Ib pawg ntawm cov kws tshawb fawb los ntawm University of Turku (Finland) tau tshaj tawm cov txiaj ntsig ntawm kev txheeb xyuas cov pob khoom hauv PyPI qhov chaw cia khoom siv rau kev siv cov kev tsim tsim phom sij uas tuaj yeem ua rau muaj qhov tsis zoo. Thaum lub sij hawm soj ntsuam ntawm 197 txhiab pob, 749 txhiab qhov teeb meem kev ruaj ntseg tau txheeb xyuas. 46% ntawm cov pob khoom muaj tsawg kawg yog ib qho teeb meem. Ntawm cov teeb meem uas tshwm sim feem ntau yog qhov tsis txaus cuam tshuam txog kev zam kev tuav thiab siv cov yam ntxwv uas tso cai hloov pauv.
Ntawm 749 txhiab qhov teeb meem tau txheeb xyuas, 442 txhiab (41%) tau sau npe tias yog me, 227 txhiab (30%) yog teeb meem nruab nrab thiab 80 txhiab (11%) yog qhov txaus ntshai. Qee pob khoom sawv tawm ntawm cov neeg coob coob thiab muaj ntau txhiab qhov teeb meem: piv txwv li, pob PyGGI tau txheeb xyuas 2589 teeb meem, feem ntau cuam tshuam nrog kev siv "sim-tsuas yog-pass" tsim, thiab pob appengine-sdk pom 2356 teeb meem. Cov teeb meem loj kuj tseem muaj nyob hauv genie.libs.ops, pbcore thiab genie.libs.parser pob.
Nws yuav tsum raug sau tseg tias cov txiaj ntsig tau txais los ntawm kev txheeb xyuas qhov zoo li qub, uas tsis suav nrog cov ntsiab lus ntawm kev siv qee cov qauv. Tus tsim tawm ntawm cov cuab yeej siv bandit, uas tau siv los luam theej cov cai, tau hais tawm lub tswv yim tias vim muaj cov txiaj ntsig tsis zoo, cov txiaj ntsig scan tsis tuaj yeem raug txiav txim siab ncaj qha rau qhov tsis zoo yam tsis muaj kev tshuaj xyuas phau ntawv ntxiv ntawm txhua qhov teeb meem.
Piv txwv li, tus kws tshuaj ntsuam xyuas txiav txim siab txog kev siv lub tshuab hluav taws xob tsis txaus ntseeg thiab hashing algorithms, xws li MD5, yog qhov teeb meem kev nyab xeeb, thaum nyob rau hauv cov cai xws li algorithms yuav siv tau rau cov hom phiaj uas tsis cuam tshuam txog kev ruaj ntseg. Lub analyzer tseem txiav txim siab txog kev ua haujlwm ntawm cov ntaub ntawv sab nraud hauv kev ua haujlwm tsis zoo xws li pickle, yaml.load, subprocess thiab eval ib qho teeb meem, tab sis qhov kev siv no tsis tas yuav cuam tshuam rau qhov tsis zoo thiab qhov tseeb ntawm kev siv cov haujlwm no tuaj yeem ua tiav yam tsis muaj kev hem thawj rau kev nyab xeeb. .
Ntawm cov kev ntsuam xyuas siv nyob rau hauv txoj kev tshawb no:
- Siv cov haujlwm ua haujlwm tsis zoo exec, mktemp, eval, mark_safe, thiab lwm yam.
- Tsis muaj kev nyab xeeb ntawm kev nkag mus rau cov ntaub ntawv.
- Txuas lub network qhov (socket) rau tag nrho cov network interfaces.
- Kev siv cov passwords thiab cov yuam sij nruj me ntsis teev hauv cov cai.
- Siv ib daim ntawv teev npe ib ntus ua ntej.
- Siv hla thiab txuas ntxiv hauv kev ntes-txhua yam kev zam tshwj xeeb handlers;
- Launching web applications raws li Flask web moj khaum nrog debugging hom enabled.
- Siv cov ntaub ntawv tsis zoo deserialization.
- Siv MD2, MD4, MD5 thiab SHA1 hash functions.
- Kev siv tsis ruaj ntseg DES ciphers thiab hom encryption.
- Kev siv HTTPSConnection tsis ruaj ntseg siv hauv qee qhov versions ntawm Python.
- Qhia meej cov ntaub ntawv: // scheme hauv urlopen.
- Siv pseudorandom tooj generators thaum ua haujlwm cryptographic.
- Siv Telnet raws tu qauv.
- Siv tsis ruaj ntseg XML parsers.
Tsis tas li ntawd, nws tuaj yeem raug sau tseg tias 8 pob tsis zoo tau kuaj pom hauv PyPI phau ntawv qhia. Ua ntej tshem tawm, cov pob teeb meem tau rub tawm ntau dua 30 txhiab zaus. Txhawm rau nkaum qhov kev ua phem thiab hla cov lus ceeb toom los ntawm cov cuab yeej zoo li qub hauv cov pob khoom, cov lej thaiv tau raug encoded siv Base64 thiab raug tua tom qab txiav txim siab siv kev hu xov tooj eval.
Cov noblesse, genesisbot, yog, raug kev txom nyem, noblesse2 thiab noblessev2 tej pob khoom muaj cov lej los cuam tshuam cov lej credit card thiab passwords khaws cia hauv Chrome thiab Edge browsers, nrog rau hloov pauv tus lej tokens los ntawm Discord daim ntawv thov thiab xa cov ntaub ntawv kaw lus, suav nrog cov screenshots ntawm cov ntsiab lus. Cov pytagora thiab pytagora2 pob khoom suav nrog lub peev xwm thauj khoom thiab ua tiav cov txheej txheem thib peb.
Tau qhov twg los: opennet.ru