Under the sea - Attacking vulnerable C creatures in Snakes-land
summary
Claim: many PyPI packages silently bundle C sources that carry real CVEs. Using snippet matching tied C code to CVEs and a vulnerability DB, researchers unpack every package (~400k) and detect 1.7% of ~400k packages — about 6,200 libraries that match known C flaws. A concrete chain shows pycares wrapping c-ares mishandles null-byte CNAMEs leading to SSRF into Kubernetes, demoed successfully against real projects like aiohttp and Home Assistant. Tools, raw dataset and exploits all work end-to-end.
AI-written summary · about
chapters (7)
- 0:00Introduction to talk
- 2:11Why mix Python and C
- 8:07Research claim and tools
- 12:18PyKers vulnerability chain
- 16:10Exploitation demo
- 18:02Takeaways and solutions
- 19:30Q&A session
related talks
16mUnpacking Open Source Security in Public Repos
27mStrangerDanger: Finding Security Vulnerabilities Before They Find You
25mTrusting Your Open-Source Software Supplier
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?
28mUnveiling Remote Code Execution: How Vulnerabilities Lead to System Takeovers
53mWhere The Wild Things Are: The State Of Open Source Supply Chain Risk Management In Three Stories
13mKeynote: Hacking the OSS Supply Chain
43mHow to hack and defend (your) open source