{"id":21848,"date":"2025-02-10T19:01:43","date_gmt":"2025-02-10T22:01:43","guid":{"rendered":"https:\/\/www.ethicalhacker.com.br\/site\/?p=21848"},"modified":"2025-02-17T12:13:46","modified_gmt":"2025-02-17T15:13:46","slug":"modelos-de-ml-maliciosos-aproveitampicles-quebrados-para-evitar-a-deteccao","status":"publish","type":"post","link":"https:\/\/www.ethicalhacker.com.br\/site\/2025\/02\/exploits\/modelos-de-ml-maliciosos-aproveitampicles-quebrados-para-evitar-a-deteccao\/","title":{"rendered":"Modelos de ML maliciosos e picles quebrados"},"content":{"rendered":"\n<p class=\"story-title\"><strong>Modelos de ML maliciosos aproveitam o formato de picles quebrados para evitar a detec\u00e7\u00e3o<\/strong><\/p>\n<p style=\"text-align: justify;\">Recentemente, pesquisadores de seguran\u00e7a cibern\u00e9tica descobriram dois modelos de\u00a0<strong>machine learning (ML)<\/strong>\u00a0maliciosos na plataforma\u00a0<strong>Hugging Face<\/strong>. Esses modelos exploraram uma t\u00e9cnica incomum envolvendo arquivos\u00a0<strong>Pickle &#8220;quebrados&#8221;<\/strong>\u00a0para evadir detec\u00e7\u00e3o. O caso, batizado de\u00a0<strong>nullifAI<\/strong>, revela uma vulnerabilidade cr\u00edtica no formato de serializa\u00e7\u00e3o Pickle, amplamente utilizado para distribuir modelos de ML.<\/p>\n<p style=\"text-align: justify;\">Neste artigo, vamos explorar o que aconteceu, os riscos associados ao formato Pickle e como voc\u00ea pode usar scripts em Python para mitigar esses riscos.<\/p>\n<p>\u00a0<\/p>\n<p><strong>O Que aconteceu?<\/strong><\/p>\n<p style=\"text-align: justify;\">Os modelos maliciosos, hospedados nos reposit\u00f3rios\u00a0<code>glockr1\/ballr7<\/code>\u00a0e\u00a0<code>who-r-u0000\/0000000000000000000000000000000000000<\/code>, continham arquivos Pickle manipulados. Esses arquivos inclu\u00edam um\u00a0<strong>payload malicioso<\/strong>\u00a0no in\u00edcio do fluxo de dados, que consistia em um\u00a0<strong>reverse shell<\/strong>\u00a0conectado a um endere\u00e7o IP pr\u00e9-definido. O objetivo era executar c\u00f3digo arbitr\u00e1rio no sistema da v\u00edtima assim que o modelo fosse carregado.<\/p>\n<p>\u00a0<\/p>\n<p><strong>Por que o Pickle \u00e9 um problema?<\/strong><\/p>\n<p style=\"text-align: justify;\">O formato\u00a0<strong>Pickle<\/strong>\u00a0\u00e9 amplamente utilizado para serializar e desserializar objetos em Python, incluindo modelos de ML. No entanto, ele \u00e9 conhecido por ser inseguro, pois permite a execu\u00e7\u00e3o de c\u00f3digo arbitr\u00e1rio durante a desserializa\u00e7\u00e3o. No caso dos modelos maliciosos, os atacantes exploraram essa caracter\u00edstica para injetar c\u00f3digo malicioso.<\/p>\n<p style=\"text-align: justify;\">Al\u00e9m disso, os modelos foram compactados no formato\u00a0<strong>7z<\/strong>\u00a0(em vez do formato ZIP padr\u00e3o usado pelo PyTorch), o que ajudou a evitar a detec\u00e7\u00e3o por ferramentas como o\u00a0<strong>Picklescan<\/strong>, utilizado pelo Hugging Face para identificar arquivos Pickle suspeitos.<\/p>\n<p>\u00a0<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhhOkjwZiNh4b2foWpp2iLABOWeXkHhZNTnCg4lwPGL4869tsQ8cCg81ZX9_QEi-u91o6XPxSPwhKdwLflJZGYNKu-Sksm7QJrNgoQgszGNHHRyPSg4KC8jwwU55_7l1fwLRr2A5z_4ZZ1Mw-76S6OSKMDuzkfpsZ_5QZAybVNAEVCHNukOX07jOi3VeqTj\/s728-rw-e365\/code.png\" alt=\"Modelos de ML maliciosos\" width=\"622\" height=\"406\" \/><\/p>\n<p>\u00a0<\/p>\n<p><strong>Riscos associados ao pickle<\/strong><\/p>\n<ul>\n<li>\n<p><strong>Execu\u00e7\u00e3o de c\u00f3digo arbitr\u00e1rio<\/strong>: A desserializa\u00e7\u00e3o de arquivos Pickle pode executar c\u00f3digo Python, o que pode ser explorado para injetar malware.<\/p>\n<\/li>\n<li>\n<p><strong>Evas\u00e3o \u00a0de detec\u00e7\u00e3o: <\/strong>: A manipula\u00e7\u00e3o de arquivos Pickle, como a inser\u00e7\u00e3o de payloads no in\u00edcio do fluxo, pode fazer com que ferramentas de seguran\u00e7a ignorem o c\u00f3digo malicioso.<\/p>\n<\/li>\n<li>\n<p><strong>Falha na desserializa\u00e7\u00e3o<\/strong>: Arquivos Pickle &#8220;quebrados&#8221; podem ainda executar c\u00f3digo malicioso, mesmo que a desserializa\u00e7\u00e3o falhe parcialmente.<\/p>\n<\/li>\n<\/ul>\n<p>\u00a0<\/p>\n<p><strong>Como mitigar os riscos?<\/strong><\/p>\n<p style=\"text-align: justify;\">Abaixo est\u00e3o exemplos de scripts em Python que voc\u00ea pode usar para mitigar os riscos associados a arquivos Pickle maliciosos.<\/p>\n<p>\u00a0<\/p>\n<p>1.\u00a0<strong>Verifica\u00e7\u00e3o de arquivos Pickle com Picklescan<\/strong><\/p>\n<p style=\"text-align: justify;\">O\u00a0<strong>Picklescan<\/strong>\u00a0\u00e9 uma ferramenta de c\u00f3digo aberto que analisa arquivos Pickle em busca de c\u00f3digo suspeito. Voc\u00ea pode integr\u00e1-lo ao seu fluxo de trabalho para verificar modelos antes de carreg\u00e1-los.<\/p>\n<p>\u00a0<\/p>\n<pre><strong><span class=\"token keyword\">import<\/span> picklescan\n\n<span class=\"token keyword\">def<\/span> <span class=\"token function\">scan_pickle_file<\/span><span class=\"token punctuation\">(<\/span>file_path<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span>\n    <span class=\"token keyword\">try<\/span><span class=\"token punctuation\">:<\/span>\n        results <span class=\"token operator\">=<\/span> picklescan<span class=\"token punctuation\">.<\/span>scan<span class=\"token punctuation\">(<\/span>file_path<span class=\"token punctuation\">)<\/span>\n        <span class=\"token keyword\">if<\/span> results<span class=\"token punctuation\">[<\/span><span class=\"token string\">'unsafe_opcodes'<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">:<\/span>\n            <span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string-interpolation\"><span class=\"token string\">f\"Arquivo <\/span><span class=\"token interpolation\"><span class=\"token punctuation\">{<\/span>file_path<span class=\"token punctuation\">}<\/span><\/span><span class=\"token string\"> cont\u00e9m opcodes inseguros: <br \/><\/span><span class=\"token interpolation\"><span class=\"token punctuation\">{<\/span>results<span class=\"token punctuation\">[<\/span><span class=\"token string\">'unsafe_opcodes'<\/span><span class=\"token punctuation\">]<\/span><span class=\"token punctuation\">}<\/span><\/span><span class=\"token string\">\"<\/span><\/span><span class=\"token punctuation\">)<\/span>\n        <span class=\"token keyword\">else<\/span><span class=\"token punctuation\">:<\/span>\n            <span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string-interpolation\"><span class=\"token string\">f\"Arquivo <\/span><span class=\"token interpolation\"><span class=\"token punctuation\">{<\/span>file_path<span class=\"token punctuation\">}<\/span><\/span><span class=\"token string\"> \u00e9 seguro.\"<\/span><\/span><span class=\"token punctuation\">)<\/span>\n    <span class=\"token keyword\">except<\/span> Exception <span class=\"token keyword\">as<\/span> e<span class=\"token punctuation\">:<\/span>\n        <span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string-interpolation\"><span class=\"token string\">f\"Erro ao escanear o arquivo <\/span><span class=\"token interpolation\"><span class=\"token punctuation\">{<\/span>file_path<span class=\"token punctuation\">}<\/span><\/span><span class=\"token string\">: <\/span><span class=\"token interpolation\"><span class=\"token punctuation\">{<\/span>e<span class=\"token punctuation\">}<\/span><\/span><span class=\"token string\">\"<\/span><\/span><span class=\"token punctuation\">)<\/span>\n\n<span class=\"token comment\"># Exemplo de uso<\/span>\nscan_pickle_file<span class=\"token punctuation\">(<\/span><span class=\"token string\">\"modelo_malicioso.pkl\"<\/span><\/strong><span class=\"token punctuation\"><strong>)<\/strong><br \/><br \/>https:\/\/thehackernews.com\/2025\/02\/malicious-ml-models-found-on-hugging.html<br \/><\/span><br \/><br \/><strong>2.\u00a0Carregamento Seguro de Modelos com Verifica\u00e7\u00e3o de Hash<\/strong><\/pre>\n<p style=\"text-align: justify;\">Antes de carregar um modelo, verifique sua integridade usando um hash (como SHA-256) para garantir que o arquivo n\u00e3o foi alterado.<\/p>\n<p>\u00a0<\/p>\n<pre><strong><span class=\"token keyword\">import<\/span> hashlib\n\n<span class=\"token keyword\">def<\/span> <span class=\"token function\">calculate_file_hash<\/span><span class=\"token punctuation\">(<\/span>file_path<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span>\n    sha256_hash <span class=\"token operator\">=<\/span> hashlib<span class=\"token punctuation\">.<\/span>sha256<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>\n    <span class=\"token keyword\">with<\/span> <span class=\"token builtin\">open<\/span><span class=\"token punctuation\">(<\/span>file_path<span class=\"token punctuation\">,<\/span> <span class=\"token string\">\"rb\"<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token keyword\">as<\/span> f<span class=\"token punctuation\">:<\/span>\n        <span class=\"token keyword\">for<\/span> byte_block <span class=\"token keyword\">in<\/span> <span class=\"token builtin\">iter<\/span><span class=\"token punctuation\">(<\/span><span class=\"token keyword\">lambda<\/span><span class=\"token punctuation\">:<\/span> f<span class=\"token punctuation\">.<\/span>read<span class=\"token punctuation\">(<\/span><span class=\"token number\">4096<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string\">b\"\"<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span>\n            sha256_hash<span class=\"token punctuation\">.<\/span>update<span class=\"token punctuation\">(<\/span>byte_block<span class=\"token punctuation\">)<\/span>\n    <span class=\"token keyword\">return<\/span> sha256_hash<span class=\"token punctuation\">.<\/span>hexdigest<span class=\"token punctuation\">(<\/span><span class=\"token punctuation\">)<\/span>\n\n<span class=\"token keyword\">def<\/span> <span class=\"token function\">verify_model_integrity<\/span><span class=\"token punctuation\">(<\/span>model_path<span class=\"token punctuation\">,<\/span> expected_hash<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span>\n    file_hash <span class=\"token operator\">=<\/span> calculate_file_hash<span class=\"token punctuation\">(<\/span>model_path<span class=\"token punctuation\">)<\/span>\n    <span class=\"token keyword\">if<\/span> file_hash <span class=\"token operator\">==<\/span> expected_hash<span class=\"token punctuation\">:<\/span>\n        <span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">\"Integridade do modelo verificada. Carregando...\"<\/span><span class=\"token punctuation\">)<\/span>\n        <span class=\"token comment\"># Carregue o modelo aqui<\/span>\n    <span class=\"token keyword\">else<\/span><span class=\"token punctuation\">:<\/span>\n        <span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">\"Erro: Hash do modelo n\u00e3o corresponde ao esperado. <br \/>Poss\u00edvel altera\u00e7\u00e3o maliciosa.\"<\/span><span class=\"token punctuation\">)<\/span>\n\n<span class=\"token comment\"># Exemplo de uso<\/span>\nexpected_hash <span class=\"token operator\">=<\/span> <span class=\"token string\">\"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef\"<\/span>\nverify_model_integrity<span class=\"token punctuation\">(<\/span><span class=\"token string\">\"modelo.pkl\"<\/span><span class=\"token punctuation\">,<\/span> expected_hash<span class=\"token punctuation\">)<\/span><\/strong><\/pre>\n<p>\u00a0<\/p>\n<p>3.\u00a0<strong>An\u00e1lise de conte\u00fado de arquivos Pickle<\/strong><\/p>\n<p style=\"text-align: justify;\">Voc\u00ea pode inspecionar manualmente o conte\u00fado de um arquivo Pickle para identificar c\u00f3digo suspeito.<\/p>\n<p>\u00a0<\/p>\n<pre><strong><span class=\"token keyword\">import<\/span> pickle\n\n<span class=\"token keyword\">def<\/span> <span class=\"token function\">inspect_pickle_file<\/span><span class=\"token punctuation\">(<\/span>file_path<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span>\n    <span class=\"token keyword\">try<\/span><span class=\"token punctuation\">:<\/span>\n        <span class=\"token keyword\">with<\/span> <span class=\"token builtin\">open<\/span><span class=\"token punctuation\">(<\/span>file_path<span class=\"token punctuation\">,<\/span> <span class=\"token string\">\"rb\"<\/span><span class=\"token punctuation\">)<\/span> <span class=\"token keyword\">as<\/span> f<span class=\"token punctuation\">:<\/span>\n            data <span class=\"token operator\">=<\/span> pickle<span class=\"token punctuation\">.<\/span>load<span class=\"token punctuation\">(<\/span>f<span class=\"token punctuation\">)<\/span>\n            <span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">\"Conte\u00fado do arquivo Pickle:\"<\/span><span class=\"token punctuation\">,<\/span> data<span class=\"token punctuation\">)<\/span>\n    <span class=\"token keyword\">except<\/span> Exception <span class=\"token keyword\">as<\/span> e<span class=\"token punctuation\">:<\/span>\n        <span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string-interpolation\"><span class=\"token string\">f\"Erro ao carregar o arquivo Pickle: <\/span><span class=\"token interpolation\"><span class=\"token punctuation\">{<\/span>e<span class=\"token punctuation\">}<\/span><\/span><span class=\"token string\">\"<\/span><\/span><span class=\"token punctuation\">)<\/span>\n\n<span class=\"token comment\"># Exemplo de uso<\/span>\ninspect_pickle_file<span class=\"token punctuation\">(<\/span><span class=\"token string\">\"modelo_malicioso.pkl\"<\/span><span class=\"token punctuation\">)<br \/><br \/><br \/><\/span><\/strong><\/pre>\n<p><strong>4.\u00a0Uso de formatos alternativos<\/strong><\/p>\n<p style=\"text-align: justify;\">Prefira formatos mais seguros, como\u00a0<strong>ONNX<\/strong>\u00a0ou\u00a0<strong>TensorFlow SavedModel<\/strong>, que n\u00e3o permitem a execu\u00e7\u00e3o de c\u00f3digo arbitr\u00e1rio.<\/p>\n<p>\u00a0<\/p>\n<pre><strong><span class=\"token keyword\">import<\/span> onnx\n\n<span class=\"token keyword\">def<\/span> <span class=\"token function\">load_onnx_model<\/span><span class=\"token punctuation\">(<\/span>file_path<span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">:<\/span>\n    <span class=\"token keyword\">try<\/span><span class=\"token punctuation\">:<\/span>\n        model <span class=\"token operator\">=<\/span> onnx<span class=\"token punctuation\">.<\/span>load<span class=\"token punctuation\">(<\/span>file_path<span class=\"token punctuation\">)<\/span>\n        <span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string\">\"Modelo ONNX carregado com sucesso.\"<\/span><span class=\"token punctuation\">)<\/span>\n        <span class=\"token keyword\">return<\/span> model\n    <span class=\"token keyword\">except<\/span> Exception <span class=\"token keyword\">as<\/span> e<span class=\"token punctuation\">:<\/span>\n        <span class=\"token keyword\">print<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string-interpolation\"><span class=\"token string\">f\"Erro ao carregar o modelo ONNX: <\/span><span class=\"token interpolation\"><span class=\"token punctuation\">{<\/span>e<span class=\"token punctuation\">}<\/span><\/span><span class=\"token string\">\"<\/span><\/span><span class=\"token punctuation\">)<\/span>\n\n<span class=\"token comment\"># Exemplo de uso<\/span>\nload_onnx_model<span class=\"token punctuation\">(<\/span><span class=\"token string\">\"modelo_seguro.onnx\"<\/span><span class=\"token punctuation\">)<br \/><br \/><br \/><\/span><\/strong><\/pre>\n<p><strong>Boas pr\u00e1ticas para evitar riscos<\/strong><\/p>\n<ul>\n<li>\n<p><strong>Verifique a origem dos modelos<\/strong>: S\u00f3 baixe modelos de fontes confi\u00e1veis.<\/p>\n<\/li>\n<li>\n<p><strong>Use ferramentas de an\u00e1lise<\/strong>: Integre ferramentas como Picklescan ao seu fluxo de trabalho.<\/p>\n<\/li>\n<li>\n<p><strong>Prefira formatos seguros<\/strong>: Evite o uso de Pickle sempre que poss\u00edvel.<\/p>\n<\/li>\n<li>\n<p style=\"text-align: justify;\"><strong>Monitore atividades suspeitas<\/strong>: Fique atento a comportamentos incomuns durante o carregamento de modelos.<\/p>\n<\/li>\n<\/ul>\n<p>\u00a0<\/p>\n<p><strong>Conclus\u00e3o<\/strong><\/p>\n<p style=\"text-align: justify;\">A descoberta de modelos maliciosos no Hugging Face \u00e9 um alerta importante sobre os riscos associados ao formato Pickle. Ao adotar pr\u00e1ticas de seguran\u00e7a robustas e utilizar scripts de verifica\u00e7\u00e3o, voc\u00ea pode proteger seus sistemas contra amea\u00e7as semelhantes. Lembre-se: a seguran\u00e7a deve ser uma prioridade em todas as etapas do desenvolvimento e implanta\u00e7\u00e3o de modelos de ML.<\/p>\n<p>\u00a0<\/p>\n<p>Fonte e imagens: <a href=\"https:\/\/thehackernews.com\/2025\/02\/malicious-ml-models-found-on-hugging.html\" target=\"_blank\" rel=\"noopener\">https:\/\/thehackernews.com\/2025\/02\/malicious-ml-models-found-on-hugging.html<\/a><\/p>\n<pre><strong><span class=\"token punctuation\">\u00a0<\/span><\/strong><\/pre>\n<p>\u00a0<\/p>\n<pre><span class=\"token punctuation\">\u00a0<\/span><\/pre>\n\n\n","protected":false},"excerpt":{"rendered":"<p>Modelos de ML maliciosos aproveitam o formato de picles quebrados para evitar a detec\u00e7\u00e3o Recentemente, pesquisadores de seguran\u00e7a cibern\u00e9tica descobriram dois modelos de\u00a0machine learning (ML)\u00a0maliciosos na plataforma\u00a0Hugging Face. Esses modelos exploraram uma t\u00e9cnica incomum envolvendo arquivos\u00a0Pickle &#8220;quebrados&#8221;\u00a0para evadir detec\u00e7\u00e3o. O caso, batizado de\u00a0nullifAI, revela uma vulnerabilidade cr\u00edtica no formato de serializa\u00e7\u00e3o Pickle, amplamente utilizado para [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":21862,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[89,100,21,105],"tags":[],"class_list":["post-21848","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-basico","category-diversos","category-exploits","category-noticias"],"_links":{"self":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts\/21848","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/comments?post=21848"}],"version-history":[{"count":16,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts\/21848\/revisions"}],"predecessor-version":[{"id":21866,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/posts\/21848\/revisions\/21866"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/media\/21862"}],"wp:attachment":[{"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/media?parent=21848"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/categories?post=21848"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ethicalhacker.com.br\/site\/wp-json\/wp\/v2\/tags?post=21848"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}