Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Obsidian plugin was abused to deploy a remote access trojan

cyber.netsecops.io

Post reply on HN
Print view View original

41–50 of 241 posts

Re: Obsidian plugin was abused to deploy a remote access trojan

#41

Post by fnordlord »

Loocid wrote: post #15
kid64 wrote: post #9

Earlier quoted context omitted.

That's horse hockey. Obsidian is not a usable system without community plugins. Folks will reply "but I use it every day without plugins". That position disregards software usability as a formal discipline, along with decades of UX research and standards.

As one of those people that uses Obsidian without plugins, what plugins do you consider essential?

I rely on Advanced URI, which opens certain functionality up to external apps. I use Raycast and with Cmd+Space, it lets me open vaults or daily notes. And Obsidian_to_Anki, but that's probably just me because I have no clue how to use Anki otherwise.

Re: Obsidian plugin was abused to deploy a remote access trojan

#42

Post by troad »

Loocid wrote: post #15
kid64 wrote: post #9

Earlier quoted context omitted.

That's horse hockey. Obsidian is not a usable system without community plugins. Folks will reply "but I use it every day without plugins". That position disregards software usability as a formal discipline, along with decades of UX research and standards.

As one of those people that uses Obsidian without plugins, what plugins do you consider essential?

Me too.

All I want is a top-notch Markdown editor with a mobile app and trustworthy sync, and that's what Obsidian gives me. And if ever Obsidian goes away or is enshittified, I'll still have a perfectly good folder of Markdown documents that I can take elsewhere.

Re: Obsidian plugin was abused to deploy a remote access trojan

#43

Post by kepano »

Obsidian CEO here. There is a major update coming soon for plugin security. I think it will address many of the concerns people have raised in this thread. It's a hard problem but we are working on it.

That said, the headline is misleading. This article is about a social engineering attack that requires the user to actively reject multiple safety warnings in Obsidian. As far as I know this is a proof of concept, I haven't seen any reports of users being affected by this attack.

Re: Obsidian plugin was abused to deploy a remote access trojan

#44

Post by ibash »

kepano wrote: post #43

Obsidian CEO here. There is a major update coming soon for plugin security. I think it will address many of the concerns people have raised in this thread. It's a hard problem but we are working on it. That said, the headline is misleading. This article is about a social engineering attack that requires the user to actively reject multiple safety warnings in Obsidian. As far as I know this is a proof of concept, I ha…

lol we told you plugins were insecure years ago. I distinctly remember getting flamed in your discord because I said that they had full disk access. Too little too late.

Re: Obsidian plugin was abused to deploy a remote access trojan

#45

Post by eightys3v3n »

Ferret7446 wrote: post #40
Groxx wrote: post #8

Earlier quoted context omitted.

"Hey users: don't do insecure things. Here's a button to do cool insecure things!" is not a plugin security model.

Meanwhile that is exactly what a lot of people here want for Android with side loaded apps

I'm not sure I agree or understand where you're coming from. Side-loaded Android apps are still bound by all the same permission restrictions as any app installed by the Play Store. The only difference is Google didn't review it (for what little good that does) and that I didn't get the app from Google.

If I side-load a camera app, it still has to ask for camera privileges the same way any Play store app does.

Is there something in your message I missed about how it relates to this article or is this just being uninformed about side-loading?

Re: Obsidian plugin was abused to deploy a remote access trojan

#46

Post by gilrain »

amazingamazing wrote: post #22
kid64 wrote: post #11

This is just the first detected and reported instance, in all likelyhood such attacks have been happening for some time. When will the fanatic userbsse finally admit that using Obsidian in any enterprise setting is just plain malpractice? It takes 5 minutes in their Discord channel to see the founders are D&D nerds, not competent engineers. It was never meant for serious work.

What software do you use that would be immune to a scenario where you disable all protections to take some action?

One whose protections can’t be disabled.

Re: Obsidian plugin was abused to deploy a remote access trojan

#47

Post by sebastienbarre »

kepano wrote: post #43

Obsidian CEO here. There is a major update coming soon for plugin security. I think it will address many of the concerns people have raised in this thread. It's a hard problem but we are working on it. That said, the headline is misleading. This article is about a social engineering attack that requires the user to actively reject multiple safety warnings in Obsidian. As far as I know this is a proof of concept, I ha…

Releasing the source code to the clients would also address many of our concerns.

Re: Obsidian plugin was abused to deploy a remote access trojan

#48

Post by pdpi »

AlienRobot wrote: post #35
pdpi wrote: post #30

Earlier quoted context omitted.

Software engineers at large would benefit from playing World of Warcraft, and seeing the ongoing fight between Blizzard and add-on authors. WoW's whole UI is built in the same Lua environment as add-ons, and Blizzard has implemented some interesting restrictions (like the taint system[0]) to prevent add-ons from completely automating gameplay. 0. https://wowpedia.fandom.com/wiki/Secure_Execution_and_Tainti...

World of Warcraft is one of the most popular MMO's ever made. You simply can't expect every software that wants a plugin system to have the same security practices as the most used software in the world. In fact, there are many reasons why you might want a plugin to have full filesystem and internet access, such as batch processing or simply adding things directly from webpages. Sandboxing this will just make plugins…

> You simply can't expect every software that wants a plugin system to have the same security practices as the most used software in the world.

I'm not saying that I think they should, or that I expect them to. I'm saying that it's one particular implementation of sandboxing that has a bunch of interesting properties, and that makes it worth studying.

Re: Obsidian plugin was abused to deploy a remote access trojan

#49

Post by kepano »

sebastienbarre wrote: post #47
kepano wrote: post #43

Obsidian CEO here. There is a major update coming soon for plugin security. I think it will address many of the concerns people have raised in this thread. It's a hard problem but we are working on it. That said, the headline is misleading. This article is about a social engineering attack that requires the user to actively reject multiple safety warnings in Obsidian. As far as I know this is a proof of concept, I ha…

Releasing the source code to the clients would also address many of our concerns.

How would that make a difference for plugin security? Almost all plugins are already open source.

If you mean for the security of the app without plugins you can currently inspect the app's code in app.js and review third-party audits:

https://obsidian.md/security

Re: Obsidian plugin was abused to deploy a remote access trojan

#50

Post by amazingamazing »

gilrain wrote: post #46
amazingamazing wrote: post #22

Earlier quoted context omitted.

What software do you use that would be immune to a scenario where you disable all protections to take some action?

One whose protections can’t be disabled.

So i assume you dont use an android device, github, etc? Everything is vulnerable to social engineering.
Post reply on HN