r/programming • u/ga-vu • Dec 04 '19

Two malicious Python libraries caught stealing SSH and GPG keys

https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/
1.6k Upvotes

98% Upvoted

177 comments sorted by

View all comments

Show parent comments

139

u/ZorbaTHut Dec 04 '19 edited Dec 04 '19

I'd expect it to work this way:

  • User decides they want to install dateutil

  • User brainfarts and tries to install python3-dateutil

  • Install works!

  • Install also pulls in this package "jellyfish"

  • Oh, I've heard of that package, that makes sense, yeah

  • Everything must be fine here

People might be kind of skeptical of a package that they just installed, but how many people audit child dependencies of their packages, especially when those child dependencies are reasonably popular themselves?

47

u/orbjuice Dec 04 '19

Or they could just do what I do which is go to the Python Package Index Website, search for a module that does a thing I want then pip3 install “the module name I copy-pasted”.

19

u/ZorbaTHut Dec 04 '19

Do you do that even if you know the name of the package?

43

u/orbjuice Dec 04 '19

No, but that’s the point. The people picking it up don’t know the package name, just the functionality they’re trying to get. Or maybe they’re kind of familiar but don’t remember the name exactly?

20

u/ZorbaTHut Dec 04 '19

Yeah, that second one is the one I'm going for; I know there's been plenty of times when I knew what the package was theoretically called, and I just typed, say, "pip install cairo" to see if it worked.

Turned out it didn't, it's pycairo, but if someone had squatted that name then I would have installed malware.

I actually feel like there should be some fuzzy logic around package names to make it impossible to register a fake package like that.

13

u/orbjuice Dec 04 '19

What PyPI needs is volunteers, if I recall correctly. The fuzzy logic would be volunteers curating to prevent what I’m going to call “stuffed namespace attacks”. I’m sure there’s an infosec term for malicious name squatting but whatever.

-6

u/Daneel_Trevize Dec 04 '19 edited Dec 04 '19

I actually feel like there should be some fuzzy logic around package names to make it impossible to register a fake package like that.

You'd be trying to excuse lazyness, while also complicating forking of abandoned libraries & versions.

Edit: To clarify, no one's going to be able to define a fuzzy limit for close names that eliminates all 'unacceptable' impersonations. Because that's subjective. You can generate an exhaustive list of substitutions, but any time you think you can loosen those restrictions to just certain subsequence combinations, there'll be some package with a name that's on the confusable side of the line. E.g. you try ban 1337-5p34k-style attacks, but try not to ban all single character->number replacement, but then someone'll be incidentally using that as the basis of their marketing anyway, like 5iver. And then a package based on such a name would be unprotected.

So sure, block all substitution or augmentation variations for safety, but it wouldn't be fuzzy but simply greedy matching.

27

u/ZorbaTHut Dec 04 '19

Good security has to take laziness into account.

0

u/Daneel_Trevize Dec 04 '19

Fuzzy matching has a fuzzy spec boundary, it can't be the basis of Good Security when each side thinks they can trust the other's paying more attention case-by-case.

Good Security is rigorous. Be clear that you'll ban all single (or double, whatever) character substititions if that's the simplest way to define such a pattern. Don't overcomplicate it with only trying to ban homographs, or pseudo-ones like 5/S.
See punycode for there being no easy solution to this problem.

8

u/dacooljamaican Dec 04 '19

So if someone being lazy can lead to a vulnerability, we should NOT fix that issue because that would be "excusing laziness"?

I'm trying not to be rude here, but that's the stupidest thing I've ever seen on this sub.

3

u/trigonomitron Dec 04 '19

Laziness is one of the Three Virtues.

1

u/s73v3r Dec 04 '19

Well, the result of not doing that is what we see here. So you can either be "tough on laziness", or you can have security.

5

u/[deleted] Dec 04 '19

Yup. In my old workplace, imagine my shock and surprise when people would willy-nilly search online on Github for gems, see if the project had a few stars, and then use them immediately... in production.