Stories
Slash Boxes
Comments

SoylentNews is people

Ten Malicious Libraries Found on PyPI - Python Package Index

posted by Fnord666 on Monday September 18 2017, @01:41PM   Printer-friendly
from the dirty-libraries dept.

MrPlow writes:

Submitted via IRC for SoyCow5743

The Slovak National Security Office (NBU) has identified ten malicious Python libraries uploaded on PyPI — Python Package Index — the official third-party software repository for the Python programming language.

NBU experts say attackers used a technique known as typo-squatting to upload Python libraries with names similar to legitimate packages — e.g.: "urlib" instead of "urllib."

The PyPI repository does not perform any types of security checks or audits when developers upload new libraries to its index, so attackers had no difficulty in uploading the modules online.

Developers who mistyped the package name loaded the malicious libraries in their software's setup scripts.

"These packages contain the exact same code as their upstream package thus their functionality is the same, but the installation script, setup.py, is modified to include a malicious (but relatively benign) code," NBU explained.

[...] Indicators of compromise are available in the NBU security alert.

[...] On a side note, and unrelated to the attack vector, NBU also advises Python developers to avoid using "pip" — a Python package installer — when downloading Python libraries, as pip does not support cryptographic signatures.

Source: https://www.bleepingcomputer.com/news/security/ten-malicious-libraries-found-on-pypi-python-package-index/

Original Submission

 
This discussion has been archived. No new comments can be posted.
Ten Malicious Libraries Found on PyPI - Python Package Index | Log In/Create an Account | Top | 21 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 2) by fritsd on Monday September 18 2017, @03:43PM (1 child)

    by fritsd (4586) on Monday September 18 2017, @03:43PM (#569778) Journal

    That issue, that I just referenced in my previous comment, talked about using something called "distutils" to bootstrap "setuptools".

    Can anyone more familiar with Python (i.e. anyone) explain how I can install distutils from source? Do I need pip, wheel, python-six, python-setuptools, python3-setuptools and python-nose-of-the-camel-in-the-tent pre-installed??

    I've got python2.7 and python3.5, if that helps.

    Starting Score:    1  point
    Karma-Bonus Modifier   +1  
    Total Score:   2  

  • (Score: 0) by Anonymous Coward on Monday September 18 2017, @04:12PM

    by Anonymous Coward on Monday September 18 2017, @04:12PM (#569786)

    Distutils and ensurepip are in the standard library. If you install python, then both are installed by default. If you want to install distutils from source, then all you need to do is install CPython from source (or copy the .py files into the path, I suppose). Also of note, when you install CPython from source or using official installers, it will automatically run ensurepip, which uses vendorized wheels to install setuptools and pip into the site-packages using distutils.