Python for the Paranoid: How to secure your Python code

Presented at PyCon Hong Kong 2025

Transcript

1. Python for the Paranoid: How to secure your Python code Sau @ PyCon HK 2025
2. Modern threats Stolen API keys Ransomware Source: https://www.reddit.com/r/googlecloud/comments/1noctxi/student_hit_with_a_5544478_google_cloud_bill/, https://www.france24.com/en/live-news/20251003-cyberattack-halts-shipments-from-japan-s-biggest-brewer 2
3. Is Python secure? 3
4. “The most secure code in the world is code which is never written.” - Colin Percival 4
5. Common Weakness Enumeration (CWE) Over 600 categories! Source: https://nvd.nist.gov/vuln/categories 5
6. OWASP Top 10 (2021) There’s also OWASP Top 10 LLM, etc Source: https://owasp.org/Top10/ 6
7. Start by understanding 4 types of security vulnerabilities in Python 7
8. Today’s Agenda 1. Unsafe Data 2. Unsafe Algorithms 3. Unsafe Versions 4. Unsafe Third-party Packages 8
9. 1. Unsafe Data 9
10. 1.1 Denial of Service (DoS) Zip bomb (Zip-of-death) 💀 42 kB 5 GB 10
11. With a simple Google search… Source: A better zip bomb https://www.bamsoftware.com/hacks/zipbomb/ 11
12. 1.1 Denial of Service (DoS) Zip bomb (Zip-of-death) XML bomb (Billion laughs attack) < 1 kB � 3 GB 12
13. 1.2 Remote Code Execution Source: https://docs.python.org/3/library/pickle.html, https://huggingface.co/docs/hub/security-pickle 13
14. About pickle 14
15. Example of a Bad pickle 15
16. History of pickle 2003: Warning about use of pickle in Python 2.3 (PEP-307) 2022: Proposal of SafeTensors, a safer format in the ML community 2024: BentoML pickle-related vulnerability (CVE-2024-2912) 2025: On Hugging Face, 45% of models continue to use pickle* *Kellas et al (2025) "PickleBall: Secure Deserialization of Pickle-based Machine Learning Models" https://arxiv.org/html/2508.15987v1 16
17. About picklescan 17
18. Lesson: Always validate your input! Not only ZIP, XML, pickle. YAML, JSON, etc can also be unsafe. 2021: Vulnerability in Tensorflow (CVE-2021-37678) 18
19. 2. Unsafe Algorithms 19
20. 2.1 Random number generation Source: https://docs.python.org/3.13/library/random.html 20
21. What’s wrong with this? 21
22. History of random 20xx: random is not for security uses 2012: Plone (CMS) vulnerability (CVE-2012-5508) 2016: Addition of secrets module in Python 3.6 (PEP-506) 2025: Dify vulnerability (CVE-2025-1796) 22
23. 2.2 Hashing Collision! Source: https://library.mosse-institute.com/articles/2023/08/collision-birthday-attack.html#collision-attack 23
24. Comparing hashing algorithms MD5 pyconhk2025 SHA-1 SHA-256 dc20dd27bf6ad19d14abba6837cfffd8 9c8d02347c5f6698c9fbdcbad902f6d3ac5937e5 4399f1015fd012fae2dc6e7c61c3976500f01168b 96bebc53515cab0535affd0 24
25. MD5 collision attack Source: Nat McHugh (2015) "Create your own MD5 collisions" https://natmchugh.blogspot.com/2015/02/create-your-own-md5-collisions.html 25
26. MD5 collision attack (potential impact) “I recommend Alice” “I grant Alice full access” Source: Hash Collisions (The Poisoned Message Attack) "The Story of Alice and her Boss" https://www.sos.cs.ru.nl/applications/courses/security2015/md5collisions/index.html 26
27. Comparing hashing algorithms �� MD5 dc20dd27bf6ad19d14abba6837cfffd8 �� pyconhk2025 SHA-1 SHA-256 9c8d02347c5f6698c9fbdcbad902f6d3ac5937e5 4399f1015fd012fae2dc6e7c61c3976500f01168b 96bebc53515cab0535affd0 27
28. Lesson: Check recommended hash functions! NIST Policy on Hash Functions 28
29. 3. Unsafe Versions 29
30. What Python version do you use? 30
31. 3.1 The Circle of Life Source: https://devguide.python.org/versions/, https://www.python.org/downloads/release/python-3140/ 31
32. ICYMI: Python 3.9 ends in 3 weeks Source: https://endoflife.date/python 32
33. ICYMI: Numpy 1.x ended 3 weeks ago Source: https://endoflife.date/numpy 33
34. Example: Zip bomb fix in Python 2023 Sep: Zipfile vulnerability (CVE-2024-0450) Python 3.12.2, 3.11.8, 3.10.13, 3.9.18, 3.8.18 2024 Jan: Security patch released 34
35. Example: Zip bomb fix in Python 35
36. Lesson: Use latest Python versions if you can It’s FREE! Minor releases largely backward compatible (for Python 3.x to Python 3.y where y > x) For libraries, use automated tools like Dependabot or Renovate 36
37. 4. Unsafe Third-party Packages 37
38. The weakest link Source: https://security.googleblog.com/2021/12/understanding-impact-of-apache-log4j.html 38
39. Spot the difference! pip install _____ asynciio beaufifulsoup matplotib request pytorch 39
40. Anyone can upload packages to PyPI asynciio -> asyncio beaufifulsoup -> beautifulsoup matplotib -> matplotlib request -> requests pytorch -> torch Source: https://pypi.org/project/pytorch/ 40
41. What’s the worst that can happen? (CVE-2025-27607) (CVE-2025-30066) 41
42. CI/CD 2025: GitHub Action tj-actions/changed-file was compromised, leaking secrets from 20,000 repos (CVE-2025-30066) Source: https://unit42.paloaltonetworks.com/github-actions-supply-chain-attack/ 42
43. Lesson: Pin 📌 or lock🔒 your files Python: Lock with poetry.lock, Pipfile.lock, uv.lock 🔒 Github Actions: Pin with the SHA commit hash📌 - uses: actions/checkout@main - uses: actions/checkout@v4 - uses: actions/checkout@692973e3d937129bcbf40652 eb9f2f61becf3332 # v4.1.7 - uses: actions/checkout@v4.1.7 43
44. Today’s Agenda 1. Unsafe Data 2. Unsafe Algorithms 3. Unsafe Versions 4. Unsafe Third-party Packages 44
45. Dealing with vulnerabilities in Python 45
46. Recap 1. Unsafe Data: Validate input data 2. Unsafe Algorithms: Refer to recommended hash functions. Use secrets over random for security uses 3. Unsafe Versions: Take note of Python/library lifespan. Use tools such as uv/ Dependabot/ Renovate 4. Unsafe 3rd party: Pay attention to the entire ecosystem. Build safely by pinning or locking to the commit hash 46
47. In the Age of Agent-written code, we need to automate 47
48. Set up your linter flake8-bandit https://docs.astral.sh/ruff/rules/#flake8-bandit-s 48
49. Check your GitHub security settings Most require explicit opt-in (Dependabot, Code Scanning...) 49
50. GitHub recommended settings (advanced level) GitHub Actions learnings from the recent nx hack https://jessehouwing.net/github-actions-learnings-from-the-recent-nx-hack/ GitHub Actions: A Cloudy Day for Security - Part 1 https://binarysecurity.no/posts/2025/08/securing-gh-actions-part1 50
51. Ask your LLM to review your code Example: Gemini 51
52. Ask your LLM to review your code Example: Grok 52
53. Ask your LLM to review your code Example: Gemini “Review if the code is secure” 53
54. In the Age of Agent-written code, we need to automate 1. Ruff 2. GitHub 3. LLM 54
55. How to secure your Python code Scope is beyond Python: algorithms, CI/CD, etc Think not only about “what works”, but also “what can break” 55
56. Thank you, and stay safe! 56