Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.xs4all.nl!newsfeed3a.news.xs4all.nl!xs4all!newsgate.cistron.nl!newsgate.news.xs4all.nl!post.news.xs4all.nl!not-for-mail Return-Path: X-Original-To: python-list@python.org Delivered-To: python-list@mail.python.org X-Spam-Status: OK 0.098 X-Spam-Evidence: '*H*': 0.81; '*S*': 0.00; 'python.': 0.02; 'subject:Python': 0.06; 'plenty': 0.07; 'alternatives': 0.09; 'runs': 0.10; 'python': 0.11; 'blocked': 0.16; 'hackers': 0.16; 'phases.': 0.16; 'rarely': 0.16; 'wrote:': 0.18; 'machine': 0.22; 'email addr:gmail.com>': 0.22; 'sort': 0.25; '>': 0.26; 'header:In-Reply-To:1': 0.27; 'host': 0.29; 'message- id:@mail.gmail.com': 0.30; 'url:06': 0.31; 'open': 0.33; 'received:google.com': 0.35; 'there': 0.35; 'machine.': 0.36; 'two': 0.37; 'server': 0.38; 'nov': 0.38; 'to:addr:python-list': 0.38; 'fact': 0.38; 'pm,': 0.38; 'channel': 0.39; 'to:addr:python.org': 0.39; 'according': 0.40; 'skip:\xc2 10': 0.60; 'browser': 0.61; 'simple': 0.61; 'first': 0.61; 'happen': 0.63; 'choose': 0.64; 'needing': 0.65; 'occur': 0.65; 'virus': 0.65; 'url:co': 0.67; 'anything.': 0.68; 'frequently': 0.68; 'url:11': 0.68; 'targeted': 0.69; 'virus.': 0.74; 'url:2014': 0.84; 'device,': 0.91; 'edwards': 0.91 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=etKLMMjRB05KU41PN6UA9bdg7/JbgP3vqiHHzNnjl9M=; b=mlHogqINbUMiWtW4DmfuQx8n1KuT/jV7jlg8WboCbrqLZsCTQD6lCw1jEPM/3C06gK n1XCFQCrnyJxCwR0gol/mXBOZPS+6sIbbeskC21EzXrBqYGfKwuHGs9CTOJgbKaG3mD2 TKsYD1TH6/Qan4q+C8wRZ4sl1sTud8H2WGiL7ynR2HF+m0rXgA+jPw3ismS1xEIEGsQQ IM3NH9SHCCDP/MaP5Z6pEQzkjdLz9z5567+dHcSW8ouSmJVSpkt38ZxgeDz3LZBWBFRU eDuyXICV/F7ZAx6mITA9WDdq09vk0CWjTtcMFuOMeZMtGEIyH1gQfWM7DH7fBJRzRTBV 26Jw== MIME-Version: 1.0 X-Received: by 10.66.234.72 with SMTP id uc8mr9367210pac.51.1415335380137; Thu, 06 Nov 2014 20:43:00 -0800 (PST) In-Reply-To: <1661847952437024668.827511sturla.molden-gmail.com@news.gmane.org> References: <1661847952437024668.827511sturla.molden-gmail.com@news.gmane.org> Date: Thu, 6 Nov 2014 21:43:00 -0700 Subject: Re: Python has arrived! From: Ian Kelly To: Python Content-Type: multipart/alternative; boundary=047d7b111d2592416105073d7260 X-BeenThere: python-list@python.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: General discussion list for the Python programming language List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Newsgroups: comp.lang.python Message-ID: Lines: 61 NNTP-Posting-Host: 2001:888:2000:d::a6 X-Trace: 1415335387 news.xs4all.nl 2953 [2001:888:2000:d::a6]:46882 X-Complaints-To: abuse@xs4all.nl Xref: csiph.com comp.lang.python:80347 --047d7b111d2592416105073d7260 Content-Type: text/plain; charset=UTF-8 On Nov 6, 2014 10:47 PM, "Sturla Molden" wrote: > > Grant Edwards wrote: > > According to > > http://www.theregister.co.uk/2014/11/06/hackers_use_gmail_drafts_as_dead_drops_to_control_malware_bots : > > > > "Attacks occur in two phases. Hackers first infect a targeted > > machine via simple malware that installs Python onto the device, > > [...]" > > > > A virus that runs on Python. It had to happen sooner or later. It's not a Python virus. The infection vector can be anything. The interesting part is that they're using browser automation to open a real-time, encrypted, virtually undetectable and untraceable channel to the malware over a port (443) that is frequently used and very rarely blocked, via a host (gmail.com) that is also frequently used and rarely blocked (and there would likely be plenty of alternatives to choose from if it were), and without needing to create any sort of server on the target machine. The fact that Python is involved is incidental. --047d7b111d2592416105073d7260 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


On Nov 6, 2014 10:47 PM, "Sturla Molden" <sturla.molden@gmail.com> wrote:
>
> Grant Edwards <invalid@invalid.invalid> wrote:
> > According to
> > http://www.theregister.co= .uk/2014/11/06/hackers_use_gmail_drafts_as_dead_drops_to_control_malware_bo= ts:
> >
> >=C2=A0 =C2=A0"Attacks occur in two phases. Hackers first infe= ct a targeted
> >=C2=A0 =C2=A0 machine via simple malware that installs Python onto= the device,
> >=C2=A0 =C2=A0 [...]"
> >
>
> A virus that runs on Python. It had to happen sooner or later.

It's not a Python virus. The infection vector can be any= thing. The interesting part is that they're using browser automation to= open a real-time, encrypted, virtually undetectable and untraceable channe= l to the malware over a port (443) that is frequently used and very rarely = blocked, via a host (gmail.com) that is al= so frequently used and rarely blocked (and there would likely be plenty of = alternatives to choose from if it were), and without needing to create any = sort of server on the target machine. The fact that Python is involved is i= ncidental.

--047d7b111d2592416105073d7260--