Mischief Managed: What hackers can do on your Jupyter instance
summary
Jupyter instances expose code execution, defaulting to HTTP on port 888 with an authentication token that becomes a cookie and lasts 30 days, and shells and kernels let attackers run anything the user could in a terminal. Demonstrations include extracting tokens via netstat, reading the SQLite command history to recover secrets (AKIA… keys), loading malicious pickles (joblib still uses pickle) to get remote code execution, planting startup scripts or editing runtime JSON to change variables silently. Defenses shown: secrets managers, hashes/signatures, JupyterHub, and tighter configs.
AI-written summary · about
chapters (15)
- 0:00Welcome
- 1:12Why Jupyter attracts hackers
- 3:42Jupyter’s client-server risks
- 5:08Launch config pitfalls
- 8:16Hidden files and shell risks
- 9:00Plain text credentials
- 11:08Secrets management
- 12:15Pickle file risks
- 14:23Jupyter token exposure
- 15:54History and key exposure
- 17:06Startup scripts as attack vector
- 18:53Modifying client behavior
- 21:01Defense in depth
- 22:46Summary
- 23:30Q&A
related talks
28m"Cyber Security Investigations with Jupyter Notebooks"
26mTesting Python Security
43mUnique ways to Hack into a Python Web Service
37mBeyond the Basics: Hacking and Securing Machine Learning Systems and Environments
53mHow hacking works - Web edition
40mHow hacking works; Web edition
51mPrompt Injection: When Hackers Befriend Your AI
43mLive hacking: Breaking into your Java web app