Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.lang.python > #80347
| Path | csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.xs4all.nl!newsfeed3a.news.xs4all.nl!xs4all!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail |
|---|---|
| Return-Path | <ian.g.kelly@gmail.com> |
| X-Original-To | python-list@python.org |
| Delivered-To | python-list@mail.python.org |
| X-Spam-Status | OK 0.098 |
| X-Spam-Evidence | '*H*': 0.81; '*S*': 0.00; 'python.': 0.02; 'subject:Python': 0.06; 'plenty': 0.07; 'alternatives': 0.09; 'runs': 0.10; 'python': 0.11; 'blocked': 0.16; 'hackers': 0.16; 'phases.': 0.16; 'rarely': 0.16; 'wrote:': 0.18; 'machine': 0.22; 'email addr:gmail.com>': 0.22; 'sort': 0.25; '>': 0.26; 'header:In-Reply-To:1': 0.27; 'host': 0.29; 'message- id:@mail.gmail.com': 0.30; 'url:06': 0.31; 'open': 0.33; 'received:google.com': 0.35; 'there': 0.35; 'machine.': 0.36; 'two': 0.37; 'server': 0.38; 'nov': 0.38; 'to:addr:python-list': 0.38; 'fact': 0.38; 'pm,': 0.38; 'channel': 0.39; 'to:addr:python.org': 0.39; 'according': 0.40; 'skip:\xc2 10': 0.60; 'browser': 0.61; 'simple': 0.61; 'first': 0.61; 'happen': 0.63; 'choose': 0.64; 'needing': 0.65; 'occur': 0.65; 'virus': 0.65; 'url:co': 0.67; 'anything.': 0.68; 'frequently': 0.68; 'url:11': 0.68; 'targeted': 0.69; 'virus.': 0.74; 'url:2014': 0.84; 'device,': 0.91; 'edwards': 0.91 |
| DKIM-Signature | v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=etKLMMjRB05KU41PN6UA9bdg7/JbgP3vqiHHzNnjl9M=; b=mlHogqINbUMiWtW4DmfuQx8n1KuT/jV7jlg8WboCbrqLZsCTQD6lCw1jEPM/3C06gK n1XCFQCrnyJxCwR0gol/mXBOZPS+6sIbbeskC21EzXrBqYGfKwuHGs9CTOJgbKaG3mD2 TKsYD1TH6/Qan4q+C8wRZ4sl1sTud8H2WGiL7ynR2HF+m0rXgA+jPw3ismS1xEIEGsQQ IM3NH9SHCCDP/MaP5Z6pEQzkjdLz9z5567+dHcSW8ouSmJVSpkt38ZxgeDz3LZBWBFRU eDuyXICV/F7ZAx6mITA9WDdq09vk0CWjTtcMFuOMeZMtGEIyH1gQfWM7DH7fBJRzRTBV 26Jw== |
| MIME-Version | 1.0 |
| X-Received | by 10.66.234.72 with SMTP id uc8mr9367210pac.51.1415335380137; Thu, 06 Nov 2014 20:43:00 -0800 (PST) |
| In-Reply-To | <1661847952437024668.827511sturla.molden-gmail.com@news.gmane.org> |
| References | <m3g3o5$gum$1@reader1.panix.com> <1661847952437024668.827511sturla.molden-gmail.com@news.gmane.org> |
| Date | Thu, 6 Nov 2014 21:43:00 -0700 |
| Subject | Re: Python has arrived! |
| From | Ian Kelly <ian.g.kelly@gmail.com> |
| To | Python <python-list@python.org> |
| Content-Type | multipart/alternative; boundary=047d7b111d2592416105073d7260 |
| X-BeenThere | python-list@python.org |
| X-Mailman-Version | 2.1.15 |
| Precedence | list |
| List-Id | General discussion list for the Python programming language <python-list.python.org> |
| List-Unsubscribe | <https://mail.python.org/mailman/options/python-list>, <mailto:python-list-request@python.org?subject=unsubscribe> |
| List-Archive | <http://mail.python.org/pipermail/python-list/> |
| List-Post | <mailto:python-list@python.org> |
| List-Help | <mailto:python-list-request@python.org?subject=help> |
| List-Subscribe | <https://mail.python.org/mailman/listinfo/python-list>, <mailto:python-list-request@python.org?subject=subscribe> |
| Newsgroups | comp.lang.python |
| Message-ID | <mailman.15552.1415335387.18130.python-list@python.org> (permalink) |
| Lines | 61 |
| NNTP-Posting-Host | 2001:888:2000:d::a6 |
| X-Trace | 1415335387 news.xs4all.nl 2953 [2001:888:2000:d::a6]:46882 |
| X-Complaints-To | abuse@xs4all.nl |
| Xref | csiph.com comp.lang.python:80347 |
Show key headers only | View raw
[Multipart message — attachments visible in raw view] - view raw
On Nov 6, 2014 10:47 PM, "Sturla Molden" <sturla.molden@gmail.com> wrote: > > Grant Edwards <invalid@invalid.invalid> wrote: > > According to > > http://www.theregister.co.uk/2014/11/06/hackers_use_gmail_drafts_as_dead_drops_to_control_malware_bots : > > > > "Attacks occur in two phases. Hackers first infect a targeted > > machine via simple malware that installs Python onto the device, > > [...]" > > > > A virus that runs on Python. It had to happen sooner or later. It's not a Python virus. The infection vector can be anything. The interesting part is that they're using browser automation to open a real-time, encrypted, virtually undetectable and untraceable channel to the malware over a port (443) that is frequently used and very rarely blocked, via a host (gmail.com) that is also frequently used and rarely blocked (and there would likely be plenty of alternatives to choose from if it were), and without needing to create any sort of server on the target machine. The fact that Python is involved is incidental.
Back to comp.lang.python | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Python has arrived! Grant Edwards <invalid@invalid.invalid> - 2014-11-06 15:22 +0000
Re: Python has arrived! Sturla Molden <sturla.molden@gmail.com> - 2014-11-07 03:45 +0000
Re: Python has arrived! Ian Kelly <ian.g.kelly@gmail.com> - 2014-11-06 21:43 -0700
Re: Python has arrived! Steve Hayes <hayesstw@telkomsa.net> - 2014-11-07 06:54 +0200
Re: Python has arrived! Heinz Schmitz <HeinzSchmitz@gmx.net> - 2014-11-07 10:10 +0100
Re: Python has arrived! Gregory Ewing <greg.ewing@canterbury.ac.nz> - 2014-11-07 22:15 +1300
csiph-web