https://blog.sonatype.com/python-packages-upload-your-aws-keys-env-vars-secrets-to-web * Blog * DevZone * Contact Us PATH:/python-packages-upload-your-aws-keys-env-vars-secrets-to-web QUERY: DOMAIN:blog.sonatype.com * Products + Software composition Analysis + Nexus Lifecycle Eliminate OSS risk across the entire SDLC + Nexus Firewall Protect your artifact repository from OSS risk + Code Quality Analysis + Sonatype Lift Find and fix security, performance, and reliability bugs during code review. + Repository MANAGEMENT + Nexus Repository Manage binaries and build artifacts + CONTAINER SECURITY + Nexus Container Identify and remediate OSS risk in containers for build and run-time protection + COMPLETE PLATFORM Automate your software supply chain security against every attack with Sonatype's suite of products. * Solutions + For Professionals + Developers + Application Security + DevSecOps + Legal & Compliance + For Industries + Government + Financial Services + Manufacturing + Technology + Healthcare * Pricing * Resources + Content + Spring4Shell Resource Center + Log4j Resource Center + Whitepapers & eBooks + Webinars + Videos + Events + INtegrations & FREE TOOLS + Sonatype Integrations + Sonatype OSS Index + Nexus Vulnerability Scanner + Free Developer Tools + CUSTOMER PORTAL + My Sonatype Customer support, product guides & documentation, online courses, community, and more. * Company + About Us + About Sonatype + About Nexus Intelligence + Partner Program + Careers at Sonatype + Press Releases + Media + Blog + Contact Us * DevZone * BOOK A DEMO * CHAT NOW * Products * Solutions * Pricing * Resources * Company * BOOK A DEMO * CHAT NOW Software composition analysis * Nexus Lifecycle Eliminate OSS risk across the entire SDLC. * Nexus Firewall Protect Nexus and Artifactory repos from OSS risk. Container Security * Nexus Container Identify and remediate OSS risk in containers for build and run-time protection. CODE QUALITY ANALYSIS * Sonatype Lift Find and fix security, performance, and reliability bugs during code review. Repository MANAGEMENT * Nexus Repository Manage binaries and build artifacts. Complete Platform * Automate your software supply chain security against every attack with Sonatype's suite of products. Book a Demo * Get a personalized demo and get your questions answered from a Sonatype expert. For Professionals * Developers * Application Security * DevSecOps * Legal & Compliance For Industries * Government * Financial Services * Manufacturing * Technology * Healthcare Content * Spring4Shell Resource Center * Log4j Resource Center * Whitepapers & eBooks * Webinars * Videos * Customer Stories * Events CUSTOMER Portal * Training & Workshops * My Sonatype Customer support, product guides & documentation, learning paths, community, and more. Integrations & Free Tools * Free Developer Tools * Sonatype Integrations * Sonatype OSS Index * Nexus Vulnerability Scanner About us * About Sonatype * About Nexus Intelligence * Analyst Recognition * Partners * Careers at Sonatype * Press Releases * Media * Blog Contact Us Sonatype Blog Python packages upload your AWS keys, env vars, secrets to the web Share on Facebook Share on LinkedIn Share on Twitter Share on Email June 23, 2022 By Ax Sharma 5 minute read time SHARE: Share on Facebook Share on LinkedIn Share on Twitter Share on Email [blog-secur] Last week, Sonatype discovered multiple Python packages that not only exfiltrate your secrets--AWS credentials and environment variables but rather upload these to a publicly exposed endpoint. These packages were discovered by Sonatype's automated malware detection system, offered as a part of Nexus platform products, including Nexus Firewall. On a further review, we deemed these packages malicious and reported them to PyPI. These malicious packages, assigned sonatype-2022-3475 and sonatype-2022-3546 are: * loglib-modules -- appears to target developers familiar with the legitimate 'loglib' library. * pyg-modules -- appears to target developers familiar with the legitimate 'pyg' library. * pygrata -- unknown target * pygrata-utils -- unknown target; contains identical malicious code to that seen in 'loglib-modules' * hkg-sol-utils -- unknown target Analyzed by Sonatype security researchers Jorge Cardona and Carlos Fernandez, some of these packages either contain code that reads and exfiltrates your secrets or use one of the dependencies that will do the job. For example, the 'loglib-modules' and 'pygrata-utils' packages contain malicious code, part of which is shown below. [image-png-Jun-17-2022-03-47-26-21-PM] Line 21 connects to a 169.254 IP address, which belongs to the link-local IP range and is used by Amazon EC2 instances to provide the EC2 Instance Metadata Service. The URL 'hxxp://169.254.169[.]254/latest/meta-data/iam/ security-credentials/' is known to return IAM role information pertaining to an EC2 cloud instance. Subsequent lines of code (Line 22-26) peek into AWS credentials, network interface information, and environment variables. The script then attempts to upload the collected credentials, and metadata to one or more endpoints hosted on the PyGrata domain: hxxp://graph.pygrata[.]com:8000/upload [image-png-Jun-17-2022-03-46-23-76-PM] The usage of the PyGrata[.]com domain and the names of some of the malicious packages (pygrata-utils) weren't imminently clear to us as to their purpose. Interestingly though, our researchers noticed the endpoints collecting these credentials were exposing this data to just about anyone on the web. Going up a directory level showed us hundreds of TXT files containing sensitive information and secrets like those shown in the redacted screenshot below: [image-png-Jun-17-2022-03-03-40-74-PM] While the behavior appears to be suspicious, to give the benefit of the doubt and rule out ethical red team testing, we reached out to the owners of the 'pygrata[.]com' domain to understand the issue but did not hear back. Following our email to the domain owners, however, the endpoint leaking the TXT files started timing out, indicating it had been shut down to the public. Although some portions of the mysterious PyGrata domain remain up at the time of writing: [image-png-Jun-22-2022-09-16-45-32-AM] The malicious package 'loglib-modules' had already been yanked at the time of our discovery, but was restored the following day by its maintainer prompting us to notify PyPI again: [image-png-Jun-17-2022-03-12-13-13-PM] Whereas, 'loglib-modules' and 'pygrata-utils' contain malicious code shown above that steals secrets, packages like 'pygrata' simply use one of these packages as a dependency. [image-png-Jun-17-2022-03-10-04-36-PM] As such, with the problematic packages 'pygrata-utils' having been gone from the PyPI registry, following our report to PyPI, there isn't much that existing versions of 'pygrata' can achieve: [image-png-Jun-22-2022-09-20-41-64-AM] It remains yet to be known who the actors behind these packages are and what is their ultimate goal. It isn't hard to see how a Python package called 'loglib-modules' can be aimed at devs using loglib. But what about PyGrata, and its domains? Who is being targeted by these? Were the stolen credentials being intentionally exposed on the web or a consequence of poor opsec practices? Should this be some kind of legitimate security testing, there surely isn't much information at this time to rule out the suspicious nature of this activity. Sonatype reported all of these packages, including the problematic 'pygrata-utils', 'pygrata', and others to the PyPI security team out of caution and these packages were taken down. Nexus Firewall users remain protected This discovery follows our last week's report of several dozen malicious packages including npm package 'flame-vali' that attempted to disable Windows Defender multiple times before dropping a trojan. Sonatype remains at the forefront of timely discoveries and reporting attacks targeting OSS developers, like the ones discussed above. Users of Nexus Firewall can rest easy knowing that such malicious packages would automatically be blocked from reaching their development builds. U-cofx0-oAHuk7B8hQ_0YBbx7E9LQSW04uag5iP4Q7mdyUWkjohGvAiYYykP8LnvXzbz7CUADYOIt3X4KVAozG7Sxz7PFEffVVl_TP2LufuKfXcPzVvjvk3Br_IPtFK9776-HbUE Nexus Firewall instances will automatically quarantine any suspicious components detected by our automated malware detection systems while a manual review by a researcher is in the works, thereby keeping your software supply chain protected from the start. Sonatype's world-class security research data, combined with our automated malware detection technology safeguards your developers, customers, and software supply chain from infections. Tags: vulnerabilities, Nexus Firewall, python, PyPI, featured, malware prevention, DevZone Ax Sharma Written by Ax Sharma Ax is a Security Researcher at Sonatype and Engineer who holds a passion for perpetual learning. His works and expert analyses have frequently been featured by leading media outlets. Ax's expertise lies in security vulnerability research, reverse engineering, and software development. In his spare time, he loves exploiting vulnerabilities ethically and educating a wide range of audiences. Follow me on: * AUTHOR POSTS * TOPIC POSTS * [blog-Thisw] This Week in Malware--show me your secrets! Ax Sharma * [blog-secur] Python packages upload your AWS keys, env vars, secrets to the web Ax Sharma * [blog-Thisw] This Week in Malware--killing Windows Defender with an npm package Ax Sharma * [blog-Thisw] This Week in Malware--show me your secrets! vulnerabilities * [blog-secur] Python packages upload your AWS keys, env vars, secrets to the web vulnerabilities * [blog-Thisw] This Week in Malware--killing Windows Defender with an npm package vulnerabilities SON_logo_white@2x copy trimmed Twitter LinkedIn Facebook YouTube GitHub Products * Full-Spectrum Platform * Sonatype Lift * Nexus Lifecycle * Advanced Legal Pack * Nexus Lifecycle Foundation * Nexus Firewall * Nexus Container * Nexus Auditor * Nexus Repository * Pricing Free Tools * Nexus Vulnerability Scanner * OSS Index * Free Developer Tools * Nexus Integrations * CVE Insights Solutions * Developers * AppSec * DevSecOps * Legal & Compliance * Government * Financial Services * Manufacturing * Technology * Healthcare Resources * Sonatype Blog * Whitepapers & eBooks * Webinars * Videos * Customer Stories * Events Customer Portal * Training & Workshops * My Sonatype * Guides * Documentation * Online Courses * Customer Support Company * About Sonatype * Analyst Recognition * Nexus Intelligence * Partners * Investors * Press Releases * Media Coverage * Press Kit * Careers * Contact Us SON_logo_white@2x copy trimmed * Products * Free Tools * Solutions * Resources * About * Pricing * Twitter * LinkedIn * Facebook * YouTube * GitHub Sonatype Headquarters - 8161 Maple Lawn Blvd #250, Fulton, MD 20759 Tysons Office - 8281 Greensboro Drive - Suite 630, McLean, VA 22102 Australia Office - 60 Martin Place Level 1, Sydney, NSW 2000, Australia London Office -168 Shoreditch High Street, E1 6HU London Copyright (c) 2008-present, Sonatype Inc. All rights reserved. Includes the third-party code listed here. Sonatype and Sonatype Nexus are trademarks of Sonatype, Inc. Apache Maven and Maven are trademarks of the Apache Software Foundation. M2Eclipse is a trademark of the Eclipse Foundation. All other trademarks are the property of their respective owners. Terms of Service Privacy Policy Modern Slavery Statement Event Terms and Conditions Do Not Sell My Personal Information