The Secret Life of Python
summary
Python 3.8 adds audit hooks that surface module loads sockets file access and compile events so security tooling sees what Python actually does not just that it ran. Hooks can be installed at the C entry point so every interpreter instance reports events. Demos show the open_code hook enforcing Windows Defender application control catalogs to block unsigned .py and the compile hook calling AMSI signatures to stop encrypted malware and raise distributed alerts while logging to the Windows Event Log.
AI-written summary · about
chapters (11)
- 0:00Python as multi-tool
- 1:27Security risks of living off land
- 4:13Assumed breach mindset
- 8:33Python’s hidden danger in monitoring
- 10:21Python 3.8 auditing hooks
- 15:18Three security scenarios
- 16:43Windows Defender for known-good code
- 21:37Malware scanners for known bad code
- 26:16Logging for early detection
- 31:11Knowing your opponent
- 32:15Python 3.8 as early warning
related talks
26mTesting Python Security
59mCommon Python Coding Mistakes
25mUnexpected Execution: Wild Ways Code Execution can Occur in Python
34mSecure Python Development: Tips, Tricks, and Tools
47mApplication Whitelisting
50mWhen Arbitrary Code Execution is Working As Intended What Code is Python Supposed To Execute
22mMalware Hunting - Using python as an attack weapon
25m"Security considerations in Python Packaging"