Machine Learning Attack Series: Backdooring Pickle Files
Brief
Recently I read this excellent post by Evan Sultanik about exploiting pickle files on Trail of Bits. There was also a DefCon30 talk about backdooring pickle files by ColdwaterQ .
This got me curious to try out backdooring a pickle file myself.
Pickle files - the surprises
Surprisingly Python pickle files are compiled programs running in a VM called the Pickle Machine (PM). Opcodes control the flow, and when there are opcodes there is often fun to be had.