Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious VSCode extensions with more than 45k installs

blog.checkpoint.com

Post reply on HN
Print view View original

91–100 of 191 posts

Re: Malicious VSCode extensions with more than 45k installs

#91

Post by criddell »

thenerdhead wrote: post #90

I work in this space and see these types of "hit articles" so often. These "security researchers/products" aren't doing anything more than spreading FUD and trying to sell their own products. Most of the FUD they spread is so widely misunderstood and positioned as if X thousands of machines/developers were "affected". The reality is much different. In the name of being a good security citizen, please just report thes…

> The stewards of each registry work very hard to keep them safe.

What kinds of things do they do? Any idea how this slipped through? Do you know what the review process entails before a plugin is made available for download?

Re: Malicious VSCode extensions with more than 45k installs

#92

Post by thenerdhead »

pdimitar wrote: post #77
maccard wrote: post #13

This article is a good example of how to write a misleading headline. They found 3 extensions, one of which has 45k downloads (because it name squats on a popular package), and another with 1000 installs. The 45k dowload extension (Darcula Dark) collects some data that I would define as telemetry, and the python-vscode extension which is clearly trying to hide what it's doing. Now, whether you define telemetry as mal…

Name squatting always betrays malicious intent. No benefit of the doubt is owed to anyone practicing it.

Before you go down this rabbit hole, consider that many extensions are slight forks of others. There isn't always malicious intent. Just people who try to extend the extensions and publish them without knowing otherwise.

For example go look at any popular "Hello world" type of extension and you'll see many results of extensions in this definition of "name squatting".

i.e. https://marketplace.visualstudio.com/search?term=word%20coun...

VS Code Marketplace has a namesquatting problem. It doesn't always imply malicious intent though.

Re: Malicious VSCode extensions with more than 45k installs

#93

Post by fwlr »

oofsa wrote: post #84
fwlr wrote: post #19

Capabilities-based security prevents these supply chain attacks! (Even though in this case most of the downloads were of packages including unwanted telemetry and not something more dangerous.) “…And now if a [color theme] wants to read your data and send it to a server, it needs a filesystem capability and a network capability. It should be an obvious red flag if a [theming addon] were to ask for those dependencies.…

I want that feature too, but in reality, many non-trivial extensions require the execution of binaries such as language servers. Applying capability models to these executables will require OS support or containerization, but the overhead for memory and disk will be huge. In fact, even an extension to auto-complete paths in .gitignore files requires running a language server written in Rust [1], and it has the real b…

This… is a very strong objection and I think you’re right that users would be convinced. I didn’t think capabilities would be a panacea but I did think they would be pretty close, I have to revise that down somewhat.

Re: Malicious VSCode extensions with more than 45k installs

#94

Post by 8organicbits »

I think this is missing advice for staying safe. It mostly just pushes their product and says

> it’s our responsibility to verify

I'd recommend checking of your extensions are from a verified publisher. See https://code.visualstudio.com/api/working-with-extensions/pu...

Re: Malicious VSCode extensions with more than 45k installs

#95

Post by robertlagrant »

samatman wrote: post #62
codedokode wrote: post #34

Earlier quoted context omitted.

Yes! Sadly, today nobody seem to care about the principle of least privileges. Take Linux as an example: every program you install gets full access to the system, and gets thousands of privileges it doesn't need. If your PDF reader is vulnerable, it will have both access to your SSH keys and to the Internet to upload them (and if you block Internet access for a PDF reader, it still can send the data by connecting to…

> No. Theming addons should not even be able to ask for those privileges. That's not the principle of least privilege, that's a user rule, and it isn't necessarily a good one. I can imagine, for example, a theming add-on which queries a weather API and picks colors based on that, perhaps displaying a nice weather bar in the status line. Such a theme would need to be granted this privilege, which should ideally be res…

Agree, although what would be really useful is if the capability listed exactly what data will be queried from VSCode and sent to the remote endpoint.

Re: Malicious VSCode extensions with more than 45k installs

#96

Post by codedokode »

anthk wrote: post #69
codedokode wrote: post #34

Earlier quoted context omitted.

Yes! Sadly, today nobody seem to care about the principle of least privileges. Take Linux as an example: every program you install gets full access to the system, and gets thousands of privileges it doesn't need. If your PDF reader is vulnerable, it will have both access to your SSH keys and to the Internet to upload them (and if you block Internet access for a PDF reader, it still can send the data by connecting to…

>is a joke What did you expect? This is a computer to access and manipulate data, not to consume it as a smartphone. Call me when a smartphone locked toyware can do 1% of what Emacs can do. If any, stop using propietary crap to do your daily job.

If I am the one who decides what is locked (and not Google or Apple) then "smartphone" security model is good for me.

Re: Malicious VSCode extensions with more than 45k installs

#97

Post by thenerdhead »

criddell wrote: post #91
thenerdhead wrote: post #90

I work in this space and see these types of "hit articles" so often. These "security researchers/products" aren't doing anything more than spreading FUD and trying to sell their own products. Most of the FUD they spread is so widely misunderstood and positioned as if X thousands of machines/developers were "affected". The reality is much different. In the name of being a good security citizen, please just report thes…

> The stewards of each registry work very hard to keep them safe. What kinds of things do they do? Any idea how this slipped through? Do you know what the review process entails before a plugin is made available for download?

Many things...

They verify that submissions meet criteria.

They scan for known malicious code/vulnerabilities.

They work with security researchers to take appropriate action on reports.

They enforce CoC and ToS policy to any that abuse it.

They work with the community to address any unrest.

They continuously monitor for suspicious activity.

They respond to active security incidents.

They work across many security working groups to stay current on best practices, latest standards, newest initiatives.

As to your other questions, this isn't "slipping through". These registries act under a "trust but verify" model. It simply would not scale if they had to manually review all submissions akin to the app store(Zero trust). Most of these registries run on volunteers or small pizza teams.

Every single registry has similar challenges. PyPi just last weekend had to halt user sign-ups and uploads due to these abuses.

Re: Malicious VSCode extensions with more than 45k installs

#98

Post by robertlagrant »

fwlr wrote: post #78
explaininjs wrote: post #48

Earlier quoted context omitted.

Indeed. Professional woodworking equipment can also cut you, but that’s a risk we accept as we know their developers also care more about providing a tool that works and can be used responsibly by trained professionals. Yes we could insist everyone only hands us straight jackets in padded rooms, but I’m not sure that’d be a good thing.

For over 20 years now, professional woodworkers have had SawStops, devices that literally use an explosive charge to ram a block of aluminum into the blade of a table saw when it detects that the blade is touching something that might be a human body part. These are $50+ devices that destroy themselves on use (and often destroy the $50+ blade they’re used on), they have a high false positive rate, and yet they’re sti…

I remember as a kid seeing the Tomorrow's World episode where the chap demonstrated it to probably Philippa Forrester and Peter Snow. It looked like magic. What a great idea.

Re: Malicious VSCode extensions with more than 45k installs

#99

Post by Silhouette »

anthk wrote: post #75
Silhouette wrote: post #23

Some people have argued that we should work inside expendable and tightly restricted VMs when doing anything that involves fetching packages from a repository using a package manager. I used to feel that was quite an extreme position but it does make sense because the risk we're discussing is really a consequence of two systemic vulnerabilities. Mainstream desktop operating systems have weak security models that aren…

>Mainstream desktop operating systems have weak security models that aren't fit for purpose in our modern online-first world Stop using propietary software first, then we will discuss your "security" rants. Perl users have been using CPAN since forever, so did LaTeX users with CTAN. Ditto with Emacs users with ELPA and NonGNU. No issues with addons.

This has little to do with being open or proprietary. CPAN is analogous to repositories we use with pip or npm today and most of what is involved is not proprietary on any of those platforms. The relevant differences are cultural and technical.

I don't think invoking CTAN as an example is very convincing. It's well known that there are only seven people in the universe who can actually program TeX and they probably have little interest in trying to infect each other with malware.

Re: Malicious VSCode extensions with more than 45k installs

#100

Post by codedokode »

oofsa wrote: post #84
fwlr wrote: post #19

Capabilities-based security prevents these supply chain attacks! (Even though in this case most of the downloads were of packages including unwanted telemetry and not something more dangerous.) “…And now if a [color theme] wants to read your data and send it to a server, it needs a filesystem capability and a network capability. It should be an obvious red flag if a [theming addon] were to ask for those dependencies.…

I want that feature too, but in reality, many non-trivial extensions require the execution of binaries such as language servers. Applying capability models to these executables will require OS support or containerization, but the overhead for memory and disk will be huge. In fact, even an extension to auto-complete paths in .gitignore files requires running a language server written in Rust [1], and it has the real b…

> Applying capability models to these executables will require OS support or containerization, but the overhead for memory and disk will be huge.

This is because most OSes use outdated security model where the app gets all privileges by default and poor users have to build containers to revoke them, that's why there is an overhead.

If the extension only has access to project files then all applications launched by it should inherit its restrictions.

Post reply on HN