Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious VSCode extensions with more than 45k installs

blog.checkpoint.com

Post reply on HN
Print view View original

121–130 of 191 posts

Re: Malicious VSCode extensions with more than 45k installs

#121

Post by TheRealDunkirk »

codedokode wrote: post #34
fwlr wrote: post #19

Capabilities-based security prevents these supply chain attacks! (Even though in this case most of the downloads were of packages including unwanted telemetry and not something more dangerous.) “…And now if a [color theme] wants to read your data and send it to a server, it needs a filesystem capability and a network capability. It should be an obvious red flag if a [theming addon] were to ask for those dependencies.…

Yes! Sadly, today nobody seem to care about the principle of least privileges. Take Linux as an example: every program you install gets full access to the system, and gets thousands of privileges it doesn't need. If your PDF reader is vulnerable, it will have both access to your SSH keys and to the Internet to upload them (and if you block Internet access for a PDF reader, it still can send the data by connecting to…

> Take Linux as an example: every program you install gets full access to the system...

... which should be locked down by group assignments and file-system permission flags. What the hell am I missing? The POSIX model has worked extraordinarily well for decades. The issue you're describing would be no different in Windows or any other operating system. If you install a malicious program, it can embed whatever protocols and communication channels it needs to exfiltrate any data your user account has access to. It's great to advocate for absolute least privilege in programs, but the only people who want to manage a matrix of permissions for every application the system would be IT managers who don't have to deal with the hassle or the complaints. This is precisely why so many things slip through on mobile. "Ain't nobody got time for that."

Re: Malicious VSCode extensions with more than 45k installs

#122

Post by arthie »

fwlr wrote: post #19

Capabilities-based security prevents these supply chain attacks! (Even though in this case most of the downloads were of packages including unwanted telemetry and not something more dangerous.) “…And now if a [color theme] wants to read your data and send it to a server, it needs a filesystem capability and a network capability. It should be an obvious red flag if a [theming addon] were to ask for those dependencies.…

This is exactly what deno does: https://deno.com/manual@v1.33.4/basics/permissions

Re: Malicious VSCode extensions with more than 45k installs

#123

Post by moonchrome »

megous wrote: post #64
moonchrome wrote: post #18

Earlier quoted context omitted.

I think if it's a large org you should treat engineer machines as threat vectors by default, PoLP and all that jazz. Someone already posted here how they were able to use PIP to hijack Google developer machines because on their machines defaults were to resolve to public repo first (even for private packages). Google just closed/ignored the issue because this was engineers problem and official build was setup to reso…

Oh, yeah. That's how I have to treat large orgs as a contractor. :) And trouble start almost immediately, because they apply PoLP only to you... First thing with a new client is usually some form of a VPN access. Even with open protocols, it's challenging to secure a VPN access. Eg. by default running openvpn with a random config provided by a third party allows the third party to push any network setup they want rem…

I use a VM for each client. I host it on my desktop and then when I need to work from a laptop I just SSH into the VM.

This way I never "forget to turn off the client VPN" and similar BS, and my client files don't get mixed up, etc.

Re: Malicious VSCode extensions with more than 45k installs

#124

Post by numbsafari »

thenerdhead wrote: post #106
numbsafari wrote: post #105

Earlier quoted context omitted.

But it does imply a trust and quality issue with the VSCode marketplace. Combined with the lack of a proper sandbox or TCB for plugins, having an untrustworthy “marketplace” makes VSCode sound like a disaster waiting to be installed.

That's an opinion. Another opinion is that there is plenty of crap on every registry and some are better at surfacing and cleaning up than others. Similar to the US Navy and ships that are rust-free versus those battling rust. It doesn't affect the performance of those ships, just the perception. Left on for too long could eat away the actual integrity. Not all problems are the registry's to burden. Trust and quality…

VSCode doesn’t even provide a framework for enabling that decision making. Sure, you could forgo the use of any plugins, but so much of VScode’s functionality is derived from plugins, you’d be better off just using notepad.

To be fair, vim and emacs aren’t any better.

Most of our dev tools are based on plug-in models that have zero security model baked in.

Re: Malicious VSCode extensions with more than 45k installs

#125

Post by andrewmcwatters »

There's some capabilities-based security talk going on here, but the current state of the art in JavaScript makes absolutely no sense to me. It's nonsensical on its face. Right now, you grant caps through Deno to the whole executable script--so dependencies left and right that don't need caps get them.

So, what's the point? It's literally worthless. It does nothing to stop capabilities abuse.

The same thing could have happened here with Visual Studio Code. The language nor its popular runtimes are simply not designed for this behavior.

As far as I know Node.js still doesn't have capabilities functionality, which doesn't matter, because how broken Deno's is means they're practically on the same footing.

Re: Malicious VSCode extensions with more than 45k installs

#126

Post by dunham »

codedokode wrote: post #34
fwlr wrote: post #19

Capabilities-based security prevents these supply chain attacks! (Even though in this case most of the downloads were of packages including unwanted telemetry and not something more dangerous.) “…And now if a [color theme] wants to read your data and send it to a server, it needs a filesystem capability and a network capability. It should be an obvious red flag if a [theming addon] were to ask for those dependencies.…

Yes! Sadly, today nobody seem to care about the principle of least privileges. Take Linux as an example: every program you install gets full access to the system, and gets thousands of privileges it doesn't need. If your PDF reader is vulnerable, it will have both access to your SSH keys and to the Internet to upload them (and if you block Internet access for a PDF reader, it still can send the data by connecting to…

The MacOS app store has some sandboxing. For example, applications installed from the store can't access any file or directory unless a user has selected it in a file dialog. (The app can hold onto a ticket for later access.) I've installed Slack from the app store for this reason.

Re: Malicious VSCode extensions with more than 45k installs

#127

Post by voynich »

skc wrote: post #107
explaininjs wrote: post #9

Article disingenuously wraps a couple extensions that seem to be “actually” malicious (secret stealing), with one that has a lot of installs and is “HN-malicious” (collects telemetry) for a striking headline. That said, malicious code in VS Code extensions is a problem. I wonder if a GPT could be helpful here. The existing internal systems for detecting malicious code seem lacking.

"HN-malicious" Hehe. We could probably come up with a dozen similar HN specific adjectives.

Lol. MS Notepad is HN-bloated.

Re: Malicious VSCode extensions with more than 45k installs

#128

Post by bdcravens »

dylan604 wrote: post #119
bdcravens wrote: post #114

2 out of the 3 examples do not have more than 45k installs. The one example that did "had a simple PII stealer code" but was actually just sending telemetry. The point of the article is probably valid, but the article itself seems to be dishonest.

Does the 45k installs mean for a specific extension or just that 45k installs in total of all extensions?

I read it as any extension with more than 45k installs.

If it's 45k total, that's a very small percentage of all installs.

Re: Malicious VSCode extensions with more than 45k installs

#129

Post by eptcyka »

TheRealDunkirk wrote: post #121
codedokode wrote: post #34

Earlier quoted context omitted.

Yes! Sadly, today nobody seem to care about the principle of least privileges. Take Linux as an example: every program you install gets full access to the system, and gets thousands of privileges it doesn't need. If your PDF reader is vulnerable, it will have both access to your SSH keys and to the Internet to upload them (and if you block Internet access for a PDF reader, it still can send the data by connecting to…

> Take Linux as an example: every program you install gets full access to the system... ... which should be locked down by group assignments and file-system permission flags. What the hell am I missing? The POSIX model has worked extraordinarily well for decades. The issue you're describing would be no different in Windows or any other operating system. If you install a malicious program, it can embed whatever protoc…

Do you execute your SSH agent as a different user/group from the one you use for your PDF reader? Does Firefox only get to read and write to ~/.config, ~/.cache and ~/Downloads?

The capabilities are there for the people who want to hot glue some elaborate contraptions together, but there is no good UX or DX for doing this in a composable manner for end user consumption.

Re: Malicious VSCode extensions with more than 45k installs

#130

Post by ianzakalwe »

Actually malicious extension only had 250 downloads, 45k installs extension was sending telemetry only. It’s a very misleading title collapsing two separate incidents into one for the sake of dramatization.

This article also highlighted that automated tools used by VS team are pretty good at catching most of similar issues.

Post reply on HN