Published in Ochrona Security·Mar 4, 2022Ochrona 2.0.0 ReleasedOchrona, the Python security tool has some major updates, including SAST checks — Ochrona, an open source supply chain security tool for Python developers, released a new update to enable enhanced security throughout the SDLC. With Ochrona, Python developers were already able to check their projects for malicious package usage and set policies to audit additional packages outside of those tied to known…Python2 min readPython2 min read
Published in Ochrona Security·Updated Dec 12, 20213 New Malicious Packages Found on PyPIHighly Used Packages Identified Through Text Analysis — Background I recently started doing some large scale static analysis of a large percentage of the packages on PyPI. Using Bandersnatch from the Python Packaging Authority, it was relatively easy to download roughly ~200k of the nearly 330k packages available on PyPI today. …Python4 min readPython4 min read
Published in Geek Culture·Nov 30, 2021Member-onlyThe Python Vulnerability LandscapeAnalyzing 10 years of vulnerability data for Python packages — A couple years ago I started to put together my own database of known vulnerabilities in Python packages. Much of my list came from NIST NVD, the Github Advisory Database, vendor disclosures and blog posts, and most recently, from the PyPA Advisory DB. …Python5 min readPython5 min read
Published in Ochrona Security·Updated Apr 7, 2021Member-onlyPreventing Dependency Confusion Attacks in PythonBefore we get into how to protect python applications from dependency confusion attacks, we’ll define this new attack vector, give a bit of background, and look at examples. What is Dependency Confusion? Dependency Confusion is a new intrusion technique that exploits the way many programming languages handle dependency resolution when projects utilize a mix…Python5 min readPython5 min read
Published in Ochrona Security·Mar 21, 2021Member-onlySecurity Pitfalls in the Python Standard LibraryKeep your code safe by avoiding these 6 pitfalls — Assert If you’ve spent any time doing automated testing in Python you’re probably familiar with the python assert statement. Assert is incredibly handy in the context of testing. It gives you the ability to test the truthiness of a condition. If the condition is false, an AssertionError is raised. …Python6 min readPython6 min read
Published in Palo Alto Networks Developers·Jan 29, 2021Fingerprinting SSL Servers using JARM and PythonIntroducing pyJARM, the simple way to use JARM with Python — In early November 2020, SalesForce announced a new active TLS fingerprinting tool, inexplicably named JARM. The premise of JARM is that if a target server is scanned using a variety of different custom-crafted TCP “Client hello” packets, the resulting responses can be combined and hashed to provide a fingerprint that…Jarm3 min readJarm3 min read
Published in Ochrona Security·Jan 4, 2021Member-onlyPython Pickle is Notoriously InsecurePreventing Pwnage against Python Pickle — If you’re a heavy python user you’ve probably come across the pickle module from the standard library at some point. You may have even heard that this library is dangerous. …Python3 min readPython3 min read
Published in Ochrona Security·Nov 27, 2020Member-onlyPython DoS Prevention: The ReDOS AttackWhat is a “ReDoS” Attack, and how can you make sure your code is safe? — What is DoS? I’ve covered this in a few earlier posts, but DoS stands for Denial-of-Service. Denial-of-Service is a type of cyber attack technique where the attacker attempts to disrupt the availability of a service, application, or company. DoS attacks generally exist in one of two broad categories, Denial-of-Service (DoS) and Distributed Denial-of-Service…Cybersecurity4 min readCybersecurity4 min read
Published in Ochrona Security·Nov 17, 2020Member-onlyArbitrary Code Execution During Python Package InstallationWhy Typosquatting is a Threat to Python Developers and their Companies — The Setup Imagine this, you’re a developer at Super corp. You’re working on a new web application and you’re planning on building it using Flask. Like many Macbook Pros, your laptop has some keyboard issues. No biggie. Typing like the wind, you try to install flask using pip. …Cybersecurity3 min readCybersecurity3 min read
Published in Ochrona Security·Aug 10, 2020Member-onlyHow Being Hacked Launched My Career in CybersecurityWhat’s your Infosec origin story? — I’ve always been fascinated by how other Cybersecurity professionals ended up in their roles. For some it was a childhood dream to be a hacker (or catch hackers) after watching an old school hacker movie, others fell into roles organically after a career in enterprise IT, and if we’re being…Cybersecurity5 min readCybersecurity5 min read
