Par Max Kahan − Salle Rosalind Franklin

pip install malware

pip install malware: it’s that easy. Almost all projects depend on external packages, but did you know how easy it can be to install something nasty instead of the dependency you want? I'll be showing this live, as I make malware and infect my own computer with it during the talk!

You might remember classic typosquatting examples like goggle.com, but it’s now common to see malicious code hidden in spoofed or otherwise fraudulent PyPI packages or nested dependencies. Malware developers can also use techniques like starjacking to appear legitimate, so these unpleasant packages become even more difficult to spot. It’s estimated that over 3% of packages on PyPI could be using this technique.

By the end of this talk, you’ll know how to protect yourself when installing and updating dependencies and you’ll leave with a checklist to follow to help you stay safe in future.

Support

---

Notes personnelles

• disclamer
  • malware evolve
  • not a security talk
• cost of malware
  • 4.06 M€ cost of malware
  • 19% are from
• developers are now a target
• PyPI risk
  • typo squatting
    • estimated typosquatted package on PyPI: 3%
    • downloaded estimated 0.5%
    • real malware targetting requests
      • rrequests, _equests, …
    • pycurl -> libcurl
    • dot-env
  • repo change for a malicious mainten€r
  • starjacking
    • malwar shows lots of popularity on github
• DEMO Do not install this: https://pypi.org/project/not-the-vonage-python-sdk/
• What ca I do
  • consider defensing typosquatting
  • preempt you package typo errors
  • do no type package name, use config files
  • use scanning tools