61–70 of 109 posts
[0] https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-cod...
Earlier quoted context omitted.
It's not just Microsoft. What most bug bounties pay isn't even close to the amount you can get from selling it on the black market (assuming you have the right connections). It's why selling exploits to nation states and vendors who work with them is so lucrative.
I do agree that bug bounties are too small, but isn't selling bugs on the black market illegal? I would much rather get $40 dollars for a bug and some public acknowledgement (which I could use to get a better paying job) than to sell it for criminal use.
If I'm reading this right, it assumes the machine's IP is publicly accessible over the internet; which I'm guessing -even with IPv6- is not the case in 99.999% of cases; who just exposes their development machine directly to the internet with a public IP? Still bad, but not quite as bad as owning from the browser via localhost GET.
No, JavaScript running in your browser can connect to it. No remote access required. Of course, if you do allow remote access it is even worse.
Edit: after reading tfa, it appears: no it can't , but it may due to browser security vulnerabilities.
What is the best alternative for TypeScript development? My favorite light-weight editor is Kakoune, but it really doesn't have enough plugins for the kind of work I do.
I've only been using VSC for about 6 months. During my the first week of use, I noted how insecure all the plugins and their communications with the main application were set up. Dismayed, I moving the workstation to an airgapped portion of my environment, and the piece of shit would not work without a net connection. So I use VCE inside a VM now. My career includes working for security companies with sensitive infor…
Why not just use some other editor?
Earlier quoted context omitted.
oh how i would love this future.
At this point of time, I give it 10min before we get a magic_proxy nginx module, then your script src will be /magic_proxy/www.evilthirdpary.com/slow_multi_megabyte_script.js You can still import all nasty third parties required by marketing department, bypassing first party protections and leading to even worse security. Or maybe maintain allow lists, basically that's a Content Security Policy. Future is now old man…
I'd have taken a trip down to Buenos Aires and sold it.
I am not 100% sure, but wouldn't that be a crime under the laws of many countries? If someone left their car unlocked with keys next to your house. Will you also steal it and sell it to somebody?
Earlier quoted context omitted.
> Browsers need to stop connecting to anything other than what's typed into the navigation bar. Yes, indeed!
A web browser that doesn’t support links isn’t much of a web browser
Issues like this have been repeated countless times in various IDEs, debugger interfaces and local services using browser as UI. Developers need to stop using network sockets as IPC channels for local services unless browsers significantly increase the restrictions on cross site requests. Similar situation with regular CSRF attacks. And it needs to be opt out not opt in. As long it's a responsibility of developer to…
What if browsers learned to connect to Unix sockets? And windows named pipes? And users could control these endpoints by the usual filesystem permissions? One can dream.
Microsoft has the best bounty hunter program: go fuck yourself. If you find a way to take over MS accounts, or force email swaps, or even gamertag shanaigans, there is too much money to be made, there is not even a point for a bug bounty. It's like a $40 reward for returning a purse filled with $250k. I agree with OP: no more free bugs.
Pay-per-bug-found incentivises plenty of counterproductive things as well, especially if we're talking about people who happily sell to anyone on the black market.