Slashdot Mirror
Python is a Hit With Hackers, Report Finds (zdnet.com)
After breaking into the top three most popular programming languages for the first time this month, behind C and Java, Python has also won the hearts of hackers and web nasties, according to attack statistics published this week by web security biz Imperva. From a report: The company says more than a third of daily attacks against sites the company protects come from a malicious or legitimate tool coded in Python. Imperva says that around 77 percent of all the sites the company protects, have been attacked by at least one Python-based tool. Furthermore, when the company looked at the list of tools that hackers used for their attacks, more than a quarter were coded in Python, by far the attackers' favorite tool. "Hackers, like developers, enjoy Python's advantages which makes it a popular hacking tool," the Imperva team says.
she embraces and extends it
Please....
Back in the day, we called them "script kiddies" for a reason.
Obviously, Python needs to update their Code of Conduct to exclude the web nasties from using the language to create tools to attack systems.
or simply popularity?
4wdloop
VB is easy too but the main advantage of python is that it doesn't need to be compiled and just runs as well as the vast array of network type modules that it has.
Under Wear is Also Hit with hackers, apparently coding requires ones nuts to be held by clothing.
Python: The tool to use when you want to get things done fast.
Another stupid content-free fluff piece so msmash can pretend to be k-rad. Shyeah, keep trying harder, maybe you'll get it sometime.
... the devil, the fundamentalists, the commies, the language of terrorists! /irony
USA nonsense all over the place...
Thing is used for evil -> better ban said thing.
Write fast, not necessarily read fast. Perl had a reputation for being quick and short to write code with, but such code had very questionable readability by somebody besides the author.
Remember, roughly 2/3 of software cost is maintenance, not original writing. I'm not claiming Python has a problem in this area, only saying that quick/short writing of code is only part of a real-world score.
Table-ized A.I.
I always hack naked. When you abuse someone, you can as well do it right.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Unless they deliver the Python runtime along with it (which no longer makes it "just a Python script"), any Python-based malware won't do shit on anyone's machine except for servers and web developer boxes where the runtime is already there.
Have I missed something?
Python is popular on both sides for the same reasons that others have discussed.
There are many, many books on using Python to develop tools for IT Security, systems automation, AI, you name it.
Some of the best SOAR products run Python at their core (I'm talking 6-digit packages here).
In short, yeah, it's popular with the blackhats for the same reason it's popular with the whitehats and greyhats.
Metasploit is the biggest one AFAIK and it's Ruby not Python.
That's "hackers" used unironically to refer exclusively to unauthorized intruders into computer systems on the front page of Slashdot, three times in one day. These are dark times, there is no denying.
You know, in my extensive research, Ive found indications that HACKERS HATE COBOL, you would be really hard pressed to find a COBOL rootkit attached to an email. I think we should all switch over!
"Enjoy what you're doing! If it becomes drudgery, you're doing it wrong!" - Jim Butterfield
Consider the source
I may be showing my ignorance here, but unless on the target system some python thing is being exploited, how do you know what the crackers will use? I'm not aware that calling cards are left after a system has been compromised. Sockets, file reads, etc. all look the same if they're done by a python script or a compiled program.
One thing I know, and that is that I am ignorant...
Python is a hit with anyone who has experienced it with an open mind, IMHO.
I was a perl-let-me-code-my-style! developer. Once I got past the oh-no-space-formatted-code-that-looks-all-the-same! barrier, I discovered that the freedom of "there is more than way to do it", does not really trumps the "there is one simpler and clearer pythonic way" way to do it of python.
It's a wonderful, powerful language with good libraries on nearly every programming subject.
It lets you focus more on the problem, and makes it easier to read other people code, and binds with C.
I consider it the closest language to pseudo code description of a program
If Python is an interpreted language then how does it run on computers that hackers target if the python interpreter has not also been installed? Embedding the python interpreter in the executable would seem to result in larger executable sizes which is not the sort of thing that attackers should want when writing malware since smaller programs are faster to download, take up less space and are less likely to be noticed as resource hogs. Perhaps I'm missing something here?
Looks like Sparc Flow's TTP are spreading.
http://hacklikeapornstar.com/
Cwm, fjord-bank glyphs vext quiz
Java is the second most awful language I've ever programmed in behind JavaScript. How it continues to rank in popularity is entirely beyond me. Go is the third worst, but not because it fundamentally sucks, like Java and JavaScript do. Go sucks because of all the fanboy hipsters that circle jerk with it.
Python's what they're teaching the kids these days in school! XD
I imagine Python is also a hit with people trying to do useful things as well, particularly things involving Raspberry Pi and automation - it's been taught in schools for the last few years as well. Nice try educators though, trying to make coding more 'cool' by writing this article!