Spectra Assure

warningRisk: Secrets

Scanned:

sdbus

Artifact:

latest

Top 10k

Modern Python D-Bus library. Based on sd-bus from libsystemd.

License: Copyleft (LGPL-2.1-or-later)

Published:

Visit GitHub

See on PyPI

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

2 debugging symbols found

Security

Vulnerabilities

No known vulnerabilities detected

Hardening

1 execution hijacking concerns

Threats

Tampering

No evidence of software tampering

Malware

No evidence of malware inclusion

Overview issues8 vulnerabilities0 malware0 behaviors66 dependencies0 contributors1 versions29

List of software quality issues with the number of affected components.

Policies

Info

Problem

Operating systems execute application code in multiple privilege access levels. Separation of privileges is designed to protect the stability and integrity of the operating system by shielding it from issues that the user run applications may cause. However, some users may need to interact with higher privilege parts of the operating system to accomplish specific tasks. For this purpose, operating systems provide facilities that users may leverage to temporarily elevate their running privileges. Users with higher privileges can run any application with the same privilege level as their own. Attackers often try to trick privileged users into running malicious code, enabling them to infect the operating system. While the presence of code that elevates user privileges does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that can elevate user privileges. One example of acceptable use for such functions is allowing the users to install software packages and updates.

Prevalence in PyPI community

1 packages

found in

Top 100

31 packages

found in

Top 1k

194 packages

found in

Top 10k

4.1k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1548 - Abuse Elevation Control Mechanism.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Software developers use programming and design knowledge to build reusable software components. Software components are the basic building blocks for modern applications. Software consumed by an enterprise consists of hundreds, and sometimes even thousands of open source components. Software developers publish components they have authored to public repositories. While a new software project is a welcome addition to the open source community, it is not always prudent to indiscriminately use the latest components when building a commercial application. Irrespective of the software quality, the danger of being the first to try out a new project lies in the fact that the software component may contain novel, currently undetected malicious code. Therefore, it is prudent to review software component behaviors and even try out software component in a sandbox, an environment meant for testing untrusted code.

Prevalence in PyPI community

1 packages

found in

Top 100

13 packages

found in

Top 1k

37 packages

found in

Top 10k

443.06k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Software components contain executable code that performs actions implemented during its development. These actions are called behaviors. In the analysis report, behaviors are presented as human-readable descriptions that best match the underlying code intent. While most behaviors are benign, some are commonly abused by malicious software with the intent to cause harm. When a software package shares behavior traits with malicious software, it may become flagged by security solutions. Any detection from security solutions can cause friction for the end-users during software deployment. While the behavior is likely intended by the developer, there is a small chance this detection is true positive, and an early indication of a software supply chain attack.

Prevalence in PyPI community

20 packages

found in

Top 100

92 packages

found in

Top 1k

907 packages

found in

Top 10k

43.88k packages

in community

Next steps

Investigate reported detections.

If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Each security solution has a unique footprint that consists of installed files and changes to system configuration. Malicious code often tries to detect security solutions by accessing registry keys and folder locations associated with the software installation. Detecting which security solution is installed plays a key role in selecting the optimal malware infection strategy. When a computer system is protected by a security solution, malware may decide to behave differently. Malware may choose to delay its execution, change infection stages, or even avoid running altogether. While the presence of code that detects security solutions does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Only select applications should consider using functions that check for presence of installed security software. One example of acceptable use for such functions is informing the user about possible compatibility issues with the detected security software.

Prevalence in PyPI community

0 packages

found in

Top 100

5 packages

found in

Top 1k

30 packages

found in

Top 10k

451 packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1518.001 - Security Software Discovery.

Consider rewriting the flagged code without using the marked behaviors.

Problem

On Linux, external symbols are resolved via the procedure linkage table (PLT) and the global offset table (GOT). Without any protection, both are writable at runtime and thus leave the executable vulnerable to pointer hijacking - an attack where the function address is overwritten with an address of a malicious function. Pointer hijacking can be mitigated by using full read-only relocations, which instruct the compiler to unify global offset tables into a single read-only table. This requires that all external function symbols are resolved at load-time instead of during execution, and may increase loading time for large programs.

Prevalence in PyPI community

26 packages

found in

Top 100

135 packages

found in

Top 1k

847 packages

found in

Top 10k

17.09k packages

in community

Next steps

In most cases, it's recommended to use full read-only relocations (in GCC: -Wl,-z,relro,-z,now).

If the executable load-time is an issue, you should use partial read-only relocations.

Problem

Debug databases are typically only used during software development. On Windows, they are usually files embedded into the executable (PDB), while on Linux, they're contained inside special executable sections. The databases contain private debug symbols that make it significantly easier to reverse-engineer a closed-source application. In some cases, having a debug database is equivalent to having access to the source code. Presence of debug databases could indicate that one or more software components have been built using a debug profile, instead of the release. Private debug databases can be embedded into software components by programming language tools.

Prevalence in PyPI community

27 packages

found in

Top 100

130 packages

found in

Top 1k

824 packages

found in

Top 10k

14.18k packages

in community

Next steps

To remediate this issue and remove private debugging information, refer to your programming language toolchain documentation.

Problem

Common compilers often embed source code information into executables for debugging purposes, usually by mapping symbols to source filenames or paths. While this is typically desirable in open-source software and standard tools, that information can be used to determine security weaknesses, code repository layout, trade secrets and similar sensitive information. Such symbols make it easier to reverse-engineer a closed source application.

Prevalence in PyPI community

27 packages

found in

Top 100

138 packages

found in

Top 1k

922 packages

found in

Top 10k

19.5k packages

in community

Next steps

Strip out such information in the linking phase by using compiler options like the -s flag in GCC, or in the post-build phase by using the strip tool.

Problem

Operating systems allow multiple user accounts to coexist on a single computer system. Each registered user has identity information associated with their account. At the very least, user accounts consist of a user name and an optional password. In some cases, user account data may also include personally identifiable information. Extended personal information may include user's given and last name, their email and mailing address, personal photo and their telephone number. Financially motivated attackers may seek to collect personal information for purposes of selling the private data to a third-party. Malicious code that typically exhibits these behavior traits is commonly referred to as an information stealer. While the presence of code that accesses identity information does not necessarily imply malicious intent, all of its uses in a software package should be documented and approved. Accessing identity information is a very common behavior for software packages. One example of acceptable use for such functions is verifying that the active user has purchased a software license that allows them to run the application.

Prevalence in PyPI community

16 packages

found in

Top 100

113 packages

found in

Top 1k

669 packages

found in

Top 10k

19.67k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

List of software quality issues with the number of affected components.

Policies

Info

Problem

Prevalence in PyPI community

1 packages

found in

Top 100

31 packages

found in

Top 1k

194 packages

found in

Top 10k

4.1k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1548 - Abuse Elevation Control Mechanism.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Prevalence in PyPI community

1 packages

found in

Top 100

13 packages

found in

Top 1k

37 packages

found in

Top 10k

443.06k packages

in community

Next steps

Check the software component behaviors for anomalies.

Consider exploratory software component testing within a sandbox environment.

Consider replacing the software component with a more widely used alternative.

Avoid using this software package until it is vetted as safe.

Problem

Prevalence in PyPI community

20 packages

found in

Top 100

92 packages

found in

Top 1k

907 packages

found in

Top 10k

43.88k packages

in community

Next steps

Investigate reported detections.

If the software intent does not relate to the reported behavior, investigate your build and release environment for software supply chain compromise.

You should delay the software release until the investigation is completed, or until the issue is risk accepted.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Prevalence in PyPI community

0 packages

found in

Top 100

5 packages

found in

Top 1k

30 packages

found in

Top 10k

451 packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1518.001 - Security Software Discovery.

Consider rewriting the flagged code without using the marked behaviors.

Problem

Prevalence in PyPI community

26 packages

found in

Top 100

135 packages

found in

Top 1k

847 packages

found in

Top 10k

17.09k packages

in community

Next steps

In most cases, it's recommended to use full read-only relocations (in GCC: -Wl,-z,relro,-z,now).

If the executable load-time is an issue, you should use partial read-only relocations.

Problem

Prevalence in PyPI community

27 packages

found in

Top 100

130 packages

found in

Top 1k

824 packages

found in

Top 10k

14.18k packages

in community

Next steps

To remediate this issue and remove private debugging information, refer to your programming language toolchain documentation.

Problem

Prevalence in PyPI community

27 packages

found in

Top 100

138 packages

found in

Top 1k

922 packages

found in

Top 10k

19.5k packages

in community

Next steps

Strip out such information in the linking phase by using compiler options like the -s flag in GCC, or in the post-build phase by using the strip tool.

Problem

Prevalence in PyPI community

16 packages

found in

Top 100

113 packages

found in

Top 1k

669 packages

found in

Top 10k

19.67k packages

in community

Next steps

Investigate reported detections as indicators of software tampering.

Consult Mitre ATT&CK documentation: T1033 - System Owner/User Discovery.

sdbus

SAFE Assessment

Compliance

Security

Threats

TH16120Detected presence of software components that can elevate the user privileges.hunting

Problem

Prevalence in PyPI community

Next steps

TH30106Detected presence of software components that have low popularity or number of downloads.hunting

Problem

Prevalence in PyPI community

Next steps

TH15103Detected presence of files with behaviors commonly used by malicious software.hunting

Problem

Prevalence in PyPI community

Next steps

TH16117Detected presence of software components that can detect installed security software.hunting

Problem

Prevalence in PyPI community

Next steps

SQ18113Detected Linux executable files that were compiled without the recommended dynamic symbol hijacking protections.Causes risk: execution hijacking concernshardening

Problem

Prevalence in PyPI community

Next steps

SQ34203Detected presence of hardcoded debug databases.Causes risk: debugging symbols foundsecrets

Problem

Prevalence in PyPI community

Next steps

SQ34204Detected presence of hardcoded source code filenames or paths.Causes risk: debugging symbols foundsecrets

Problem

Prevalence in PyPI community

Next steps

TH16126Detected presence of software components that can access user identity information.hunting

Problem

Prevalence in PyPI community

Next steps

Did you know...

TH16120Detected presence of software components that can elevate the user privileges.hunting

Problem

Prevalence in PyPI community

Next steps

TH30106Detected presence of software components that have low popularity or number of downloads.hunting

Problem

Prevalence in PyPI community

Next steps

TH15103Detected presence of files with behaviors commonly used by malicious software.hunting

Problem

Prevalence in PyPI community

Next steps

TH16117Detected presence of software components that can detect installed security software.hunting

Problem

Prevalence in PyPI community

Next steps

SQ18113Detected Linux executable files that were compiled without the recommended dynamic symbol hijacking protections.Causes risk: execution hijacking concernshardening

Problem

Prevalence in PyPI community

Next steps

SQ34203Detected presence of hardcoded debug databases.Causes risk: debugging symbols foundsecrets

Problem

Prevalence in PyPI community

Next steps

SQ34204Detected presence of hardcoded source code filenames or paths.Causes risk: debugging symbols foundsecrets

Problem

Prevalence in PyPI community

Next steps

TH16126Detected presence of software components that can access user identity information.hunting

Problem

Prevalence in PyPI community

Next steps