Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

Post reply on HN
Print view View original

51–60 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#51

Post by nightpool »

cmg wrote: post #28
2OEH8eoCRo0 wrote: post #13

So which extension? Why don't they tell us?

A few days ago I saw I had an update to the Twig extension. The UI flagged it as having new executable code in the update bundle, so I didn't install the update, disabled the extension as I wasn't working on Drupal views that day, and went about my work. I didn't have time to investigate the new update's contents. When I went back to the extension page, it was taken down: https://open-vsx.org/extension/whatwedo/twig…

I'm not seeing anything on the official marketplace: https://marketplace.visualstudio.com/items?itemName=whatwedo...

I wonder if it was open-vsx specific?

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#52

Post by duped »

codedokode wrote: post #25

Note that VS Code is built on Electron and it is a pain to sandbox because Electron has (had?) SUID sandbox helper, and you cannot run SUID binaries in sandbox easily. Sandboxing on Linux is extremely difficult task.

podman seems to handle rootless namespaces just fine, minor caveat for some perf overhead but it's not the end of the world.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#53

Post by paulddraper »

tekacs wrote: post #24

Maybe I'm missing something really obvious, but... 3,800 repos? I guess I find it kind of surprising they have that many!

They have 800 engineers. So 3,800 repos is high, but not crazy.

Some of those could be forks.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#55

Post by vldszn »

friendly reminder:

- disable auto-updates for extensions in VS Code/Cursor

- use static analysis for GitHub Actions to catch security issues in pre-commit hook and on ci: https://github.com/zizmorcore/zizmor

- set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security

- for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e...

- add Socket Free Firewall when installing npm packages on CI to catch malware https://docs.socket.dev/docs/socket-firewall-free#github-act...

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#56

Post by organsnyder »

MrDarcy wrote: post #34
tekacs wrote: post #24

Maybe I'm missing something really obvious, but... 3,800 repos? I guess I find it kind of surprising they have that many!

3800 is low for an org like GitHub. Glad it’s highly likely not all their repos are compromised.

Given the attack vector, it's possible that the impacted repos were ones that see more activity.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#58

Post by philipp-gayret »

tekacs wrote: post #24

Maybe I'm missing something really obvious, but... 3,800 repos? I guess I find it kind of surprising they have that many!

I worked for a food retail store once. I remember going in the first day wondering, how hard can it really be... From the outside, it looks like they have a simple website. The website to order things on was an amalgamation of 300+ repo's. GitHub lost less in this breach. It takes a lot of effort to keep things simple as you grow.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#59

Post by applfanboysbgon »

amluto wrote: post #20
gus_ wrote: post #2

so how did they exfiltrate the information without noticing? what OS was the developer using? what security measures were they using? yesterday discussion https://news.ycombinator.com/item?id=48191680

The security measure that the developer didn't use was completely refusing to use vscode. vscode has no security model. It's not like swiss cheese where there are holes and some of the go all the way through. vscode is all hole with some cheese on the side. There is absolutely no isolation between the front-end process, the backend size (the thing that runs in the remote or the devcontainer), and any extensions or an…

Or you can just refuse to use random extensions. I built my own extensions if I needed them. You're a programmer, right? The whole point of extensibility is that you, or your company, can program what you need from your IDE, without having to make a whole IDE from scratch. I have since moved on to making my own IDE, mostly because I hate Electron and its >1gb memory footprint, but vscode served me so much better than anything else for years, without installing a single rando's extension.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#60

Post by ashishb »

tekacs wrote: post #24

Maybe I'm missing something really obvious, but... 3,800 repos? I guess I find it kind of surprising they have that many!

Uber had 8000 repos at one point with 2000 engineers - https://highscalability.com/lessons-learned-from-scaling-ube...
Post reply on HN