No post body was provided.
RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
21–30 of 109 posts
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#22Kudos to the author for a fantastic write up. The structure made reading it a really pleasant learning experience - a solid table of contents, an up-front summary, and a sensible list of prerequisites and instructions for following along.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#23Could someone with insight give an estimate for how much you could sell an exploit like this, which let's you RCE a fair bunch of developer machines? It feels that paired with a good blog (ironically about WLS) this could be very profitable, compared to the $0 MS awarded them.
Fortunately, demand for such bugs is pretty low ^, so, $1~2k I guess.
^ this is both a good and a sad indicator, it means the bar of post-exploitation for such a bug (on developers' boxes) is "sufficiently high" that your favorite ransomware gangs are not eager to get on. OTOH it means they have way more "easier" enterprise-y targets...
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#24Earlier quoted context omitted.
> Browsers need to stop connecting to anything other than what's typed into the navigation bar. Yes, indeed!
oh how i would love this future.
Unfortunately, the companies that control today's web have a different view, and they are the ones in charge.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#25Earlier quoted context omitted.
While most of me likes the idea of being paid good money for my efforts, or even for doing nothing if I can get away with it, a rather pesky part of me (a nagging entity that calls itself “a conscience”) would take all the fun out of doing it by enabling harm to others (via selling information on possible exploits, for instance). The other blockers of course being that I have neither the skills nor the time to find s…
meh, if you don't do it someone else will.
Only if everyone takes that attitude.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#26I've only been using VSC for about 6 months. During my the first week of use, I noted how insecure all the plugins and their communications with the main application were set up. Dismayed, I moving the workstation to an airgapped portion of my environment, and the piece of shit would not work without a net connection. So I use VCE inside a VM now. My career includes working for security companies with sensitive information and documents... VSC needs some serious redesigning with multiple experienced security engineers on the team.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#27Issues like this have been repeated countless times in various IDEs, debugger interfaces and local services using browser as UI. Developers need to stop using network sockets as IPC channels for local services unless browsers significantly increase the restrictions on cross site requests. Similar situation with regular CSRF attacks. And it needs to be opt out not opt in. As long it's a responsibility of developer to…
What if browsers learned to connect to Unix sockets? And windows named pipes? And users could control these endpoints by the usual filesystem permissions?
One can dream.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#28Microsoft has the best bounty hunter program: go fuck yourself.
If you find a way to take over MS accounts, or force email swaps, or even gamertag shanaigans, there is too much money to be made, there is not even a point for a bug bounty.
It's like a $40 reward for returning a purse filled with $250k.
I agree with OP: no more free bugs.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#29Earlier quoted context omitted.
While most of me likes the idea of being paid good money for my efforts, or even for doing nothing if I can get away with it, a rather pesky part of me (a nagging entity that calls itself “a conscience”) would take all the fun out of doing it by enabling harm to others (via selling information on possible exploits, for instance). The other blockers of course being that I have neither the skills nor the time to find s…
meh, if you don't do it someone else will.
It is generally held that "Defect" is not the optimal strategy in the Prisoner's dilemma, and that seems to be what you're arguing for here, or something analagous to it.
Follow the golden rule.
Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit
#30Issues like this have been repeated countless times in various IDEs, debugger interfaces and local services using browser as UI. Developers need to stop using network sockets as IPC channels for local services unless browsers significantly increase the restrictions on cross site requests. Similar situation with regular CSRF attacks. And it needs to be opt out not opt in. As long it's a responsibility of developer to…
What if browsers learned to connect to Unix sockets? And windows named pipes? And users could control these endpoints by the usual filesystem permissions? One can dream.
More scope creep?
Browser are already way too big.