Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

parsiya.net

Post reply on HN
Print view View original

101–109 of 109 posts

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#101

Post by WorldMaker »

garren wrote: post #100
easton wrote: post #51

Earlier quoted context omitted.

Apps installed from the Microsoft Store are no longer guaranteed safe, as Win32 apps can be added to the store now and installed via winget. There’s static analysis and they run the installer, but if it does something stupid after the install they can’t automatically detect it.

Don’t the win32 apps restrict the calls in that subsystem that one can access? I recall looking into this a while back with the intention of leveraging it for an ancient win32/mfc app. I don’t remember the specifics, but I seem to recall that MS restricted or prevented access to a rather substantial subset of win32.

Not anymore. Microsoft gave up on trying to sandbox Windows Store installs for Win32 apps.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#103

Post by jml7c5 »

mikotodomo wrote: post #102

I don't get the video https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-cod... He goes to the hacker website and then calculator opens?

A common way to demonstrate an RCE exploit is to make the payload launch calc.exe, implying that you can run arbitrary executables. It's a bit of a meme.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#104

Post by jodrellblank »

darkarmani wrote: post #97
jodrellblank wrote: post #70

Earlier quoted context omitted.

Make bug bounties pay $250k and people will have their friend inside add some bugs for the outsider to find, and share the payday. Pay-per-bug-found incentivises plenty of counterproductive things as well, especially if we're talking about people who happily sell to anyone on the black market.

You can do that today with blackmarket exploits, so why do you think actual bug bounties will cause this problem?

Because then you'll be able to do it without needing any black market connections or transactions, which will make it easier, more of it happens above board, there's less to trace or indicate any problem so it's less discoverable, the payment is from a trusted source.

Why would making it easier make it happen less often?

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#105

Post by executive »

vorpalhex wrote: post #77
azalemeth wrote: post #61

The "Your editor has DRM" section alone [0] is enough for me to continue to advocate for a better user-friendly FOSS IDE, in addition to the wonderful giants of emacs & vim, and to avoid the VS Code "kool aid". [0] https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-cod...

VSCodium is a FOSS build of the MIT VSCode repo, with an alternate FOSS compliant extension source. Note that some fancy extensions are missing, but otherwise works 100%. I have been using VSCodium as my main IDE for about a year now. https://vscodium.com/

Tried this today. Cannot use with Remote-WSL extension & others.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#106

Post by vorpalhex »

executive wrote: post #105
vorpalhex wrote: post #77

Earlier quoted context omitted.

VSCodium is a FOSS build of the MIT VSCode repo, with an alternate FOSS compliant extension source. Note that some fancy extensions are missing, but otherwise works 100%. I have been using VSCodium as my main IDE for about a year now. https://vscodium.com/

Tried this today. Cannot use with Remote-WSL extension & others.

Yep, the WSL extensions are closed source and hard locked to the proprietary Microsoft build of VSCode.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#107

Post by 2ion »

WorldMaker wrote: post #101
garren wrote: post #100

Earlier quoted context omitted.

Don’t the win32 apps restrict the calls in that subsystem that one can access? I recall looking into this a while back with the intention of leveraging it for an ancient win32/mfc app. I don’t remember the specifics, but I seem to recall that MS restricted or prevented access to a rather substantial subset of win32.

Not anymore. Microsoft gave up on trying to sandbox Windows Store installs for Win32 apps.

That's good to know. It was still locked down when I looked into it last time.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#108

Post by niros_valtos »

Karliss wrote: post #5

Issues like this have been repeated countless times in various IDEs, debugger interfaces and local services using browser as UI. Developers need to stop using network sockets as IPC channels for local services unless browsers significantly increase the restrictions on cross site requests. Similar situation with regular CSRF attacks. And it needs to be opt out not opt in. As long it's a responsibility of developer to…

The problem isn’t using one tech or another, but the fact that malicious extensions can be installed and we cannot detect it.

Re: RCE in Visual Studio Code's Remote WSL for Fun and Negative Profit

#109

Post by mikotodomo »

jml7c5 wrote: post #103
mikotodomo wrote: post #102

I don't get the video https://parsiya.net/blog/2021-12-20-rce-in-visual-studio-cod... He goes to the hacker website and then calculator opens?

A common way to demonstrate an RCE exploit is to make the payload launch calc.exe, implying that you can run arbitrary executables. It's a bit of a meme.

No post body was provided.
Post reply on HN