Bypass Python 3.8 Audit Hooks or Nah? Internals & Evasion
Leron Gray dives into Python 3.8's PEP 578 audit hooks (sys.addaudithook), exploring their architectural design, runtime inspection capabilities, and bypasses.
Summary
The Introduction of Python Audit Hooks (PEP 578)
Python 3.8 introduced audit hooks to provide security tools and system administrators with runtime visibility into sensitive operations like code compilation, network sockets, and dynamic imports.
Deconstructing Python Runtime Security Architecture
Leron Gray explains the CPython internal implementation of `sys.addaudithook` and `PySys_Audit`, examining what system events are logged.
Evaluating Bypass Vectors and Memory Manipulation
The author explores techniques for tampering with runtime structures in memory—including ctypes abuse, hooking C-level function pointers, and disabling callback arrays.
Designing Robust Python Runtime Defenses
The presentation discusses how application developers can effectively implement audit hooks and what limitations defenders must anticipate.
Related talks
Black Hat·47 min
Ivan Ristic
Industry experts analyze emerging threats surrounding USA 2012 - Confessions of a WAF Developer: Protocol-Level Evasion of Web App Firewalls.
Black Hat·1 hr 4 min
K.K. Mookhey
Analysts investigate attack surfaces and defenses concerning USA 2004 - Evasion and Detection of Web Application Attacks.
OWASP Foundation·29 min
Lynn Root
Lynn Root explores how to spy with python so easy the NSA can do it.