Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Obsidian plugin was abused to deploy a remote access trojan

cyber.netsecops.io

Post reply on HN
Print view View original

21–30 of 241 posts

Re: Obsidian plugin was abused to deploy a remote access trojan

#21

Post by [deleted] »

kid64 wrote: post #9
pointlessone wrote: post #7

Earlier quoted context omitted.

It does give full access but Obsidian does tell you that. Community plugins are not enabled by default, you have to enable them manually. Same happens with a shared vault: once you get it you still have to manually enable plugins. So far no one managed to sneak in a plugin completely unnoticed.

That's horse hockey. Obsidian is not a usable system without community plugins. Folks will reply "but I use it every day without plugins". That position disregards software usability as a formal discipline, along with decades of UX research and standards.

[deleted]

Re: Obsidian plugin was abused to deploy a remote access trojan

#22

Post by amazingamazing »

kid64 wrote: post #11

This is just the first detected and reported instance, in all likelyhood such attacks have been happening for some time. When will the fanatic userbsse finally admit that using Obsidian in any enterprise setting is just plain malpractice? It takes 5 minutes in their Discord channel to see the founders are D&D nerds, not competent engineers. It was never meant for serious work.

What software do you use that would be immune to a scenario where you disable all protections to take some action?

Re: Obsidian plugin was abused to deploy a remote access trojan

#24

Post by guiambros »

ImPostingOnHN wrote: post #10
kid64 wrote: post #9

Earlier quoted context omitted.

That's horse hockey. Obsidian is not a usable system without community plugins. Folks will reply "but I use it every day without plugins". That position disregards software usability as a formal discipline, along with decades of UX research and standards.

The attack here requires not just enabling community plugins, but also syncing the attacker's vault to your computer, and also separately enabling the synchronization of the attacker's plugins with yours.

Yes, in this specific case.

Obsidian Plugins are still incredibly vulnerable. A compromised plugin will essentially take over your machine. There's no sandboxing of any kind. It's even more insecure than browser extensions (that could steal your auth tokens, but at least don't have unfettered access to your filesystem).

This is really unfortunate. I love Obsidian and am a paid subscriber for many years, but the community plugins needs a security overhaul asap, before someone gets hurt.

Re: Obsidian plugin was abused to deploy a remote access trojan

#25

Post by AlienRobot »

kid64 wrote: post #9
pointlessone wrote: post #7

Earlier quoted context omitted.

It does give full access but Obsidian does tell you that. Community plugins are not enabled by default, you have to enable them manually. Same happens with a shared vault: once you get it you still have to manually enable plugins. So far no one managed to sneak in a plugin completely unnoticed.

That's horse hockey. Obsidian is not a usable system without community plugins. Folks will reply "but I use it every day without plugins". That position disregards software usability as a formal discipline, along with decades of UX research and standards.

The real problem is people believing "plugins" are not full software.

If you install a dozen mini-apps from random developers you never heard about, you can't complain if one is malware.

Krita also has a plugin system based on Python. Any "plugin" has the same level of access as running a python script.

Personally I blame operating systems for not providing a way to isolate how programs interact with user files.

Re: Obsidian plugin was abused to deploy a remote access trojan

#26

Post by dspillett »

chillfox wrote: post #19
dspillett wrote: post #17

Earlier quoted context omitted.

> the founders are D&D nerds, not competent engineers The two are not mutually exclusive. What would you trust more than a nerd? A jock? A spod? An MBA? Any evidence of other examples if bad engineering you can point to, or are your thoughts on the pluggin system and throwing shade at random groups of people all you've got? [FYI: I know little of obsidian other than planning to look into it at some point as people I…

The attack relies on social engineering to get the victim to disable protections and could just as easily have happened with a plugin for any code editor. Anyway, What I like about obsidian is that it can handle a truly huge amount of notes without slowing down, and the notes are just markdown files on disk, so there's no lock in. I have used evernote, ms one note and zoho notebook before, and had issues with all of…

That isn't a response to my post, it is a bit of information already present in the thread that isn't relevant to my question followed by a positive review. This suggests that a shill brigade has been attracted to these comments. I suggest you don't do that, it isn't a good look.

Re: Obsidian plugin was abused to deploy a remote access trojan

#27

Post by Groxx »

Paul-E wrote: post #18
Groxx wrote: post #4

Earlier quoted context omitted.

Ehm. No? https://obsidian.md/help/plugin-security#Plugin+capabilities > Due to technical limitations, Obsidian cannot reliably restrict plugins to specific permissions or access levels. This means that plugins will inherit Obsidian's access levels. As a result, consider the following examples of what community plugins can do: Community plugins can access files on your computer. Community plugins can connect to intern…

Obsidian seems like a perfect candidate for a WASM/WASI based plugin system that would properly sandbox plugin code.

For at least the vast majority, yes definitely. I'm fine with full bypasses existing (say a webgl thing, or web previews, custom VCS integration, there are tons of legitimate reasons to escape a sandbox), but they should be an abnormality with heavy warnings and proportionate community attention to watch for issues, not the only option.

I don't think they meant it this way, but I honestly consider unsafe official plugin systems to be negligent to the point of being actively malicious. By releasing one, if you ever become successful you have explicitly chosen to screw over an unknown number of your users to save yourself a relatively small amount of work in the short term. It might be single digit users, or it might be septuple digit users - is it really worth it?

(Unsafe unofficial plugins, like most games? Mildly unfortunate but I think that's fine. Though a healthy modding community around your stuff should be a VERY STRONG sign that you should introduce a safe version to protect your users, if it won't cause you to implode (it definitely can)).

Re: Obsidian plugin was abused to deploy a remote access trojan

#28

Post by CGamesPlay »

hresvelgr wrote: post #23

Am I the only one who thinks Obsidian is perfect without plugins? Half the reason I switched to it from Anytype was that it was rather spartan in its offerings. If they announced tomorrow they would ban plugins, I would not care.

I'm also switching back to Obsidian after a few-year stint on Anytype, and the Notebook Navigator plugin is the only one I have installed. This is (I assume) a UI-only plugin, which shouldn't need access to external network or processes, so a quite good candidate for sandboxed plugins.

Re: Obsidian plugin was abused to deploy a remote access trojan

#29

Post by cpach »

Loocid wrote: post #15
kid64 wrote: post #9

Earlier quoted context omitted.

That's horse hockey. Obsidian is not a usable system without community plugins. Folks will reply "but I use it every day without plugins". That position disregards software usability as a formal discipline, along with decades of UX research and standards.

As one of those people that uses Obsidian without plugins, what plugins do you consider essential?

Same here, zero plugins for me.

Re: Obsidian plugin was abused to deploy a remote access trojan

#30

Post by pdpi »

AlienRobot wrote: post #25
kid64 wrote: post #9

Earlier quoted context omitted.

That's horse hockey. Obsidian is not a usable system without community plugins. Folks will reply "but I use it every day without plugins". That position disregards software usability as a formal discipline, along with decades of UX research and standards.

The real problem is people believing "plugins" are not full software. If you install a dozen mini-apps from random developers you never heard about, you can't complain if one is malware. Krita also has a plugin system based on Python. Any "plugin" has the same level of access as running a python script. Personally I blame operating systems for not providing a way to isolate how programs interact with user files.

Software engineers at large would benefit from playing World of Warcraft, and seeing the ongoing fight between Blizzard and add-on authors.

WoW's whole UI is built in the same Lua environment as add-ons, and Blizzard has implemented some interesting restrictions (like the taint system[0]) to prevent add-ons from completely automating gameplay.

0. https://wowpedia.fandom.com/wiki/Secure_Execution_and_Tainti...

Post reply on HN