What part of it is malicious? From what I understood, it is a illegal music downloading platform, and they say it opens its users to “legal action”.
Are we calling pirating-enabling software malicious now? Because pirating is ilegal?
I agree the article isn’t super clear. Reading it twice, it seems that the user credentials are exfiltrated to the C2 server (only the screenshot implies it), which definitely would be malicious.
Also a possible interpretation could be that the package advertised “just” some automations (e.g. export playlists to m3u?) and getting music metadata, whereas it was actually downloading musics locally unbeknownst to the user. Then exfiltrating the music back to the C2 server, effectively using the package’s users to mass pirate musics without exposing the pirates directly. That would indeed be malicious, especially if the package did not advertise any content downloading.
But for the last paragraph I’m extrapolating on the few info this article gives without making much sense…
EDIT: from the original article here https://socket.dev/blog/malicious-pypi-package-exploits-deezer-api-for-coordinated-music-piracy it does not seem that the musics are downloaded on the user systems then extracted to the C2 server, but rather all that’s necessary to build the download urls, including tokens tied to the victims’ account.
I see, makes sense, so the problem is that the user tokens are collected without knowledge and could be used for pirating
I assume the malicious part is that it phones home without permission, likely tracking users without their consent or informing them.
Given that a lot of Python software I see already by convention runs in a venv, which is at least somewhat-isolated from the rest of the system…I wonder how much harder it would be to make it the norm for most Python software to run in an isolated sandbox, without broader filesystem access. Like, kinda follow an Android-like model, where there’s an application-private directory and permissions that mostly make the app keep to itself.
I do run some Python software in firejail. But it’d need to be a norm for how the software is distributed. Can’t require a bunch of technical work on the part of end users.
You can’t simultaneously have an executable that operates in a private sandbox and maintain all the features expected of the programming language.
You’re correct. Not all software will be able to usefully run under such a restriction.
But I think that a very substantial amount probably can.
