Advanced Pickle Security
By lvh

Python's standard library comes with an object serialization framework called pickle. It's no secret pickles are unsafe. Any time you load a pickle, you really have no guarantee what it'll do. While it's designed to just reconstitute objects from some bytes, it could open network connections, delete all your files, or really anything else it wants.

Despite all of these flaws, it's very popular, especially in the scientific Python community. Many of its users actually have pretty good reasons to use it, so just telling them not to isn't very helpful. For example, numpy's various array types have custom behavior to fine-tune how they are serialized and deserialized -- features explicitly supported by the Pickle module's extension points. Most scientific applications also don't just have a matrix: they might have fairly complex object graphs that require serialization. Pickle supports this out of the box, and that's great!

This talk is intended for intermediate and expert Python programmers. It's expected that you have heard of the Pickle module before and that you know it's unsafe. We'll (quickly) go through how Pickle works at a Pickle VM opcode level. Then we'll show how you can get arbitrary code execution, followed by some more advanced exploitation techniques (e.g. how you can put other behavior in a pickle while keeping equivalent functionality; e.g. the pickle still turns into the object you were expecting). Finally, we'll talk about how we can make this safe again in the end anyway, culminating in the practical implementation I have open sourced.

If I have time (big stretch for the talk, but maybe not for the hallway track), I'll show techniques for how to attack Pickles that are "protected" by malleable encryption schemes like AES-CTR.