{"id":102339,"date":"2021-11-20T09:36:56","date_gmt":"2021-11-20T07:36:57","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-kataloge-pypi-vyyavleny-vredonosnye-biblioteki-ispolzuyushhie-cdn-pypi-dlya-skrytiya-kanala-svyazi"},"modified":"2021-11-20T09:36:56","modified_gmt":"2021-11-20T07:36:57","slug":"v-kataloge-pypi-vyyavleny-vredonosnye-biblioteki-ispolzuyushhie-cdn-pypi-dlya-skrytiya-kanala-svyazi","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-kataloge-pypi-vyyavleny-vredonosnye-biblioteki-ispolzuyushhie-cdn-pypi-dlya-skrytiya-kanala-svyazi","title":{"rendered":"Malicious libraries using the PyPI CDN to obscure communication channels have been identified in the PyPI catalog.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The PyPI (Python Package Index) catalog has revealed 11 packages containing malicious code. Before the issues were detected, these packages were downloaded approximately 38,000 times. The identified malicious packages are notable for employing intricate methods to conceal connections to the attackers' servers. <\/p>\n
\n
importantpackage (6305 downloads), important-package (12897) \u2014 established a connection with an external server pretending to connect to pypi.python.org to provide shell access to the system (reverse shell) and used the program trevorc2 to hide the communication channel.\n
pptest (10001), ipboards (946) \u2014 used DNS as a communication channel to transmit system information (the first packet contained the hostname, working directory, internal and external IP, in the second \u2014 the username and hostname).\n
owlmoon (3285), DiscordSafety (557), yiffparty (1859) \u2014 detected the Discord service token in the system and sent it to an external host.\n
trrfab (287) \u2014 sent the identifier, hostname, and contents of \/etc\/passwd, \/etc\/hosts, \/home to an external host.\n
10Cent10 (490) \u2014 established a reverse shell connection with an external host.\n
yandex-yt (4183) \u2014 displayed a message about system compromise and redirected to a page with additional information on further actions, provided through nda.ya.ru (api.ya.cc). <\/ul>\n
Particular attention should be paid to the method of contacting external hosts used in the packages importantpackage and important-package, which used the Fastly content delivery network to hide their activity applied in the PyPI directory. In fact, requests were sent to the pypi.python.org server (including specifying the name python.org in the SNI within the HTTPS request), but at the same time, the HTTP header 'Host' was set to the name of the server controlled by the attackers (sec.forward.io.global.prod.fastly.net). The content delivery network redirected such requests to the attackers' server, using the TLS connection parameters with pypi.python.org during data transmission. <\/p>\n
The infrastructure of PyPI is supported by the Fastly content delivery network, which uses a transparent Varnish proxy for caching standard requests and processes TLS certificates at the CDN level, rather than at the end servers, to organize the forwarding of HTTPS requests through the proxy. Regardless of the target host, requests are sent to the proxy, which determines the required host based on the HTTP header 'Host', and domain names<\/a> of hosts are tied to common IP addresses of CDN load balancers for all Fastly clients. <\/p>\n
![\"Malicious](\"\/wp-content\/uploads\/2021\/11\/9e9761458829291aded542d2bcae4cf3.jpg\")
<\/center> <\/p>\n