A few days ago, it was announced that 11 packages containing malicious code were identified in the PyPI directory (Python package index).
Before the problems were identified, the packages were downloaded approximately 38 times in total , and it is worth noting that the detected malicious packages stand out for their use of sophisticated methods to conceal communication channels with the attackers' servers.
The packages that were discovered are the following:
- importantpackage (6305 downloads) e important-package (12897): these packages establish a connection to an external server under the guise of connecting to pypi.python.org to provide shell access to the system (reverse shell) and use the trevorc2 program to hide the communication channel.
- pptest (10001) and ipboards (946): used DNS as a communication channel to transfer information about the system (in the first packet, the hostname, working directory, internal and external IP, in the second, the username and the hostname).
- owlmoon (3285) DiscordSafety (557) and yiffparty (1859) - Identify the Discord service token on the system and send it to an external host.
- trrfab (287): Sends the identifier, hostname, and content of / etc / passwd, / etc / hosts, / home to an external host.
- 10cent10 (490) - Established a reverse shell connection to an external host.
yandex-yt (4183): showed a message about the compromised system and redirected to a page with additional information about additional actions, issued through nda.ya.ru (api.ya.cc).
Therefore, it is mentioned that special attention should be paid to the method of accessing external hosts used in the importantpackage and important-package packets, which use the Fastly content delivery network used in the PyPI catalog to hide their activity.
In fact, the requests were sent to the pypi.python.org server (including specifying the name of python.org in SNI within the HTTPS request), but the name of the server controlled by the attacker was set in the HTTP header "Host ». The content delivery network sent a similar request to the attacker's server, using the parameters of the TLS connection to pypi.python.org when transmitting data.
PyPI 's infrastructure is powered by the Fastly Content Delivery Network, which uses Varnish's transparent proxy to cache typical requests and employs CDN-level TLS certificate processing, rather than endpoint servers, to forward HTTPS requests through the proxy. Regardless of the destination host, requests are sent to the proxy, which identifies the desired host by the HTTP "Host" header, and domain hostnames are bound to typical CDN load balancer IP addresses found on all Fastly clients.
The attackers' server is also registered with the CDN Fastly , which offers free plans and even allows anonymous registration. It's worth noting that a similar scheme is used to send requests to the victim when a "reverse shell" is created, but initiated by the attacker's host. From the outside, interaction with the attacker's server appears to be a legitimate session with the PyPI directory, encrypted with the PyPI TLS certificate. A similar technique, known as "domain fronting," was previously used to actively conceal the hostname by bypassing blocks. This involved using the HTTPS option provided by some CDNs, specifying the dummy host in the SNI, and passing the requested hostname in the HTTP host header within a TLS session.
To hide the malicious activity, the TrevorC2 package was additionally used, which makes the interaction with the server similar to normal web browsing.
The pptest and ipboards packets used a different approach to hide network activity, based on encoding useful information in requests to the DNS server. Malicious software transmits information by performing DNS queries, in which data transmitted to the command and control server is encoded using the base64 format in the subdomain name. An attacker accepts these messages by controlling the domain's DNS server.
Finally, if you are interested in learning more, you can find the details at the following link.