{"id":100875,"date":"2021-07-30T16:22:41","date_gmt":"2021-07-30T14:22:41","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/46-python-paketov-v-repozitorii-pypi-soderzhat-potenczialno-nebezopasnyj-kod"},"modified":"2021-07-30T16:22:41","modified_gmt":"2021-07-30T14:22:41","slug":"46-python-paketov-v-repozitorii-pypi-soderzhat-potenczialno-nebezopasnyj-kod","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/46-python-paketov-v-repozitorii-pypi-soderzhat-potenczialno-nebezopasnyj-kod","title":{"rendered":"46% Python bal\u00ed\u010dkov v repozit\u00e1ri PyPI obsahuje potenci\u00e1lne nebezpe\u010dn\u00fd k\u00f3d","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Skupina v\u00fdskumn\u00edkov z Univerzity v Turku (F\u00ednsko) zverejnila v\u00fdsledky anal\u00fdzy bal\u00edkov v repozit\u00e1ri PyPI z h\u013eadiska pou\u017e\u00edvania potenci\u00e1lne nebezpe\u010dn\u00fdch kon\u0161trukci\u00ed, ktor\u00e9 m\u00f4\u017eu vies\u0165 k vzniku zranite\u013enost\u00ed. Po\u010das anal\u00fdzy 197 tis\u00edc bal\u00edkov bolo zisten\u00fdch 749 tis\u00edc potenci\u00e1lnych bezpe\u010dnostn\u00fdch probl\u00e9mov. V 46 % bal\u00edkov sa nach\u00e1dza aspo\u0148 jeden tak\u00fdto probl\u00e9m. Medzi naj\u010dastej\u0161ie sa vyskytuj\u00facimi probl\u00e9mami s\u00fa nedostatky s\u00favisiace s spracovan\u00edm v\u00fdnimiek a pou\u017e\u00edvan\u00edm funkcional\u00edt, ktor\u00e9 umo\u017e\u0148uj\u00fa zasahovanie k\u00f3du. <\/p>\n
Z 749 tis\u00edc zisten\u00fdch probl\u00e9mov je 442 tis\u00edc (41 %) ozna\u010den\u00fdch ako nev\u00fdznamn\u00e9, 227 tis\u00edc (30 %) ako probl\u00e9my s miernym rizikom a 80 tis\u00edc (11 %) ako nebezpe\u010dn\u00e9. Niektor\u00e9 bal\u00edky sa vy\u010dle\u0148uj\u00fa zo zvy\u0161ku a obsahuj\u00fa tis\u00edce probl\u00e9mov: napr\u00edklad v bal\u00edku PyGGI bolo objaven\u00fdch 2589 probl\u00e9mov, preva\u017ene s\u00favisiacich s pou\u017eit\u00edm kon\u0161trukcie «try-except-pass», v bal\u00edku appengine-sdk bolo n\u00e1jden\u00fdch 2356 probl\u00e9mov. V zna\u010dnom po\u010dte probl\u00e9mov sa tie\u017e nach\u00e1dzaj\u00fa v bal\u00edkoch genie.libs.ops, pbcore a genie.libs.parser. <\/p>\n
Je potrebn\u00e9 poznamena\u0165, \u017ee v\u00fdsledky boli z\u00edskan\u00e9 na z\u00e1klade automatizovanej statickej anal\u00fdzy, ktor\u00e1 nezoh\u013ead\u0148uje kontext pou\u017eitia t\u00fdchto kon\u0161trukci\u00ed. V\u00fdvoj\u00e1r n\u00e1stroja bandit, ktor\u00fd bol pou\u017eit\u00fd na skenovanie k\u00f3du, vyjadril n\u00e1zor, \u017ee vzh\u013eadom na vysok\u00fd po\u010det falo\u0161n\u00fdch pozit\u00edvnych v\u00fdsledkov nemo\u017eno v\u00fdsledky kontroly pova\u017eova\u0165 za zranite\u013enosti bez dodato\u010dn\u00e9ho ru\u010dn\u00e9ho presk\u00famania ka\u017ed\u00e9ho probl\u00e9mu. <\/p>\n
Napr\u00edklad analyz\u00e1tor pova\u017euje za bezpe\u010dnostn\u00fd probl\u00e9m pou\u017e\u00edvanie nespolehliv\u00fdch gener\u00e1torov n\u00e1hodn\u00fdch \u010d\u00edsel a hashovac\u00edch algoritmov, ako je MD5, pri\u010dom rovnak\u00e9 algoritmy m\u00f4\u017eu by\u0165 v k\u00f3de pou\u017eit\u00e9 na \u00fa\u010dely, ktor\u00e9 neovplyv\u0148uj\u00fa bezpe\u010dnos\u0165. Analyz\u00e1tor tie\u017e pova\u017euje za probl\u00e9m ak\u00fako\u013evek manipul\u00e1ciu s extern\u00fdmi d\u00e1tami v nezabezpe\u010den\u00fdch funkci\u00e1ch, ako s\u00fa pickle, yaml.load, subprocess a eval, no tak\u00e9to pou\u017eitie nemus\u00ed nevyhnutne s\u00favisie\u0165 s vznikom zranite\u013enosti a v skuto\u010dnosti m\u00f4\u017ee by\u0165 aplik\u00e1cia uveden\u00fdch funkci\u00ed realizovan\u00e1 bez bezpe\u010dnostn\u00e9ho rizika. <\/p>\n
Medzi kontrolami pou\u017eit\u00fdmi v \u0161t\u00fadii: <\/p>\n
\n
Pou\u017e\u00edvanie potenci\u00e1lne nebezpe\u010dn\u00fdch funkci\u00ed exec, mktemp, eval, mark_safe a podobne.\n
Nezabezpe\u010den\u00e9 nastavenie pr\u00edstupov\u00fdch pr\u00e1v pre s\u00fabory.\n
Pripojenie sie\u0165ov\u00e9ho soketu ku v\u0161etk\u00fdm sie\u0165ov\u00fdm rozhraniam.\n
Pou\u017e\u00edvanie tvrdo zadan\u00fdch hesiel a k\u013e\u00fa\u010dov v k\u00f3de.\n
Pou\u017e\u00edvanie hashovac\u00edch funkci\u00ed MD2, MD4, MD5 a SHA1.\n
Pou\u017e\u00edvanie nebezpe\u010dn\u00fdch \u0161ifrovac\u00edch met\u00f3d DES a re\u017eimov \u0161ifrovania.\n
Pou\u017e\u00edvanie nebezpe\u010dnej implement\u00e1cie HTTPSConnection v niektor\u00fdch verzi\u00e1ch Pythonu.\n
Ur\u010denie sch\u00e9my file:\/\/ v urlopen.\n
Pou\u017e\u00edvanie gener\u00e1torov pseudon\u00e1hodn\u00fdch \u010d\u00edsel pri vykon\u00e1van\u00ed kryptografick\u00fdch \u00faloh.\n
Pou\u017e\u00edvanie protokolu Telnet.\n
Pou\u017e\u00edvanie nebezpe\u010dn\u00fdch XML parserov. <\/ul>\n
\u010eal\u0161ie mo\u017en\u00e9 pozn\u00e1mky, objavenie 8 \u0161kodliv\u00fdch bal\u00ed\u010dkov v adres\u00e1ri PyPI. Pred odstr\u00e1nen\u00edm stihli probl\u00e9my bal\u00edky stiahnu\u0165 viac ako 30-tis\u00edc kr\u00e1t. Na skrytie \u0161kodlivej aktivity a ob\u00eddenie varovan\u00ed jednoduch\u00fdch statick\u00fdch analyz\u00e1torov bolo v bal\u00ed\u010dkoch pou\u017eit\u00e9 k\u00f3dovanie blokov k\u00f3du pomocou Base64 a organiz\u00e1cia z vykonania po dek\u00f3dovan\u00ed cez volanie eval. <\/p>\n
V bal\u00ed\u010dkoch noblesse, genesisbot, are, suffer, noblesse2 a noblessev2 bol odhalen\u00fd k\u00f3d na zachyt\u00e1vanie \u010d\u00edsel kreditn\u00fdch kariet a hesiel ulo\u017een\u00fdch v prehliada\u010doch Chrome a Edge, ako aj na prenos tokenov \u00fa\u010dtov z aplik\u00e1cie Discord a odosielanie \u00fadajov o syst\u00e9me, vr\u00e1tane sn\u00edmok obrazovky obsahu. V bal\u00ed\u010dkoch pytagora a pytagora2 bola pr\u00edtomn\u00e1 mo\u017enos\u0165 na\u010d\u00edtania a vykonania extern\u00e9ho spustite\u013en\u00e9ho k\u00f3du. \n Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"