Hacker News Reader

Comment by jlgaddis | Hacker News Reader

Did you miss the statement (and relevant code snippet) immediately preceding that?

> The project contains a setup.py file that sends a request to a malicious URL during installation.

I can't comment on whether the URL is actually malicious or, perhaps, just logging requests for statistics / tracking.

View on HN

"Sends a request to a malicious URL". Malicious is relative of course.

The code reads:

    url = "http://101.32.99.28/name?<package_name>"
    requests.get(url, timeout=30)

So it looks like the author wants to track the number of installs. Nothing is done with the response value (at least for the setup.py that I saw).

Edit: seems to be a Tokyo based IP.

The IP is from "Tencent Building, Kejizhongyi Avenue". That's weird, if it was just because they were an ISP, why would it say "Tencent Building"?

https://ipapi.co/101.32.99.28/

Ultimately up to the owner of the ASN what to use as the organization name. In this case, the ASN chose the name "Tencent Building, Kejizhongyi Avenue", you can see it over at https://bgp.he.net/AS132203 (The ASN is the owner of this specific IP under their specific ranges that they own)

That surprised me too (the IP lookup I used said "domain: tencent.com") but I don't understand enough about IP to tell whether that's unusual or not.

Unrelated tidbit: tencent.com returns an empty reply for me at the moment.

> tencent.com returns an empty reply for me at the moment

That's because the correct address is https://www.tencent.com/ (prefixed with www.)

Wow. Can the massive chinese conglomerate really not forward that to www?

They are hardly the only site to do that. It is only by convention that non-www-prefixed websites tend to redirect to www-prefixed one. It's not at all mandatory and technically they are two different hostnames. It may be intentional to ensure only exactly the right hostnames are ever used, e.g., www, ftp, smtp, etc.

Seems to be working as intended, it's a non www url.

I rarely see a site that doesn't redirect it to the appropriate subdomain. Then again I don't often check it unless it's broken

Rather unusual, but it’s a corporate rather than customer-facing website so not really all that important. It’s not like apple.com, google.com, or microsoft.com where the brand name domain is the product or is where the products are sold. I just checked and apex domains for all their flagship products redirect to www just fine.

Oh, nice catch! Strange setup.

Looks like the first line of the address for the headquarters of Tencent Cloud in Shenzhen.

Assuming requester IPs are being logged, this is a good way to build a map of potentially vulnerable organisations. No need to do anything now.

Hi thanks for sharing. The above I noticed and I thought it was captured quite well by the title. Thank you for flagging though it is useful context. My overall assessment is that this is grey/whitehat but merits further investigation.

It returns a null binary. Of course, this could be a targeted attack though.

The setup.py that I saw doesn't do anything with the response of the HTTP request so if it were indeed a targeted attack it would need to exploit some kind of weakness in the network stack. I guess that makes a targeted attack quite unlikely.

I went to the IP and it sent a single file (1B) containing a line break. I don't know if they changed it recently, but that's what happens on that URL right now.

Using which HTTP client?

To test "correctly", you'd likely want to use the requests library or, at the least, ussend the same User-Agent header that it does.

(And, for all we know, they could just be targeting certain IP addresses... or only responding the "malicious" response the first time the URL is requested per IP... or some other weird conditions that we aren't aware of.)

The packages do nothing with the response from the code i've seen

Ah, I see. I was just using Firefox to test things out; I'm not really experienced with these things but I do know how to use curl to an extent. :D

If we are being honest, nobody here can really answer that. The requests can act benign until the attacker chooses to change the payload based on source IP, time of day, source network, user-agent, etc... I believe it is best to block any outbound network connection you did not define in your code. e.g. your code uses a filtering proxy for approved API destinations.

Reply on news.ycombinator.com