Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious VSCode extensions with more than 45k installs

blog.checkpoint.com

Post reply on HN
Print view View original

11–20 of 191 posts

Re: Malicious VSCode extensions with more than 45k installs

#11

Post by mango7283 »

krageon wrote: post #4
factorialboy wrote: post #2

This is one of the reasons I am *very* hesitant with VS Code extensions and Jetbrains plugins. The absolute minimum is strictly enforced on all my machines. Ditto for project dependencies (NPM, PyPi, Gradle etc.) However, the way things are going, news of these vulnerabilities / incidents will be used to push through the Codespaces (IDE on the cloud) among enterprises -- and many companies will fall for it. I guess s…

> I guess software engineers and technical experts cannot be trusted anymore to keep their machines safe. Were they ever? It's a big set of folks, and while some of them were and are competent an even larger subset isn't.

Too add salt to the wound often their machines have more rights/access too, making the impact that much more.

Re: Malicious VSCode extensions with more than 45k installs

#12

Post by MrGilbert »

factorialboy wrote: post #2

This is one of the reasons I am *very* hesitant with VS Code extensions and Jetbrains plugins. The absolute minimum is strictly enforced on all my machines. Ditto for project dependencies (NPM, PyPi, Gradle etc.) However, the way things are going, news of these vulnerabilities / incidents will be used to push through the Codespaces (IDE on the cloud) among enterprises -- and many companies will fall for it. I guess s…

> I guess software engineers and technical experts cannot be trusted anymore to keep their machines safe. :-/

I think we never could in the first place? While we are more cautious than the average user, we might occasionally shoot ourself in the foot. That’s part of our job.

The extensions shown in this example would not have ended up on my machine, simply because of the red flags they come with.

Re: Malicious VSCode extensions with more than 45k installs

#13

Post by maccard »

This article is a good example of how to write a misleading headline. They found 3 extensions, one of which has 45k downloads (because it name squats on a popular package), and another with 1000 installs.

The 45k dowload extension (Darcula Dark) collects some data that I would define as telemetry, and the python-vscode extension which is clearly trying to hide what it's doing. Now, whether you define telemetry as malicious or not may shape how you feel, but let's be honest, there's a world of difference between sending your OS versions to a telemetry server and injecting obfuscated code.

Re: Malicious VSCode extensions with more than 45k installs

#14

Post by [deleted] »

qup wrote: post #3
factorialboy wrote: post #2

This is one of the reasons I am *very* hesitant with VS Code extensions and Jetbrains plugins. The absolute minimum is strictly enforced on all my machines. Ditto for project dependencies (NPM, PyPi, Gradle etc.) However, the way things are going, news of these vulnerabilities / incidents will be used to push through the Codespaces (IDE on the cloud) among enterprises -- and many companies will fall for it. I guess s…

My God, the list of npm dependencies some projects I've worked on had. Endless. Anyway, it could have been me. I don't inspect vim plugins before install, generally. Security is hard. Even if you're an expert, it's a lot of work.

[deleted]

Re: Malicious VSCode extensions with more than 45k installs

#15

Post by maccard »

throwaway290 wrote: post #10
qup wrote: post #3

Earlier quoted context omitted.

My God, the list of npm dependencies some projects I've worked on had. Endless. Anyway, it could have been me. I don't inspect vim plugins before install, generally. Security is hard. Even if you're an expert, it's a lot of work.

I always give source code a glance, unless it's by a sufficiently prominent and reputable maintainer.

Do you check _their_ dependencies though? And do you check every file?

Re: Malicious VSCode extensions with more than 45k installs

#17

Post by hardware2win »

factorialboy wrote: post #2

This is one of the reasons I am *very* hesitant with VS Code extensions and Jetbrains plugins. The absolute minimum is strictly enforced on all my machines. Ditto for project dependencies (NPM, PyPi, Gradle etc.) However, the way things are going, news of these vulnerabilities / incidents will be used to push through the Codespaces (IDE on the cloud) among enterprises -- and many companies will fall for it. I guess s…

>I guess software engineers and technical experts cannot be trusted anymore to keep their machines safe. :-/

When SEs could be trusted?

We run so much 3rd party code that it would be insane to expect SEs to verify it.

Security industry is also heavy of bullshit

Instead of performing reviews they run some "scanners" and fill checkboxes

Re: Malicious VSCode extensions with more than 45k installs

#18

Post by moonchrome »

factorialboy wrote: post #2

This is one of the reasons I am *very* hesitant with VS Code extensions and Jetbrains plugins. The absolute minimum is strictly enforced on all my machines. Ditto for project dependencies (NPM, PyPi, Gradle etc.) However, the way things are going, news of these vulnerabilities / incidents will be used to push through the Codespaces (IDE on the cloud) among enterprises -- and many companies will fall for it. I guess s…

I think if it's a large org you should treat engineer machines as threat vectors by default, PoLP and all that jazz.

Someone already posted here how they were able to use PIP to hijack Google developer machines because on their machines defaults were to resolve to public repo first (even for private packages). Google just closed/ignored the issue because this was engineers problem and official build was setup to resolve correctly (this is my from memory summary)

Re: Malicious VSCode extensions with more than 45k installs

#19

Post by fwlr »

Capabilities-based security prevents these supply chain attacks! (Even though in this case most of the downloads were of packages including unwanted telemetry and not something more dangerous.)

“…And now if a [color theme] wants to read your data and send it to a server, it needs a filesystem capability and a network capability. It should be an obvious red flag if a [theming addon] were to ask for those dependencies. And this makes it hard to hide malware.” https://borretti.me/article/how-capabilities-work-austral

The original quote talks about a leftpad dependency but it’s a drop-in substitution to apply it here, too. It’s right there in the screenshot:

    const https = require(‘http’)
    const os = require(‘os’)
Both of those calls ought to error out with “Error: Network capability not provided” and “Error: filesystem capability not provided”, respectively.

Re: Malicious VSCode extensions with more than 45k installs

#20

Post by imoverclocked »

samwillis wrote: post #7
factorialboy wrote: post #2

This is one of the reasons I am *very* hesitant with VS Code extensions and Jetbrains plugins. The absolute minimum is strictly enforced on all my machines. Ditto for project dependencies (NPM, PyPi, Gradle etc.) However, the way things are going, news of these vulnerabilities / incidents will be used to push through the Codespaces (IDE on the cloud) among enterprises -- and many companies will fall for it. I guess s…

There must be a huge market for "audited and validated" subsets of the major package managers. For a monthly fee you have access to a secure version where all dependancies are checked (manually, or automatically) for vulnerabilities and where no new packages, or versions, can be added without having eyes over by a human. Throw in a credits or fees system where you can request, for a cost, a none audited package is ad…

Sure, but the business model for the entity providing that sucks. Practically infinite amounts of possible exploits and extremely finite resources to detect them. Either that or you are back to where you started with a web of trust.
Post reply on HN