4

I received an email from Stack Exchange with a Python file attached, and it seemed suspicious. I thought y'all would want to take a look.

email:

From: "Stack Exchange" <do-not-reply@stackexchange.com> 
To: me Reply-To: do-not-reply@stackexchange.com 
Subject: New questions in python filter for Aug 23 - Stack Exchange 
Date: Thu, 23 Aug 2018 19:06:27 +0000 
Content-Type: multipart/alternative;    boundary="----=_NextPart_000_1CCE_64CE4764.45758CD0"


------=_NextPart_000_1CCE_64CE4764.45758CD0 Content-Type: text/plain;   charset="UTF-8" Content-Transfer-Encoding: quoted-printable

***11 new questions in [python filter](<https://stackexchange.com/filters/1= 38574/python>) on stackexchange.com***


[AttributeError: 'str' object has no attribute 'export'](<https://stackover= flow.com/questions/51992674/attributeerror-str-object-has-no-attribute-expo= rt>)

from pydub import AudioSegment from pydub.silence import split_on_silence s= ound_file =3D AudioSegment.from_wav("file1.wav") audio_chunks =3D split_on_= silence(sound_file, # must be silent for at ...

Tagged: python-3.x

by [Allen](<https://stackoverflow.com/users/10266032/allen>) on <https://st= ackoverflow.com>

----------------------------

[Passing list to pool.map() function in Python returns each character for e= ach item in the list](<https://stackoverflow.com/questions/51992644/passing=
-list-to-pool-map-function-in-python-returns-each-character-for-each-it>)

This Python 2.7 script running on Windows is not outputting as I would expe= ct it to. from multiprocessing import Pool from multiprocessing.dummy impor= t Pool as ThreadPool def function1(): ...

Tagged: python

by [olaHalo](<https://stackoverflow.com/users/9976152/olahalo>) on <https:/= /stackoverflow.com>

----------------------------

[Calculating age of live person vs dead person](<https://stackoverflow.com/= questions/51992641/calculating-age-of-live-person-vs-dead-person>)

So, I've got a pandas dataframe that is the result of a MySQL query that se= arches for a person's name and then returns some information about them. On= e such piece of info is their age. The table ...

Tagged: python-3.x

by [adrysdale](<https://stackoverflow.com/users/10211367/adrysdale>) on <ht= tps://stackoverflow.com>

----------------------------

[Python ABC classes: One of multiple methods has to be overridden](<https:/= /stackoverflow.com/questions/51992631/python-abc-classes-one-of-multiple-me= thods-has-to-be-overridden>)

In Python, I have an abstract base class which has four methods, of which a= t least one has to be overridden. Is it possible to somehow implement this = with the @abstractmethod decorator or something ...

Tagged: python

by [MosteM](<https://stackoverflow.com/users/2609994/mostem>) on <https://s= tackoverflow.com>

----------------------------

[If dataframe length exceeds threshold, make a new row python](<https://sta= ckoverflow.com/questions/51992596/if-dataframe-length-exceeds-threshold-mak= e-a-new-row-python>)

I have a data frame with columns a,b,c,d a b c d 1 2 nan nan 2 3 4 5 4 5 na= n nan how do i reshape into 2 columns, when i am not aware of the number of=  rows that the result will give. (big data) ...

Tagged: python

by [aakash T.C.](<https://stackoverflow.com/users/4411700/aakash-t-c>) on <= https://stackoverflow.com>

----------------------------

[backward series in python where every next term is (prev1*prev2+prev3)](<h= ttps://stackoverflow.com/questions/51992569/backward-series-in-python-where=
-every-next-term-is-prev1prev2prev3>)

Please help to write pytnon code. The series goes like ....previous3, previ= ous2, previous1 Nth terms. And every next term is (previous1*previous2+prev= ious3). I have tried this n =3D int(input('Give ...

Tagged: python-3.x

by [hanifsm](<https://stackoverflow.com/users/10261288/hanifsm>) on <https:= //stackoverflow.com>

----------------------------

[Python - Sharing variables between different instances of different classe= s](<https://stackoverflow.com/questions/51992554/python-sharing-variables-b= etween-different-instances-of-different-classes>)

I have been searching for the next answer but for sure I have been searchin= g the wrong keywords. I used to develop with C++, passing pointers as refer= ences between objects. The case is, now I'm trying ...

Tagged: python

by [Cristo](<https://stackoverflow.com/users/10266397/cristo>) on <https://= stackoverflow.com>

----------------------------

[Automatic dictionary key resolution with nested schemas using Marshmallow]= (<https://stackoverflow.com/questions/51992551/automatic-dictionary-key-res= olution-with-nested-schemas-using-marshmallow>)

When using nested schemas in Marshmallow it is sometimes desirable to seria= lize objects using that are defined in a dictionary in another structure an= d to have the key automatically resolved when ...

Tagged: python

by [cdiggins](<https://stackoverflow.com/users/184528/cdiggins>) on <https:= //stackoverflow.com>

----------------------------

[Python Chirp.io app not responding to "chirps"](<https://stackoverflow.com= /questions/51992539/python-chirp-io-app-not-responding-to-chirps>)

I'm trying to build a chirp app that would just take a chirp and print the = data. I'm running the python app in my terminal and am able to send/ emit a=  chirp but am not getting any indication that my ...

Tagged: python

by [Jaylan](<https://stackoverflow.com/users/10266404/jaylan>) on <https://= stackoverflow.com>

----------------------------

[=D0=9E=D1=88=D0=B8=D0=B1=D0=BA=D0=B0 =D0=B2 =D0=BA=D0=BE=D0=B4=D0=B5
=D0=
=B4=D0=B5=D0=BB=D0=B0=D0=B5=D1=82 =D0=B8=D0=B7 =D0=BE=D0=B1=D1=8B=D1=87=D0=
=BD=D0=BE=D0=B3=D0=BE =D0=B1=D0=BE=D1=82=D0=B0 =D0=92=D0=9A =D1=84=D0=BB=D1=
=83=D0=B4=D0=B5=D1=80=D0=B0](<https://ru.stackoverflow.com/questions/872704= /%d0%9e%d1%88%d0%b8%d0%b1%d0%ba%d0%b0-%d0%b2-%d0%ba%d0%be%d0%b4%d0%b5-%d0%b= 4%d0%b5%d0%bb%d0%b0%d0%b5%d1%82-%d0%b8%d0%b7-%d0%be%d0%b1%d1%8b%d1%87%d0%bd= %d0%be%d0%b3%d0%be-%d0%b1%d0%be%d1%82%d0%b0-%d0%92%d0%9a-%d1%84%d0%bb%d1%83= %d0%b4%d0%b5%d1%80%d0%b0>)

=D0=9F=D1=80=D0=B8 =D0=BF=D0=BE=D0=BB=D1=83=D1=87=D0=B5=D0=BD=D0=B8=D0=B8 u= pdates =D0=B1=D0=BE=D1=82 =D0=BD=D0=B0=D1=87=D0=B8=D0=BD=D0=B0=D0=B5=D1=82 =
=D1=81=D0=BB=D0=B0=D1=82=D1=8C =D0=BE=D0=B4=D0=B8=D0=BD =D0=B8 =D1=82=D0=BE=
=D1=82 =D0=B6=D0=B5 =D0=BE=D1=82=D0=B2=D0=B5=D1=82(=D0=B2 =D1=81=D0=BE=D0=
=BE=D1=82=D0=B2=D0=B5=D1=82=D1=81=D1=82=D0=B2=D0=B8=D0=B8 =D1=81 answ[1]) =
=D0=B2=D0=BF=D0=BB=D0=BE=D1=82=D1=8C =D0=B4=D0=BE =D0=BE=D1=81=D1=82=D0=B0=
=D0=BD=D0=BE=D0=B2=D0=BA=D0=B8 =D1=81=D0=BA=D1=80=D0=B8=D0=BF=D1=82=D0=B0 =
=D0=9F=D0=BE=D0=BB=D0=BD=D1=8B=D0=B9 =D0=BA=D0=BE=D0=B4 - https://drive.goo= gle.com/open?id=3D12Bnha6V1sL3DObEsm9VLxYJO8PQ5BT-r
=D0=9D=D0=BE ...

Tagged: python

by [=D0=90=D0=BB=D0=B5=D0=BA=D1=81=D0=B5=D0=B9](<https://ru.stackoverflow.c= om/users/307197/%d0%90%d0%bb%d0%b5%d0%ba%d1%81%d0%b5%d0%b9>) on <https://ru= .stackoverflow.com>

----------------------------

[monkeypatching not carrying through class import](<https://stackoverflow.c= om/questions/51992496/monkeypatching-not-carrying-through-class-import>)

I'm trying to test some code using pytest and need to change a function fro= m some module. One of my imports also imports that function, but this is fa= iling when I change the method using monkeypatch. ...

Tagged: python

by [BadAtTesting123](<https://stackoverflow.com/users/10266339/badattesting= 123>) on <https://stackoverflow.com>

----------------------------



[Unsubscribe from this filter](<https://stackexchange.com/email/unsubscribe=
-filter/366663/630686276?code=3DyKIvad76WjgGyKyQVvWaPWMykvcFJ4G0VqchgHoXuls= %3d>) or change your email preferences by visitingyour [filter subscription= s page on stackexchange.com](<https://stackexchange.com/users/2208803?tab=
=3Dsubscriptions>).

If you no longer want to receive mail from Stack Exchange, unsubscribe from=  all stackexchange.com emails <https://stackexchange.com/email/manage/22678= 0/dbf1aaad76103a2810d725a2c65de27958b70a5d2bc501a04b4b3f99bc106d1e> Questions? Comments? Let us know on our feedback site at <https://meta.stac= kexchange.com>.

Stack Exchange, Inc. 110 William St, 28th Floor, NY NY 10038


------=_NextPart_000_1CCE_64CE4764.45758CD0 Content-Type: text/html;    charset="UTF-8" Content-Transfer-Encoding: base64

DQo8IURPQ1RZUEUgSFRNTCBQVUJMSUMgIi0vL1czQy8vRFREIEhUTUwgNC4wMS8vRU4iICJodHRw 
...[left the file out here]... 
bGUgLS0+DQo8L2JvZHk+DQo8L2h0bWw+DQo=
------=_NextPart_000_1CCE_64CE4764.45758CD0--

Do all-a-y'all want me to post the attached file here? I have added the email. I was concerned that the python code might be harmful.

  • 9
    screenshot maybe or at least subject, content and sender address? – rene Aug 23 '18 at 22:05
  • 4
    If it wasn't from Stack Exchange, they won't be able to take a look. If it was from Stack Exchange but as a mistake, the record of the email being sent might not be easy to find. But you have the email in your possession, so you can make it really easy to "take a look" by including the Email information here. – Davy M Aug 24 '18 at 0:35
  • Do all-a-y'all want me to post the attached file here? I have added the email. I was concerned that the python code might be harmful. Who am I speaking with? Are all-a-y'all public volunteers or do you work for Joel? Seemed that the company would wanna know if they were emailing users executables. – ox. Aug 24 '18 at 12:32
  • 1
    We're volunteers and users like you, but we're adult and know how to handle base64, just copy the full mail, if you want to contact StackExchange only, then use the contact us link down the page. – Tensibai Aug 24 '18 at 12:37
  • 1
    BTW I'm unsure your mail is not the usual question list from tag newsletter, with plain text and html version, if you find an attached file isn't it that your mail client doesn't support html and the file is just named pythn because that's the tag name ? (the first chars of the base 64 are a typical HTML header as well as the last ones) – Tensibai Aug 24 '18 at 12:48
  • I have the python file that was attached. I can post it here as well. I have not gone over it in detail. I worry if it were run it would pose a security risk. I worry that if I post it here I will break stack exchange rules. I thought stack exchange would want to know their emails have attachments with executables attached and this was the link in the email for issue. – ox. Aug 25 '18 at 12:53
8

That looks like the kind of email you get when you've subscribed to notifications about questions in one or more tags on the Stack Exchange network. And indeed, you have set up a subscription for questions tagged [python] on Stack Overflow: https://stackexchange.com/users/2208803/ox?tab=subscriptions

Since these are questions about Python, it's expected that some of them contain code.

You say "with a Python file attached", but in the mail you posted, I only see a plain text and an HTML part. In particular, your [left the file out here] appears in the middle of the HTML version of the email. Are you sure you're not just seeing some Python code that is part of a Stack Overflow question?

4

Building on what balpha said, we've had issues with certain mail providers breaking in interesting ways when they tweak spam and virus filters. This is the first time I've seen it happen with Python, but even Gmail sometimes tries to convert Javascript snippets to attachments and complains about them being dangerous. It used to be alarmingly common, not too common these days, but still happens.

I envision this very hungry, very angry, very neurotic regular expression living in a lab petri dish somewhere having achieved sentience as a result of usenet cross posting, and the poor souls that have to 'update' it occasionally. That's the only explanation I've ever come up with as to why certain mail clients choke on semantically-correct HTML-ified code markup.

That email was supposed to be all shiny, exciting and enticing! Sorry that you got an awful mess, maybe report it to whatever service is handling your email?

  • The email was fine, it had an attachment that might be hostile code. Not sure. I thought stack exchange might care. And this is where they said to address issues (in email). – ox. Aug 25 '18 at 12:54
3

I looked it over it again and noticed this in the email above:

This post is included in the email:

Ошибка в коде делает из обычного бота ВК флудера

it has a link to a google drive file, and gmail automagically converted it to a file attachment named 'bot.py'.

Interesting, curious if this could be exploited in other ways. Thanks everyone!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .