Python Malware Starting to Employ Anti-Debug Techniques

Re:Python Malware Starting to Employ Anti-Debug Techniques by zzzeek on Friday December 23, 2022 @03:43PM (#34110399)

that doesn't make much sense and there are necessary uses for eval() /exec(), mostly for dynamic creation of code:

For example here's Python dataclasses in the standard library using exec() to create the `__init__` and other methods that go on your dataclass:

https://github.com/python/cpython/blob/main/Lib/dataclasses....

Here's Pydantic using it for a jupyter notebook check:

https://github.com/pydantic/pydantic/blob/594effa279668bd955...

here's Pytest using it to rewrite modules so that functions like assert etc. are instrumented by pytest:

https://github.com/pytest-dev/pytest/blob/eca93db05b6c5ec101...

Here's the decorator module using it (as is the only way to do this in Python) to create a signature matching decorator for an arbitrary function:

https://github.com/micheles/decorator/blob/ad013a2c1ad796996...

All of these libraries are completely secure as eval/exec are used with code fragments that are generated by the libraries, not based on untrusted input.

eval() /exec() are not running executable files, just Python code, the same way all the rest of the package is already doing.

[ Parent | on HN ]

Re:Python Malware Starting to Employ Anti-Debug Techniques by bb88 on Saturday December 24, 2022 @06:58PM (#34122510)

Right, and each one of those is a potential exploit waiting to happen.

[ Parent | on HN ]

Re:Python Malware Starting to Employ Anti-Debug Techniques by zzzeek on Sunday December 25, 2022 @11:16AM (#34128415)

please support your assertion. I would also recommend opening CVEs detailing your discovered attack vectors, especially that of Python dataclasses in the standard library, which are in very widespread use. If you do in fact have some insight on how Python dataclasses are an "exploit waiting to happen", I think it's irresponsible to just sit on that information.

[ Parent | on HN ]