Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

parsiya.net

Post reply on HN
Print view View original

51–60 of 109 posts

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#51

Post by easton »

2ion wrote: post #41

In a sense Microsoft forgot its own learnings. Because of exactly things like this they prevent UWP apps from connecting to localhost by default and make it very annoying to circumvent and from my experience, the circumvention is not exactly a stable setup. So they really don't want you to do that, and somebody thought enough to make it extra difficult. So, they have UWP, all those well thought-out policies, then mak…

Apps installed from the Microsoft Store are no longer guaranteed safe, as Win32 apps can be added to the store now and installed via winget. There’s static analysis and they run the installer, but if it does something stupid after the install they can’t automatically detect it.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#52

Post by 8organicbits »

SamuelAdams wrote: post #35
8organicbits wrote: post #6

> Does it fix the issues? Yes. > Do I think there are other security issues here and we can bypass this? Also, yes. > Do I want to spend more time doing free work for a company with a 2.5 TRILLION market cap? Hell, no. Troubling.

Not really all that troubling, all the author is saying is that he wants to get paid for their work. Either Microsoft or other future vendors can actually honor an established bug bounty program, or the author can sell his findings to the highest bidder. Or the author can simply not spend time and energy finding bugs in the first place.

Don't miss the middle statement; the author thinks there are further attacks here, even with the fix. Others can also find and then choose to report/sell at their own discretion.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#53

Post by shukantpal »

rajin444 wrote: post #47
oaiey wrote: post #40

Earlier quoted context omitted.

Highest bidder is unethical and illegal. But does not change the monetary reality

Pass a law that requires companies to pay black market value for bug bounties. It’s also unethical for big corporations to exploit the US oligarchy to get these fixes for free.

There’s no exploitation going on.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#54

Post by Pxtl »

cryptonym wrote: post #38
Xelbair wrote: post #19

Earlier quoted context omitted.

oh how i would love this future.

At this point of time, I give it 10min before we get a magic_proxy nginx module, then your script src will be /magic_proxy/www.evilthirdpary.com/slow_multi_megabyte_script.js You can still import all nasty third parties required by marketing department, bypassing first party protections and leading to even worse security. Or maybe maintain allow lists, basically that's a Content Security Policy. Future is now old man…

At least then the server has to deal with the security implications of talking directly to the advertiser, instead of pushing the risk wholly to the client.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#55

Post by ravenstine »

SahAssar wrote: post #4

Not making websockets follow the same-origin policy was a mistake.

In fairness, couldn't the same things still be accomplished with cross-origin POST/GET requests? Not that there isn't some regretability to not making those strictly same-origin as well.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#56

Post by nostoc »

_wldu wrote: post #44
Debug_Overload wrote: post #39

Earlier quoted context omitted.

It's not just Microsoft. What most bug bounties pay isn't even close to the amount you can get from selling it on the black market (assuming you have the right connections). It's why selling exploits to nation states and vendors who work with them is so lucrative.

I do agree that bug bounties are too small, but isn't selling bugs on the black market illegal? I would much rather get $40 dollars for a bug and some public acknowledgement (which I could use to get a better paying job) than to sell it for criminal use.

How about selling legally to a state actor for 100k ?

Bug bounties need to be higher, because the black market is not the only alternative.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#57

Post by Xelbair »

cryptonym wrote: post #38
Xelbair wrote: post #19

Earlier quoted context omitted.

oh how i would love this future.

At this point of time, I give it 10min before we get a magic_proxy nginx module, then your script src will be /magic_proxy/www.evilthirdpary.com/slow_multi_megabyte_script.js You can still import all nasty third parties required by marketing department, bypassing first party protections and leading to even worse security. Or maybe maintain allow lists, basically that's a Content Security Policy. Future is now old man…

sure, but as other person stated -servers deals with that, and all legal implications about data protection apply to them - it's harder to weasel out of it that way.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#58

Post by cryptonym »

Pxtl wrote: post #54
cryptonym wrote: post #38

Earlier quoted context omitted.

At this point of time, I give it 10min before we get a magic_proxy nginx module, then your script src will be /magic_proxy/www.evilthirdpary.com/slow_multi_megabyte_script.js You can still import all nasty third parties required by marketing department, bypassing first party protections and leading to even worse security. Or maybe maintain allow lists, basically that's a Content Security Policy. Future is now old man…

At least then the server has to deal with the security implications of talking directly to the advertiser, instead of pushing the risk wholly to the client.

In the end the script is running on client, dealing with user data, not server data. Client is still taking the risk.

On moral/legal issues, integrating script from third or first party hostname sounds like technical detail. If you select partner to run their code on your pages, you should be responsible checking user consent when applicable and taking responsibility. British Airways has been fined £20m even if that script was not on their servers.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#60

Post by ensignavenger »

darkwater wrote: post #50
_wldu wrote: post #44

Earlier quoted context omitted.

I do agree that bug bounties are too small, but isn't selling bugs on the black market illegal? I would much rather get $40 dollars for a bug and some public acknowledgement (which I could use to get a better paying job) than to sell it for criminal use.

> but isn't selling bugs on the black market illegal? Noob question: is there any specific law that punishes describing how to get into a software/electronic system but not actually doing it? Something that is just not purely US-centric.

Here is UK specific answer, and as they point out, if you sell to some one knowing they are going to commit a crime with it, you can be considered an accomplice in many jurisdictions.

https://law.stackexchange.com/questions/11552/is-it-illegal-...

Post reply on HN