First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
1–10 of 63 posts
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#2For anyone else curious WTH “invisible code” is…
> invisible Unicode characters that make malicious code literally disappear from code editors.
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#3I call bullshit on this: "The attacker is using a public blockchain - immutable, decentralized, impossible to take down - as their C2 server."
"There's no hosting provider to contact, no registrar to pressure, no infrastructure to shut down. The Solana blockchain just... exists. "
Yes, but you still need to connect to it. Blocking access to *.solana.com is enough to stop the trojan from accessing its 2nd stage.
"Connections to Solana RPC nodes look completely normal. Security tools won't flag it. "
Then your security tools are badly configured. Lots of crypto traffic should be treated as a red flag in almost any corporate environment.
"there's literally no way to take it down"
There is, you just have to accept that Solana goes down with it. Why is A-OK in a work environment.
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#4Cool write-up. Seems pretty unintuitive to me that Unicode would allow someone to serialize normal code as invisible characters and that something like an IDE or a git diff has never been hardened against that at all.
In my mind it's one thing to let a string control whitespace a bit versus having the ability to write any string in a non-renderable format. Can anyone point me to some more information about why this capability even exists?
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#5I call bullshit on this: "The attacker is using a public blockchain - immutable, decentralized, impossible to take down - as their C2 server." "There's no hosting provider to contact, no registrar to pressure, no infrastructure to shut down. The Solana blockchain just... exists. " Yes, but you still need to connect to it. Blocking access to *.solana.com is enough to stop the trojan from accessing its 2nd stage. "Conn…
There's also the backup C2 path though, via google calendar. Wayyy less of a red flag.
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#6I call bullshit on this: "The attacker is using a public blockchain - immutable, decentralized, impossible to take down - as their C2 server." "There's no hosting provider to contact, no registrar to pressure, no infrastructure to shut down. The Solana blockchain just... exists. " Yes, but you still need to connect to it. Blocking access to *.solana.com is enough to stop the trojan from accessing its 2nd stage. "Conn…
There's also the backup C2 path though, via google calendar. Wayyy less of a red flag.
I'm surprised that Google hasn't deactivated the link in the 24+ hours since that article went online.
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#7If all you're interested in is which extensions have been infected:
Compromised OpenVSX Extensions:
codejoy.codejoy-vscode-extension@1.8.3
codejoy.codejoy-vscode-extension@1.8.4
l-igh-t.vscode-theme-seti-folder@1.2.3
kleinesfilmroellchen.serenity-dsl-syntaxhighlight@0.3.2
JScearcy.rust-doc-viewer@4.2.1
SIRILMP.dark-theme-sm@3.11.4
CodeInKlingon.git-worktree-menu@1.0.9
CodeInKlingon.git-worktree-menu@1.0.91
ginfuru.better-nunjucks@0.3.2
ellacrity.recoil@0.7.4
grrrck.positron-plus-1-e@0.0.71
jeronimoekerdt.color-picker-universal@2.8.91
srcery-colors.srcery-colors@0.3.9
sissel.shopify-liquid@4.0.1
TretinV3.forts-api-extention@0.3.1
cline-ai-main.cline-ai-agent@3.1.3Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#8And this is why you don't use VSCode.
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#9For anyone else curious WTH “invisible code” is… > invisible Unicode characters that make malicious code literally disappear from code editors.
So, they have a custom decode function that extracts info from unprinted characters which they then pass to `eval`. This article is trying to make this seem way fancier than it is. Maybe GitHub or `git diff` don't give a sense of how many bits of info are in the unicode string, but the far scarier bit of code is the `eval(atob(decodedString))` at the bottom. If your security practices don't flag that, either at code review, lint, or runtime then you're in trouble.
Not to say that you can't make innocuous looking code into a moral equivalent of eval, but giving this a fancy name like Glassworm doesn't seem warranted on that basis.
Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code
#10Earlier quoted context omitted.
There's also the backup C2 path though, via google calendar. Wayyy less of a red flag.
I'm surprised that Google hasn't deactivated the link in the 24+ hours since that article went online.
That should tell you (everyone) how much these companies actually care about our security the next time they claim to be stripping away our freedoms "for our security".