3

I have recently read a post about vulnerability of Python pickle module which allows to execute arbitrary Python code on unpickling: https://intoli.com/blog/dangerous-pickles/ The docs are suggesting to "never unpickle data received from an untrusted or unauthenticated source" but I can think of a hazard coming from supposedly trusted (but compromised) source.

As Python is a flexible, dynamic language it does not require a wizard to create an old-school computer virus infecting pickles.

Are there any known cases of such viruses?

[EDIT]

By "a virus" I mean literally old good "computer virus": a program that proliferates by adding itself to other programs.

3

If by "virus" you mean "exploit", then you can easily find those even on StackOverflow.

There's probably no widespread malware based on that, partly because there's only little number of applications for popular desktop platforms like Windows that are written in Python, and it's unlikely that any of them indeed uses pickle for the remote data (un-)serialization. However, a Python developer should better avoid a false sense of security here, because it's too simple to write such a malware, as is demonstrated above.

  • No, by "a virus" I mean old good "computer virus" as defined in 80' and 90': a program that replicates itself by adding itself to code of another program (since pickled data occured to be a program too). – abukaj Feb 3 '18 at 19:55
  • @abukaj what's the purpose of such a knowledge? – ximaera Feb 3 '18 at 19:56
  • curiousity and possible leverage when I warn my colleagues (data scientists using Python) about my finding on Monday. Also pride in case I am the first author of such virus. ;-) – abukaj Feb 3 '18 at 20:02
  • @abukaj if there are some, no one knows about them. If you'll write one, no one except your colleagues will know either. – ximaera Feb 3 '18 at 20:24
  • I hope you are right. – abukaj Feb 4 '18 at 16:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.