{"id":102603,"date":"2021-12-13T21:36:40","date_gmt":"2021-12-13T19:36:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-kataloge-python-paketov-pypi-vyyavleny-tri-vredonosnye-biblioteki"},"modified":"2021-12-13T21:36:40","modified_gmt":"2021-12-13T19:36:41","slug":"v-kataloge-python-paketov-pypi-vyyavleny-tri-vredonosnye-biblioteki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-tri-vredonosnye-biblioteki","title":{"rendered":"Drei b\u00f6sartige Bibliotheken im Python-Paketverzeichnis PyPI entdeckt","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Im Katalog PyPI (Python Package Index) wurden drei Bibliotheken mit sch\u00e4dlichem Code identifiziert. Vor der Entdeckung der Probleme und der L\u00f6schung aus dem Katalog wurden die Pakete insgesamt fast 15.000 Mal heruntergeladen. <\/p>\n

Die Pakete dpp-client (10194 Downloads) und dpp-client1234 (1536 Downloads) wurden seit Februar verbreitet und enthielten Code zum Senden von Umgebungsvariablen, die beispielsweise Zugangsschl\u00fcssel, Token oder Passw\u00f6rter f\u00fcr Systeme der kontinuierlichen Integration oder Cloud-Umgebungen wie AWS enthalten konnten. Die Pakete sendeten auch an einen externen Host eine Liste mit Inhalten der Verzeichnisse \u201e\/home\u201c, \u201e\/mnt\/mesos\/\u201c und \u201emnt\/mesos\/sandbox\u201c.

\"Drei<\/center> <\/p>\n

Das Paket aws-login0tool (3042 Downloads) wurde am 1. Dezember im PyPI-Repository ver\u00f6ffentlicht und enthielt Code zum Herunterladen und Ausf\u00fchren einer Trojaner-Anwendung, um die Kontrolle \u00fcber Hosts zu \u00fcbernehmen, die unter Windows laufen. Bei der Wahl des Paketnamens wurde ber\u00fccksichtigt, dass die Tasten \u201e0\u201c und \u201e-\u201c nahe beieinanderliegen, sodass die Wahrscheinlichkeit besteht, dass der Entwickler \u201eaws-login0tool\u201c anstelle von \u201eaws-login-tool\u201c eingibt.

\"Drei<\/center> <\/p>\n

Problematische Pakete wurden im Rahmen eines einfachen Experiments identifiziert, bei dem mit dem Tool Bandersnatch ein Teil der PyPI-Pakete (etwa 200.000 von 330.000 Paketen im Repository) heruntergeladen und dann mit dem Tool grep Pakete herausgefiltert und analysiert wurden, in deren setup.py-Datei die Aufforderung \u201eimport urllib.request\u201c erw\u00e4hnt wird, die normalerweise zum Senden von Anfragen an externe Hosts verwendet wird.
\n
Quelle: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 PyPI (Python Package Index) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u0414\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0432 \u0441\u0443\u043c\u043c\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0443\u0441\u043f\u0435\u043b\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u043e\u0447\u0442\u0438 15 \u0442\u044b\u0441\u044f\u0447 \u0440\u0430\u0437. \u041f\u0430\u043a\u0435\u0442\u044b dpp-client (10194 \u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438) \u0438 dpp-client1234 (1536 \u0437\u0430\u0433\u0440\u0443\u0437\u043e\u043a) \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u043b\u0438\u0441\u044c \u0441 \u0444\u0435\u0432\u0440\u0430\u043b\u044f \u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u043b\u0438 \u043a\u043e\u0434 \u0434\u043b\u044f \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0438 \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u043c\u043e\u0433\u043e \u043f\u0435\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f, \u043a\u043e\u0442\u043e\u0440\u044b\u0435, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043c\u043e\u0433\u043b\u0438 \u0432\u043a\u043b\u044e\u0447\u0430\u0442\u044c \u043a\u043b\u044e\u0447\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0442\u043e\u043a\u0435\u043d\u044b \u0438\u043b\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":102604,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102603","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Im Katalog der Python-Pakete PyPI wurden drei sch\u00e4dliche Bibliotheken identifiziert | ProHoster","description":"Im Katalog PyPI (Python Package Index) wurden drei Bibliotheken mit sch\u00e4dlichem Code identifiziert. Vor der Entdeckung der Probleme und der L\u00f6schung aus dem Katalog wurden die Pakete insgesamt fast 15.000 Mal heruntergeladen.","canonical_url":"https:\/\/prohoster.info\/de\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-tri-vredonosnye-biblioteki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"de_DE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 Python-\u043f\u0430\u043a\u0435\u0442\u043e\u0432 PyPI \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0435 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 | ProHoster","og:description":"\u0412 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 PyPI (Python Package Index) \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438, \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0449\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043a\u043e\u0434. \u0414\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044f \u0438\u0437 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430 \u0432 \u0441\u0443\u043c\u043c\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0443\u0441\u043f\u0435\u043b\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c \u043f\u043e\u0447\u0442\u0438 15 \u0442\u044b\u0441\u044f\u0447 \u0440\u0430\u0437.","og:url":"https:\/\/prohoster.info\/de\/blog\/news\/v-kataloge-python-paketov-pypi-vyyavleny-tri-vredonosnye-biblioteki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-12-13T19:36:41+00:00","article:modified_time":"2021-12-13T19:36:41+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102603","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-12-13 19:36:54","updated":"2022-09-28 10:51:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/102603","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/comments?post=102603"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/posts\/102603\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/media\/102604"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/media?parent=102603"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/categories?post=102603"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/de\/wp-json\/wp\/v2\/tags?post=102603"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}