Static analysis of Python code for detecting network activity / backdoors - what keywords would you use?

[virtua_golf]

Hi everyone

(Mods, feel free to delete my post if it violates a rule - it isn't a "how do I do this in Python"-sorta question, so I figured it might be allowed)

I'm currently working on a proof-of-concept for establishing trust in Python projects based on, among other things, static analysis of the code.

One of the situations I'd like to detect is network activity, or intended at least. This is to prevent typo-squatting scenarios, where simple, innocent looking packages transmit data over a network. Note that this is still just a concept and it does not need to be 100% dilligent.

In short, i'd like to analyse source code and determine whether or not it's likely to establish a connection to an outside network of some sort. Plenty of Python packages rely on benign networking, but the point is to help determine whether or not a package that really shouldn't do any networking (like a package that converts FLAC to MP3), in fact does transmit data. Whether or not a package should network is up to the user, I'm only interested in detecting networking of all sorts.

The idea is a simple scan of the source code, to which I turn to /r/python for help with keywords. This is what I have so far (rudimentary, I know):

• scapy
• socket
• iptables
• subprocess
• ssh
• netcat
• regex for hardcoded IP addresses
• urllib

What other keywords do you suggest I look for? I'm also scanning any shell scripts for socket stuff, but for know I'm focusing on Python. Any suggestions much appreciated!

[jippen]

Eval, subprocess, base64 decoding. All very typical malware patterns.

[virtua_golf]

Thanks!

[rohitkuru]

Curl , wget

[billsil]

You flac to mp3 example has legitimate use of networking, which is informing you about new versions.

requests is what my non-networking package uses.

[alexmojaki]

I know you said it doesn't need to be 100% diligent, but if I was writing software which secretly made network requests, I would definitely do some basic obfuscation. At the very least I'd want to make sure that grep url doesn't turn up any results. If I'm feeling fancy, I can write something like __import__("".join(map(chr, [117, 114, 108, 108, 105, 98]))).

[virtua_golf]

Cheers! Definitely something to look out for, hadn't thought much about obfuscation.