“Exploring the Risks of PyPI Malware and its Evasion Techniques”

Python Package Hides Malware in Compiled Code, Increasing Risks of Supply Chain Attacks

In an unusual twist on software supply chain attacks, cybersecurity researchers have discovered a Python package that conceals malware inside of compiled code, making it more difficult to detect by traditional methods. Python is an open-source, interpreted programming language. Hackers have used Python open-source repositories like PyPI to load malware. Researchers reported a malicious package, called “fshec2,” to PyPI administrators on April 17th. PyPI administrators immediately removed the package. The package contained all the malicious functionalities inside its compiled code, making it difficult to detect. PyPI administrators also acknowledged this type of attack is new and interesting. “This behavior is a bit more sophisticated, and it shows that the attackers are evolving and paying attention to the better detections that are being rolled out,” says an expert.

Unpacking fshec2

The fshec2 package is different from typical malware as it distributes its malware overtly in compiled code, making it easier to distribute to computers without detection. In contrast, hackers plant tools that connect to their servers and download the malicious code. To hide malicious tendencies, hackers often use obfuscation – which is like taking any clues the good guys might pick up on, and turning it to spaghetti. In comparison, fshec2 front-loaded its malicious functionalities and avoided any obfuscation techniques. The package contained three files, including a compiled bytecode that contained malicious code. It allowed hackers to download commands from a remote server and collect usernames, hostnames, and directory listings.

The Problem with Bytecode

Bytecode is a compiled set of instructions for the Python Virtual Machine. It exists somewhere between source code and being a machine binary. Raw bytecode is not human-readable. When malicious code is loaded into bytecode, it skirts by software scanners. PyPI does not account for malware hidden in bytecode, creating a dilemma for security experts. Should they provide too much protection, users would experience more lag and a significant delay in uploading files. In addition, malware buried in bytecode is difficult to detect by third-party security software as traditional software scanners cannot recognize bytecode.

Fighting Back Against Cyberattacks

Maintaining cybersecurity is becoming a significant challenge for PyPI administrators. Cybersecurity threat actors have been using PyPI, inventing new and harmful Python packages, and openly advertising their goods on the platform. PyPI continuously increases its investment in cybersecurity, including creating new roles to hire dedicated security experts. To address the issue, PyPI announced that users who maintain projects and organizations on the platform will be required to protect their accounts with two-factor authentication to reduce future threats.

Conclusion: Advice for Individuals and Organizations

The emergence of malware buried in Python packages highlights the need for individuals and organizations to be cautious when installing packages from open-source repositories. Organizations must continuously update their security systems using the latest encryption and software scanners to prevent new and sophisticated cybersecurity threats. Users of PyPI must comply with the new two-factor authentication process to protect their projects and organizations. As observed by Ashlee Benge, “Now it becomes a little more difficult than just pushing a malicious library out to PyPI and waiting for someone to download it. Now we’re seeing that these guys have to work a little harder.”