???? Beware of Malicious Python Package "fabrice" Stealing AWS Credentials ????

In the world of open-source development, trust in commonly used libraries is crucial. But, as recent findings show, that trust can be exploited by cybercriminals. The Socket Research Team has uncovered a malicious Python package named fabrice, which poses as the popular fabric library. Since its release in 2021, fabrice has quietly racked up 37,000+ downloads while stealing AWS credentials. ??

The Fabrice library is a serious security threat, and it is important to be aware of it. If you are using the Fabric library, you should make sure that you are using the correct version and that you are not installing any malicious packages. You should also be careful about the packages that you install from the Python Package Index (PyPI).

This is a timely reminder of the growing risks associated with open-source software—a trend we've seen recently with large-scale attacks on other ecosystems, like npm. Here's what every developer should know.

?? What is the Malicious "fabrice" Package? ??

The fabrice package masquerades as the fabric library—a legitimate tool widely used for SSH-based automation and deployment tasks. But instead of helping you automate server tasks, it silently steals AWS credentials and sets up backdoors in infected systems. ??

Why Do Developers Install "fabrice"? ??

1?? Look-alike Name: Developers searching for fabric may accidentally install fabrice, as the name is just a letter away.

2?? Common Use Cases: Developers use fabric to automate SSH tasks and deployments. In their haste, they might assume fabrice is just a variation or typo of the legitimate package.

3?? Lack of Awareness: Many developers trust the name and reputation of well-known libraries and may not think twice about installing a similar-sounding package.

4?? No Immediate Suspicion: fabrice may seem to work as expected at first, giving attackers time to execute their malicious activities unnoticed. ?

What Does "fabrice" Do? ??

Once installed, fabrice goes to work quietly behind the scenes, stealing AWS credentials and creating backdoors in infected systems. Here's how:

1. AWS Credentials Theft ?? → ??

• fabrice uses the boto3 library to search for AWS access keys and secret keys.
• The stolen credentials are exfiltrated to a remote server, giving attackers potential access to your AWS cloud resources.

2. Platform-Specific Attacks ??? + ??

• Linux: fabrice creates hidden directories (e.g., ~/.local/bin/vscode) to store malicious payloads. It downloads and executes harmful scripts without detection. ??
• Windows: Base64-encoded payloads are used to run hidden scripts, set up persistence mechanisms (e.g., scheduled tasks), and download malicious executables. ??

3. Data Exfiltration ??

• AWS credentials are sent to a VPN endpoint, making it difficult to trace the attacker's origins. ??

How Does "fabrice" Operate? ??

?? On Linux: ??

• Hidden Directories: Creates a directory like ~/.local/bin/vscode to store malicious scripts.
• Downloads Malicious Payloads: Downloads harmful scripts from a remote server and runs them with the user's privileges.

?? On Windows: ??

Decodes Base64 Payloads: The winThread() function decodes two malicious payloads: vv: Creates a VBScript (p.vbs) to run a hidden Python script (d.py). zz: Downloads a supposed chrome.exe file, sets up a scheduled task to run it every 15 minutes, and maintains persistence. ??

The Bigger Picture: Open-Source Security Risks ??

The fabrice attack is a reminder of the growing dangers in the open-source ecosystem. Cybercriminals use techniques like name impersonation to take advantage of developers' trust. ??

We've seen similar attacks before in the npm ecosystem, and fabrice is just the latest example. This highlights the need for vigilance and security best practices when managing dependencies. ??

How to Protect Your Projects ???

To safeguard your code and cloud environments from malicious packages like fabrice, follow these best practices:

1?? Verify Dependencies Carefully ??

2?? Lock Dependencies ??

3?? Monitor for Unusual Activity ??

4?? Secure Your AWS Credentials ??

5??Uninstall Malicious Packages ??

Conclusion: Stay Vigilant! ??

The discovery of fabrice is a stark reminder that malicious packages are a serious threat in the open-source ecosystem. By staying vigilant, verifying dependencies, and adopting security best practices, developers can protect their systems and data from these types of attacks. ???

Stay safe, stay informed, and make sure your cloud environments are secure! ????