Summary:
Researchers discovered a new attack that employed compiled Python code to evade detection, potentially marking the first supply chain attack to exploit the execution of Python byte code (PYC) files. This discovery comes at a time when there has been an increase in malicious submissions to the Python Package Index (PyPI), posing a significant supply chain risk due to the limited detection capabilities of security tools that primarily scan Python source code (PY) files.[/subscribe_to_unlock_form]
Summary:
Researchers discovered a new attack that employed compiled Python code to evade detection, potentially marking the first supply chain attack to exploit the execution of Python byte code (PYC) files. This discovery comes at a time when there has been an increase in malicious submissions to the Python Package Index (PyPI), posing a significant supply chain risk due to the limited detection capabilities of security tools that primarily scan Python source code (PY) files.[emaillocker id="1283"]
The suspicious package, named fshec2, was reported to the PyPI security team and promptly removed from the PyPI repository. the package drew attention during a scan. The analysis of the compiled binary revealed suspicious behaviors, including the presence of IP address-referencing URLs and the execution of a file. Further examination of the package exposed a file, full.pyc, which contained interesting behaviors and revealed the true nature of the package upon decompilation. Malicious actors constantly strive to avoid detection by employing obfuscation techniques. Malware authors have utilized obfuscation tools like Hyperion and Kramer to counter improved detection capabilities of security companies monitoring PyPI and other public package repositories.
The command-and-control (C2) infrastructure revealed that the web host used in the attack unintentionally exposed valuable information due to configuration errors. The web host's debug mode allowed access to a Django application, revealing reachable host paths and leaked filenames researchers were able to identify successful attacks where usernames, hostnames, and directory listings were harvested.
The fshec2 attack serves as a reminder that source-code analysis alone is insufficient for detecting malicious functions hidden within compiled Python byte code. Traditional security solutions focused on package security inspection and source-code analysis may overlook this type of threat. Researchers analyze binary files like compiled Python byte code, which provides defenders with the means to extract indicators of malicious intent and enhance security assessments.
Threat Profile:
References:
The following reports contain further technical details:
https://thehackernews.com/2023/06/malicious-pypi-packages-using-compiled.html
[/emaillocker]