Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious VSCode extensions with more than 45k installs

blog.checkpoint.com

Post reply on HN
Print view View original

141–150 of 191 posts

Re: Malicious VSCode extensions with more than 45k installs

#141

Post by danenania »

andrewmcwatters wrote: post #125

There's some capabilities-based security talk going on here, but the current state of the art in JavaScript makes absolutely no sense to me. It's nonsensical on its face. Right now, you grant caps through Deno to the whole executable script--so dependencies left and right that don't need caps get them. So, what's the point? It's literally worthless. It does nothing to stop capabilities abuse. The same thing could hav…

I agree, but it's not a problem unique to javascript. I'm not aware of any popular language/runtime/package manager that goes beyond what Deno can do, however insufficient that is. It's quite a hard problem.

Re: Malicious VSCode extensions with more than 45k installs

#142

Post by explaininjs »

andrewmcwatters wrote: post #125

There's some capabilities-based security talk going on here, but the current state of the art in JavaScript makes absolutely no sense to me. It's nonsensical on its face. Right now, you grant caps through Deno to the whole executable script--so dependencies left and right that don't need caps get them. So, what's the point? It's literally worthless. It does nothing to stop capabilities abuse. The same thing could hav…

The “right answer” afaik is to adopt the web permission model, which VSCode actually already supports. In addition to the Node extension host, there’s a WebWorker extension host which is much more secure (it’s the only host available on things like vscode.dev). Extensions need to opt into it unfortunately, but the code changes are not too bad in my experience.

Re: Malicious VSCode extensions with more than 45k installs

#143

Post by hombre_fatal »

andrewmcwatters wrote: post #125

There's some capabilities-based security talk going on here, but the current state of the art in JavaScript makes absolutely no sense to me. It's nonsensical on its face. Right now, you grant caps through Deno to the whole executable script--so dependencies left and right that don't need caps get them. So, what's the point? It's literally worthless. It does nothing to stop capabilities abuse. The same thing could hav…

It’s a problem with security across computing in general, not just JS. For example, what are these languages and runtimes you have in mind that solve this issue with app plugins if VS Code were using them instead?

Re: Malicious VSCode extensions with more than 45k installs

#144

Post by pfg_ »

megous wrote: post #52
codedokode wrote: post #34

Earlier quoted context omitted.

Yes! Sadly, today nobody seem to care about the principle of least privileges. Take Linux as an example: every program you install gets full access to the system, and gets thousands of privileges it doesn't need. If your PDF reader is vulnerable, it will have both access to your SSH keys and to the Internet to upload them (and if you block Internet access for a PDF reader, it still can send the data by connecting to…

> every program you install gets full access to the system It gets your user's privileges when you run it. It's up to you how you run your programs. Also there's no "default Linux configuration". There are many distributions, and they have different defaults and approaches.

my user's privileges contain my ssh keys, my passwords database, my personal files, ...

Re: Malicious VSCode extensions with more than 45k installs

#145

Post by lioeters »

skc wrote: post #107
explaininjs wrote: post #9

Article disingenuously wraps a couple extensions that seem to be “actually” malicious (secret stealing), with one that has a lot of installs and is “HN-malicious” (collects telemetry) for a striking headline. That said, malicious code in VS Code extensions is a problem. I wonder if a GPT could be helpful here. The existing internal systems for detecting malicious code seem lacking.

"HN-malicious" Hehe. We could probably come up with a dozen similar HN specific adjectives.

HN-incompatible: Any website that hijacks the scroll bar or the back button of the browser..

Re: Malicious VSCode extensions with more than 45k installs

#146

Post by pfg_ »

Gigachad wrote: post #24
fwlr wrote: post #19

Capabilities-based security prevents these supply chain attacks! (Even though in this case most of the downloads were of packages including unwanted telemetry and not something more dangerous.) “…And now if a [color theme] wants to read your data and send it to a server, it needs a filesystem capability and a network capability. It should be an obvious red flag if a [theming addon] were to ask for those dependencies.…

Yeah, android tried this initially with the permissions system. But literally every app requested every permission and it became completely useless. As a user, you have no way of meaningfully using this info.

Android used to ask for all permissions upfront, you have no choice. You want the app? Too bad, it is gets access to your contacts. Now apps have to ask when they need them and they are working on making file permissions more granular as well

Re: Malicious VSCode extensions with more than 45k installs

#147

Post by thenerdhead »

numbsafari wrote: post #124
thenerdhead wrote: post #106

Earlier quoted context omitted.

That's an opinion. Another opinion is that there is plenty of crap on every registry and some are better at surfacing and cleaning up than others. Similar to the US Navy and ships that are rust-free versus those battling rust. It doesn't affect the performance of those ships, just the perception. Left on for too long could eat away the actual integrity. Not all problems are the registry's to burden. Trust and quality…

VSCode doesn’t even provide a framework for enabling that decision making. Sure, you could forgo the use of any plugins, but so much of VScode’s functionality is derived from plugins, you’d be better off just using notepad. To be fair, vim and emacs aren’t any better. Most of our dev tools are based on plug-in models that have zero security model baked in.

> VSCode doesn’t even provide a framework for enabling that decision making.

How about notable publisher, verified publisher, # of downloads, rating, reviews, README, GitHub repository, extension icon, project details, repository maintenance, etc?

Re: Malicious VSCode extensions with more than 45k installs

#148

Post by ezfe »

bdcravens wrote: post #128
dylan604 wrote: post #119

Earlier quoted context omitted.

Does the 45k installs mean for a specific extension or just that 45k installs in total of all extensions?

I read it as any extension with more than 45k installs. If it's 45k total, that's a very small percentage of all installs.

Right, but the one with 45k installs wasn't malicious - sending os version telemetry isn't PII stealing

Re: Malicious VSCode extensions with more than 45k installs

#149

Post by sublinear »

eptcyka wrote: post #129
TheRealDunkirk wrote: post #121

Earlier quoted context omitted.

> Take Linux as an example: every program you install gets full access to the system... ... which should be locked down by group assignments and file-system permission flags. What the hell am I missing? The POSIX model has worked extraordinarily well for decades. The issue you're describing would be no different in Windows or any other operating system. If you install a malicious program, it can embed whatever protoc…

Do you execute your SSH agent as a different user/group from the one you use for your PDF reader? Does Firefox only get to read and write to ~/.config, ~/.cache and ~/Downloads? The capabilities are there for the people who want to hot glue some elaborate contraptions together, but there is no good UX or DX for doing this in a composable manner for end user consumption.

> Do you execute your SSH agent as a different user/group from the one you use for your PDF reader?

Yes, if it's executed from a script.

> Does Firefox only get to read and write to ~/.config, ~/.cache and ~/Downloads?

I hear people don't like snaps. https://snapcraft.io/docs/home-interface

Re: Malicious VSCode extensions with more than 45k installs

#150

Post by throwaway290 »

qup wrote: post #117
throwaway290 wrote: post #56

Earlier quoted context omitted.

I don't check every file but I use very sophisticated proprietary heuristics such as "intuition" and "hunch" for how far to dig. I use vim so dependencies are explicit. But when using npm packages in work I give dependencies a look before I look anywhere else. An unfamiliar dependency gets looked at. It's easier since npm web browser allows inspecting code. It's a very imperfect process.

Have you ever caught anything?

No, that would be a different story:) ended up not using dozens of plugins and libs stuff after a look at their dependencies and code though
Post reply on HN