Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code

koi.ai

Post reply on HN
Print view View original

51–60 of 63 posts

Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code

#51

Post by adamhartenz »

ForOldHack wrote: post #50
dingnuts wrote: post #20

Earlier quoted context omitted.

it sure is and it's complete bullshit too! that screenshot looks suspicious as hell, and my editor (Emacs) has a whitespace mode that shows unprintable characters sooooo if GitHub's diff view displays unprintable characters like this that seems like a problem with GitHub lol "it isn't just X it's Y" fuck me, man. get this slop off the front page. if there's something useful in it, someone can write a blog post about…

My Editor VSCode has the Hex editor installed, always... invisible unicode? Not to Hex. What? are you doing without Hex mode? What?

Does your Hex editor extension get automatically updated?

Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code

#52

Post by AnimalMuppet »

OptionOfT wrote: post #42
AnimalMuppet wrote: post #41

Earlier quoted context omitted.

I mean, someone could still run a string of printable characters into "decode" and then "eval"...

At least that is visible in a PR.

The decode and eval calls are always visible.

Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code

#53

Post by h4ck_th3_pl4n3t »

amingilani wrote: post #40
h4ck_th3_pl4n3t wrote: post #31

Earlier quoted context omitted.

It's not the compiler. It's JavaScript and its fucked up UTF-16 strings. UTF-16 should have been UTF-8 for a variety of reasons, and I thought we have learned from the Effective power لُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ 冗 incident.

The what incident? Can you elaborate? Edit: Here’s the incident- https://www.theregister.com/2015/05/27/text_message_unicode_...

Not only iOS was affected. MacOS, too. Firefox, too. Chromium, too.

Essentially everything that used libicu as a unicode parser.

Was quite fun posting this in IRC and other chats and seeing clients go offline at the time :)

Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code

#55

Post by nawgz »

dragonwriter wrote: post #28
nawgz wrote: post #4

Cool write-up. Seems pretty unintuitive to me that Unicode would allow someone to serialize normal code as invisible characters and that something like an IDE or a git diff has never been hardened against that at all. In my mind it's one thing to let a string control whitespace a bit versus having the ability to write any string in a non-renderable format. Can anyone point me to some more information about why this c…

> Seems pretty unintuitive to me that Unicode would allow someone to serialize normal code as invisible characters If you have a text encoding with two invisible characters, you can trivially encode anything that you could represent in a digital computer in it, in binary, by treating one as a zero and the other as a one. More invisible characters and some opinionated assumptions about what you are allows denser repre…

I see now, those “decode” and “eval” are huge red flags that are downplayed heavily by the author. Cheers for the response

Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code

#56

Post by ShowalkKama »

blauditore wrote: post #27

Why not just indicate non-printable characters in code review tools? I've always wondered that, regardless of security implications. They are super rare in real code (except line breaks and tabs maybe), so no disruption in most cases. Also, as notes in other comments, you can't do shady stuff purely with invisible code. The article seems bit sensationalist to me.

Because spaces, tabs, CR and LF are invisible too yet perfectly normal to find within code. You could very easily implement a decode() function that uses only those characters.

Re: First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code

#60

Post by DiabloD3 »

h4ck_th3_pl4n3t wrote: post #32
DiabloD3 wrote: post #8

And this is why you don't use VSCode.

Imagine a worm written in VimL or emacs lisp. Haha, that would be kinda fun as an experiment :D

I'd love to see someone do it, even as a proof of concept.
Post reply on HN