If Dracula Dark's telemetry is malicious, VSCode itself also malicious XDDDDD
Malicious VSCode extensions with more than 45k installs
81–90 of 191 posts
Re: Malicious VSCode extensions with more than 45k installs
#82Earlier quoted context omitted.
Yes! Sadly, today nobody seem to care about the principle of least privileges. Take Linux as an example: every program you install gets full access to the system, and gets thousands of privileges it doesn't need. If your PDF reader is vulnerable, it will have both access to your SSH keys and to the Internet to upload them (and if you block Internet access for a PDF reader, it still can send the data by connecting to…
> every program you install gets full access to the system It gets your user's privileges when you run it. It's up to you how you run your programs. Also there's no "default Linux configuration". There are many distributions, and they have different defaults and approaches.
Many distros with many approaches, yet not a single one with a convenient security feature that comment is mentioning
So it's not "up to me" if the good choice is not practical
Re: Malicious VSCode extensions with more than 45k installs
#83Earlier quoted context omitted.
Yes! Sadly, today nobody seem to care about the principle of least privileges. Take Linux as an example: every program you install gets full access to the system, and gets thousands of privileges it doesn't need. If your PDF reader is vulnerable, it will have both access to your SSH keys and to the Internet to upload them (and if you block Internet access for a PDF reader, it still can send the data by connecting to…
Linux has a fundamental security problem - it basically tries to protect the system from the user, not the user from himself (other user apps). So it's difficult to modify a Linux system binary, but it's extremely easy to delete or exfiltrate a user file. This security model might have made sense in the past, but today it's totally outdated since almost all systems, both local and in the cloud, have a single user whi…
Users were important in the past as well :)
Re: Malicious VSCode extensions with more than 45k installs
#84Capabilities-based security prevents these supply chain attacks! (Even though in this case most of the downloads were of packages including unwanted telemetry and not something more dangerous.) “…And now if a [color theme] wants to read your data and send it to a server, it needs a filesystem capability and a network capability. It should be an obvious red flag if a [theming addon] were to ask for those dependencies.…
I want that feature too, but in reality, many non-trivial extensions require the execution of binaries such as language servers. Applying capability models to these executables will require OS support or containerization, but the overhead for memory and disk will be huge. In fact, even an extension to auto-complete paths in .gitignore files requires running a language server written in Rust [1], and it has the real benefit of supporting multiple editors with ease. If the "prettiest java" or "python-vscode" extensions in the article insisted on needing full permissions for Java or Python execution, I believe users would be convinced and end up installing them.
[1] https://github.com/quentinguidee/gitignore-ultimate-vscode
Re: Malicious VSCode extensions with more than 45k installs
#85I'll take the opportunity to self plug:
I've been working on a solution to help bridge this gap of having to blindly trust VSCode extensions, planning to eventually also release it as open source
You're welcome to sign up for early access at https://coderguard.io/
As I'm currently mainly looking for user feedback
Re: Malicious VSCode extensions with more than 45k installs
#86Earlier quoted context omitted.
As a bare minimum security measure, when using plugins (all 9 of them), my Vim runs in a bubblewrap sandbox with only my project folder mounted as writable. Network and IPC access is completely disabled. It is secure enough to stop practically all non-targeted attacks. Generally I try to install plugins whose authors I know. And whenever I update them (once a year) I re-read the entire source code. Some small plugins…
So it's Emacs, but we want features and not to be locked. Don't run propietary crap, trust Elisp repo like ELPA and NonGNU and you will be mostly safe.
Isn't MELPA just serving the latest git master of whatever it happens to be at the time package-refresh-contents was called? With MELPA stable likewise just serving the latest tag? That doesn't spell trust.
Re: Malicious VSCode extensions with more than 45k installs
#87Capabilities-based security prevents these supply chain attacks! (Even though in this case most of the downloads were of packages including unwanted telemetry and not something more dangerous.) “…And now if a [color theme] wants to read your data and send it to a server, it needs a filesystem capability and a network capability. It should be an obvious red flag if a [theming addon] were to ask for those dependencies.…
I want that feature too, but in reality, many non-trivial extensions require the execution of binaries such as language servers. Applying capability models to these executables will require OS support or containerization, but the overhead for memory and disk will be huge. In fact, even an extension to auto-complete paths in .gitignore files requires running a language server written in Rust [1], and it has the real b…
A language server for gitignore is not what I was expecting to come across this morning.
Re: Malicious VSCode extensions with more than 45k installs
#88This article is a good example of how to write a misleading headline. They found 3 extensions, one of which has 45k downloads (because it name squats on a popular package), and another with 1000 installs. The 45k dowload extension (Darcula Dark) collects some data that I would define as telemetry, and the python-vscode extension which is clearly trying to hide what it's doing. Now, whether you define telemetry as mal…
Name squatting always betrays malicious intent. No benefit of the doubt is owed to anyone practicing it.
Darcula Dark could easily be what it says it is, which is an innocent take on the VS Code’s default Darcula theme. I’d be willing to bet there are innocent VSCode extensions with Darcula in the title, and I don’t think that’s unreasonable or traitorous of any kind of intent
Re: Malicious VSCode extensions with more than 45k installs
#89thats why we need wasi/wasm bashed sandboxed plugins scoped bashed on capability it needs.
i think lapce supports wasi plugin but overall ux is not there yet when i last tried.
Re: Malicious VSCode extensions with more than 45k installs
#90I work in this space and see these types of "hit articles" so often.
These "security researchers/products" aren't doing anything more than spreading FUD and trying to sell their own products. Most of the FUD they spread is so widely misunderstood and positioned as if X thousands of machines/developers were "affected". The reality is much different.
In the name of being a good security citizen, please just report these extensions so action can be taken and less copy cats occur. Stop writing about these non-events. The reality of each registry is that there will always be bad extensions/packages/etc. The stewards of each registry work very hard to keep them safe. These types of articles make their lives harder, not easier.