Python backdoor attacks are increasing day by day. Scripting attacks are just hard-coded malware attacks. In a scripting attack, the malware gets coded by the attacker by programming languages to gain reverse shell remotely. Python is growing in popularity among the attackers as it provides many functions. It is just the most powerful programming language. The attacker can hard-code the malware in such a way as to create persistence into the remote server with less than a hundred lines of code. Conversely, it also can be coded in such a way to gain reverse shell access remotely from the machine and get sensitive information.
What is Python Backdoor?
The python backdoor is the code written in python that could be used as malware to retrieve sensitive information from the victim’s computer. Python backdoor uses a client-server architecture to establish the connection between the victim and the attacker. The key features of these backdoor get information retrieval and gaining persistence over the victim’s computer. These scripts are very easy to code and can be downloaded easily from GitHub. GitHub community has provided over 200 python backdoor scripts. The most dangerous feature about the python malware becomes its indetectibility. Python backdoor doesn’t get detected by any malware detector or antivirus. AVs work on the principle of signatures. This malware gets easier to code and thus every time an attacker can write his own malware which is new and hard to trace because it doesn’t have any signatures.
How does a Python Backdoor work?
The attacker creates a simple code that establishes the connection between his computer and the victim’s computer. This code works on the client-server principle and is known as socket programming. The attacker can embed this code in an innocently seeming program like a game developed in python. As the victim opens this game or starts this program or runs this code, the attacker gets a reverse shell into the victim’s computer. The victim doesn’t even realize the attacker has gained the reverse shell as this code is not detectable by AV. The code runs as the background process even if the victim closes the program.
The only downside of this attack becomes the victim should have python installed on the computer. While building this backdoor there are two components in need :
1] Client: This is the code that runs on the victim’s computer, which accepts the commands from the attacker and sends the information or the data to each other.
2] Server: This code is run on the attacker’s computer which acts as the entry point of listening to the client connection, sending the commands to the client, and receiving the data or the information back.
Based on how the backdoor is coded, it will create persistence over the victim’s computer. Whenever the victim closes the program the code still runs as the background process. Even after the system restart, the code can be written in such a way that it gets run automatically after the system boots up. Here is the code of the basic python backdoor:
How to defend against Python Backdoor?
Defending against python backdoor gets difficult as it doesn’t get detected by any malware detector or any antivirus. Malicious python scripts are as same as the admin scripts, so it also bypasses traditional defenses against firewalls. Any defense that involves network addresses cannot adequately protect the environment. This is because the script can also be written in such a way that it traces back to the work environment or admin IP address.
The best and most effective way to work against this attack is to process organizations’ digital signatures. The only applications that have the same digital signature can have access to the internet. While manually adding firewall policies to detect this kind of backdoor. This becomes the only possible solution to this kind of attack. 90 percent of the time this attack gives success to the attacker.
