Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Threat actors expand abuse of Microsoft Visual Studio Code

jamf.com

Post reply on HN
Print view View original

101–110 of 306 posts

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#101

Post by pjmlp »

josephg wrote: post #56
jmyeet wrote: post #32

Maybe I'm a dinosaur in this regard but I don't like nor trust any of these desktop application that are really just Web technologies with an embedded browser eg Discord. They're resource hogs and the attack surface is huge. You're basically betting that automatic code that's run won't find a vulnerability and escape the sandbox from an entire browser. I have way more trust in Jetbrains IDEs and the JVM as a sandbox…

Yep. You’d think using web tech would make it really easy to sandbox any 3rd party JavaScript that gets run. But I suppose sandboxing is simply too inconvenient.

Because that isn't how it happens, the plugin model relies on external processes with OS IPC, most of them rely on basic process security model, and aren't even implemented in JavaScript due to performance.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#102

Post by gucci-on-fleek »

TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

I don't really like VS Code either, but I personally use it because I tend to jump between a half-dozen semi-obscure languages, and VS Code is the only [0] editor that supports all of them.

[0]: Vim and Emacs have almost as good or slightly better language support, but I prefer GUIs over TUIs.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#103

Post by scrapheap »

mmh0000 wrote: post #17
dfajgljsldkjag wrote: post #7

It is scary that a text editor can run hidden code just by opening a folder. We traded our safety for convenience and now we are paying the price. Users will always click the button to trust a file if they think it helps them work faster. We cannot blame them when the software design makes it so easy to make a mistake.

Tooooo be fair Vim had also had its share of execution vulnerabilities over the years. https://github.com/numirias/security/blob/master/doc/2019-06...

Yep, it's a shame that we keep making the same mistakes when it comes to basic security practices.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#104

Post by Dylan16807 »

perryizgr8 wrote: post #96
AmazingTurtle wrote: post #92

"Code provides features that may automatically execute files in this folder. If you don't trust the authors of these files, we recommend to continue in restricted mode as the files may be malicious." If you proceed with "Trust Project" you're at your own fault.

The "trust project" feature has been designed to be so extremely intrusive and annoying that the first thing I do is to completely disable it whenever I install VS Code on a new computer. This "solution" was just done to tick some box and put the blame on the user when a security incident happens. It's pretty similar to Windows Vista where it annoyed you with a disruptive popup so many times during the normal course…

Vista's annoyance had a purpose, to get program developers to change things to run without escalation. They didn't want you disabling UAC, and these days it breaks things to disable UAC.

By only having an upfront project-wide toggle, VS Code is much worse.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#106

Post by IshKebab »

mr_toad wrote: post #12
TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

> Im guessing the answer is probably Java is why eclipse is out of favor. Some people just want a text editor, whereas eclipse is “an IDE and Platform”.

I don't think that's really why VSCode succeeded or Eclipse failed.

Eclipse failed because it was slow and janky and had abysmal UX and it only supported Java well.

VSCode succeeded because it has a much more sane UX, it's way less janky, it's highly extensible and language neutral.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#107

Post by IshKebab »

EE84M3i wrote: post #8
dfajgljsldkjag wrote: post #7

It is scary that a text editor can run hidden code just by opening a folder. We traded our safety for convenience and now we are paying the price. Users will always click the button to trust a file if they think it helps them work faster. We cannot blame them when the software design makes it so easy to make a mistake.

Doesn't it ask you if you trust a folder when you open it?

Yeah but it's one of those useless permission requests along the lines of "Do you want this program to work or not?"

They're pawning off responsibility without giving people a real choice.

It's like the old permission dialog for Android that was pretty much "do you want to use this app?". Obviously most people just say yes.

There's a reason Google changed that.

To be fair I'm sure Microsoft would switch to a saner permission model if they could but it's kind of too late.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#108

Post by pmontra »

My first reaction has been: when we install some node modules, import them and eventually run them, we do grant local execution permissions to whatever the authors of those modules coded in their scripts, right? More or less every language already suffer from the same problem. Who vets the code inside a Ruby gem, a Python package, etc? Add your favorite language.

However I did not know about tasks.json (I don't use VSC) and when I googled it I found the example at https://code.visualstudio.com/api/extension-guides/task-prov... and that is about running rake (Ruby.) So this is a little worse than installing malicious packages: the trigger is opening a malicious repository from the editor. Is this a common practice? If it is, it means two things: 1) the developer did not take an explicit choice of installing and running code, so even the possibility of an attack is unexpected and 2) it affects users of any language, even the ones that have secured package installation or have no installation of packages from remote.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#109

Post by jhasse »

jonwinstanley wrote: post #45
TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

As I remember it, VS code was Microsoft’s response to Sublime. Sublime was exceptionally popular for web developers throughout the 2010s. Sublime was maintained by a single person as far as I know. VS code was pretty much a copy of Sublime but with a much better extensions system and relatively quickly there were some great plugins that made VS code the de-facto editor for web development.

Let's also not forget one big reason VSCode took over and Sublime lost: VSCode is gratis and (mostly) open-source, while Sublime is proprietary.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#110

Post by jhasse »

com2kid wrote: post #33
doodlesdev wrote: post #4

Earlier quoted context omitted.

> everything seems worse than eclipse I would say the answer is that's not the general perception of the software. I'm personally migrating out of VSCode, because having to use the OpenVSX registry to have open-source builds makes me mad (I've since migrated to Zed for now, since I've never adapted well to neovim nor emacs). In general, I believe most people see VSCode as "good enough". Maybe not the best text editor…

People forget that there was a period of time during which the Java runtime installer tried to install actual adware. You had to jump through hoops to deselect adware from being forced onto your machine, it was infuriating. Setting up a new machine, I could choose between Eclipse (free, took forever to open, slow, asked me a million questions before it let me start working) or Visual Studio (cost money, incredibly po…

Visual Studio is mostly written in C# btw.
Post reply on HN