Slashdot Mirror
Twelve Malicious Python Libraries Found and Removed From PyPI (zdnet.com)
An anonymous reader writes:
A software security engineer has identified 12 Python libraries uploaded on the official Python Package Index (PyPI) that contained malicious code. The 12 packages used typo-squatting in the hopes a user would install them by accident or carelessness when doing a "pip install" operation for a mistyped more popular package, like Django (ex: diango).
Eleven libraries would attempt to either collect data about each infected environment, obtain boot persistence, or even open a reverse shell on remote workstations. A twelfth package, named "colourama," was financially-motivated and hijacked an infected users' operating system clipboard, where it would scan every 500ms for a Bitcoin address-like string, which it would replace with the attacker's own Bitcoin address in an attempt to hijack Bitcoin payments/transfers made by an infected user.
54 users downloaded that package -- although all 12 malicious packages have since been taken down.
Four of the packages were misspellings of django -- diango, djago, dajngo, and djanga.
Eleven libraries would attempt to either collect data about each infected environment, obtain boot persistence, or even open a reverse shell on remote workstations. A twelfth package, named "colourama," was financially-motivated and hijacked an infected users' operating system clipboard, where it would scan every 500ms for a Bitcoin address-like string, which it would replace with the attacker's own Bitcoin address in an attempt to hijack Bitcoin payments/transfers made by an infected user.
54 users downloaded that package -- although all 12 malicious packages have since been taken down.
Four of the packages were misspellings of django -- diango, djago, dajngo, and djanga.
Which one, Terry Jones?
I've always hated to deal with python in free software game projects because it moves too fast. I've had so many projects where because of old python, part of the project wouldn't work anymore. Its hard when you have a project with two or three developers on it and then now you have all these old python scripts and now they don't work anymore because your distribution upgrades your python. Alright, I don't even know how old it is, but when when you are dealing with these tiny teams of people, you are just going to have old code. Someday, I will take the python out of my project and replace it with a language I made up that never changes. I am a better person than the Python maintainers and I would never subject my users to the evils of backwards incompatibility.
This is why I dont trust other people's code
Same here. Except you don't need "a language I made up", practically any other programming language maintains backward compatibility.
With Python, when it says "requires Python 2.6â, it means EXACTLY 2.6, not "at least 2.6". Python 2.7 won't work because they completely break compatibility even in point releases. I can't think of any other language that does that.
I have stuff written in C, Perl, shell, even Javascript fifteen years ago that still runs just fine. Other languages ADD capabilities instead of randomly redefining basic things every year or two.
Swift
All the other languages that I can think of that do it are functional academic languages like Haskell.
What you say is true, but it's even worse than that. Like you said, it means EXACTLY 2.6. Not even 2.6.1 will work, so if a security issue is found and fixed and patched in Python, you have to recompile your software to fix the issue. Along with abysmal performance, it's one of the most annoying things about supporting Python in production.
-=Lothsahn=-
There are several languages/communities that use unsecured repository systems for managing code projects. For example, Composer with PHP. Maintainers are like "oh we'll find it quick if there's a problem", and they don't do anything with it. These are not set up *anything* like linux distribution repositories, for example Ubuntu and RHEL software packages. Problem is, using code signing makes it difficult for people to add their code to the repositories, in other words "to use it" - security hampers adoption, so it's prioritized like a step-child at Christmas.
And these packages are all semi-blindly pulled as building blocks for software packages. Most of the newer sites/applications built using these repositories are exposed to malfeasance on every single build. Since there's so much weight put on CI/CD today - there are going to be a lot of configurations where an app will update and pull a malicious package and as long as any associated tests aren't interfered with, there won't be any bells ringing.
You must be doing it wrong. I have literally never had python break due to versioning.
>I can't think of any other language that does that. I recall issues with Lua and Lua bindings as well.
This is simply wrong. No you do not. I've migrated hundreds of projects through every python transition from 2.6 to 3.7, and never had these problems. I say this with sympathy, not condemnation, because we've all been there in one topic or another, but you must be doing it wrong.
> abysmal performance "The performance of uvloop-based asyncio [Python async networking/webserver] is close to that of Go programs." https://magic.io/blog/uvloop-b...
"practically any other programming language maintains backward compatibility."
Bwahahahahah. You must be new to this. This happens with a lot of programming languages, you just aren't paying attention. That jump to gcc 5.x and 6.x is enough to invalidate pretty much everything you complained about.