Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

parsiya.net

Post reply on HN
Print view View original

91–100 of 109 posts

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#91

Post by rabite »

moritonal wrote: post #2

Could someone with insight give an estimate for how much you could sell an exploit like this, which let's you RCE a fair bunch of developer machines? It feels that paired with a good blog (ironically about WLS) this could be very profitable, compared to the $0 MS awarded them.

I just asked around, I immediately had someone who I've sold exploits to tell me I could field 45k for a bug like this. There's a lot of conditions to selling exploits -- the biggest being that you don't get to blog about what you sell. But it is real money.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#92

Post by tata71 »

ackbar03 wrote: post #12
dspillett wrote: post #7

Earlier quoted context omitted.

While most of me likes the idea of being paid good money for my efforts, or even for doing nothing if I can get away with it, a rather pesky part of me (a nagging entity that calls itself “a conscience”) would take all the fun out of doing it by enabling harm to others (via selling information on possible exploits, for instance). The other blockers of course being that I have neither the skills nor the time to find s…

meh, if you don't do it someone else will.

Individual Humanism will return.

It's long overdue.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#93

Post by jodrellblank »

throw10920 wrote: post #73
jodrellblank wrote: post #71

Earlier quoted context omitted.

VS Code is MIT Licensed - https://github.com/Microsoft/vscode Arguably the MIT license gives you more Freedom than the GPL'd Linux kernel or GNU utilities. Trying to draw a distinction between "evil user-unfriendly Microsoft stuff" and "Holy Saviour FOSS" is not meaningful anymore.

Some parts of VSCode are MIT Licensed - not all of it, and in particular, parts of the standard VSCode that almost everybody downloads are straight-up proprietary, per the article[1]. [1] https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-cod...

> "Some parts of VSCode are MIT Licensed - not all of it"

The source code, the editor are. This is like Oracle releasing a proprietary plugin for EMACS and distributing it on Oracle Linux, and someone saying "this is bad, we need FOSS editors!". That wouldn't make EMACS not-FOSS.

(Is it trolling of me to point out that of course the thing people actually want is not the FOSS bit? There are dozens of editors, people want features not ideology)

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#94

Post by mrtnpwn »

christophilus wrote: post #42

What is the best alternative for TypeScript development? My favorite light-weight editor is Kakoune, but it really doesn't have enough plugins for the kind of work I do.

Sublime Text 4 with LSP-TypeScript is really nice. The official package that Microsoft ships with the TypeScript Language Server tends to stop working after a while... I'm not sure why but that's that.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#95

Post by [deleted] »

Jerrrry wrote: post #28

Microsoft has the best bounty hunter program: go fuck yourself. If you find a way to take over MS accounts, or force email swaps, or even gamertag shanaigans, there is too much money to be made, there is not even a point for a bug bounty. It's like a $40 reward for returning a purse filled with $250k. I agree with OP: no more free bugs.

[deleted]

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#96

Post by voakbasda »

_wldu wrote: post #44
Debug_Overload wrote: post #39

Earlier quoted context omitted.

It's not just Microsoft. What most bug bounties pay isn't even close to the amount you can get from selling it on the black market (assuming you have the right connections). It's why selling exploits to nation states and vendors who work with them is so lucrative.

I do agree that bug bounties are too small, but isn't selling bugs on the black market illegal? I would much rather get $40 dollars for a bug and some public acknowledgement (which I could use to get a better paying job) than to sell it for criminal use.

Or, sell it on the black market, and use that connection to get a better job on the black market. Reputation is just as important for criminals, and crime pays better (until you get caught).

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#97

Post by darkarmani »

jodrellblank wrote: post #70
Jerrrry wrote: post #28

Microsoft has the best bounty hunter program: go fuck yourself. If you find a way to take over MS accounts, or force email swaps, or even gamertag shanaigans, there is too much money to be made, there is not even a point for a bug bounty. It's like a $40 reward for returning a purse filled with $250k. I agree with OP: no more free bugs.

Make bug bounties pay $250k and people will have their friend inside add some bugs for the outsider to find, and share the payday. Pay-per-bug-found incentivises plenty of counterproductive things as well, especially if we're talking about people who happily sell to anyone on the black market.

You can do that today with blackmarket exploits, so why do you think actual bug bounties will cause this problem?

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#98

Post by DangitBobby »

christophilus wrote: post #42

What is the best alternative for TypeScript development? My favorite light-weight editor is Kakoune, but it really doesn't have enough plugins for the kind of work I do.

Webstorm is quite good. Better than VsCode, in my opinion. I use PyCharm while working on a Django/React monolith and I would say even that is better for TS than VsCode.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#99

Post by Arnavion »

nine_k wrote: post #27
Karliss wrote: post #5

Issues like this have been repeated countless times in various IDEs, debugger interfaces and local services using browser as UI. Developers need to stop using network sockets as IPC channels for local services unless browsers significantly increase the restrictions on cross site requests. Similar situation with regular CSRF attacks. And it needs to be opt out not opt in. As long it's a responsibility of developer to…

What if browsers learned to connect to Unix sockets? And windows named pipes? And users could control these endpoints by the usual filesystem permissions? One can dream.

You don't even need Windows named pipes. Windows supports AF_UNIX since 10.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#100

Post by garren »

easton wrote: post #51
2ion wrote: post #41

In a sense Microsoft forgot its own learnings. Because of exactly things like this they prevent UWP apps from connecting to localhost by default and make it very annoying to circumvent and from my experience, the circumvention is not exactly a stable setup. So they really don't want you to do that, and somebody thought enough to make it extra difficult. So, they have UWP, all those well thought-out policies, then mak…

Apps installed from the Microsoft Store are no longer guaranteed safe, as Win32 apps can be added to the store now and installed via winget. There’s static analysis and they run the installer, but if it does something stupid after the install they can’t automatically detect it.

Don’t the win32 apps restrict the calls in that subsystem that one can access?

I recall looking into this a while back with the intention of leveraging it for an ancient win32/mfc app. I don’t remember the specifics, but I seem to recall that MS restricted or prevented access to a rather substantial subset of win32.

Post reply on HN