Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

Post reply on HN
Print view View original

101–110 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#101

Post by amluto »

applfanboysbgon wrote: post #59
amluto wrote: post #20

Earlier quoted context omitted.

The security measure that the developer didn't use was completely refusing to use vscode. vscode has no security model. It's not like swiss cheese where there are holes and some of the go all the way through. vscode is all hole with some cheese on the side. There is absolutely no isolation between the front-end process, the backend size (the thing that runs in the remote or the devcontainer), and any extensions or an…

Or you can just refuse to use random extensions. I built my own extensions if I needed them. You're a programmer, right? The whole point of extensibility is that you, or your company, can program what you need from your IDE, without having to make a whole IDE from scratch. I have since moved on to making my own IDE, mostly because I hate Electron and its >1gb memory footprint, but vscode served me so much better than…

Kind of.

A vscode workspace can trivially execute code on the machine that runs the server end of vscode. (This is how building works -- there is no sandbox unless the workspace config explicitly uses some kind of sandbox.) So the workspace can usually trivially elevate permissions to take over the vscode server, including installing extensions on it without asking you.

In principle, there is a teeny tiny bit of isolation between the local and remote sides, so the remote side cannot trivially execute code on the local machine. But I recommend reading this rather long-standing ticket:

https://github.com/microsoft/vscode-remote-release/issues/66...

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#102

Post by cmg »

nightpool wrote: post #51
cmg wrote: post #28

Earlier quoted context omitted.

A few days ago I saw I had an update to the Twig extension. The UI flagged it as having new executable code in the update bundle, so I didn't install the update, disabled the extension as I wasn't working on Drupal views that day, and went about my work. I didn't have time to investigate the new update's contents. When I went back to the extension page, it was taken down: https://open-vsx.org/extension/whatwedo/twig…

I'm not seeing anything on the official marketplace: https://marketplace.visualstudio.com/items?itemName=whatwedo... I wonder if it was open-vsx specific?

That’s very possible. I switch between Cursor and VS Code, don’t remember which it was that day.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#103

Post by robotnikman »

philipp-gayret wrote: post #58
tekacs wrote: post #24

Maybe I'm missing something really obvious, but... 3,800 repos? I guess I find it kind of surprising they have that many!

I worked for a food retail store once. I remember going in the first day wondering, how hard can it really be... From the outside, it looks like they have a simple website. The website to order things on was an amalgamation of 300+ repo's. GitHub lost less in this breach. It takes a lot of effort to keep things simple as you grow.

Can confirm as someone working in the same field, we have a ton of repos

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#105

Post by K3UL »

urbandw311er wrote: post #93

I wonder if this was the compromised nx console extension that bit me yesterday. The timing seems identical. See https://github.com/nrwl/nx-console/security/advisories/GHSA-...

GitHub confirmed that it's indeed the nx console extension, in their blog post: https://github.blog/security/investigating-unauthorized-acce...

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#106

Post by lovich »

dylan604 wrote: post #68
applfanboysbgon wrote: post #59

Earlier quoted context omitted.

Or you can just refuse to use random extensions. I built my own extensions if I needed them. You're a programmer, right? The whole point of extensibility is that you, or your company, can program what you need from your IDE, without having to make a whole IDE from scratch. I have since moved on to making my own IDE, mostly because I hate Electron and its >1gb memory footprint, but vscode served me so much better than…

> You're a programmer, right? This is my position as well, but it's rarely received well. Usually, a response like "why would I rewrite something that's already been written and available?" By writing the code, I know how it works. I know it is not infected with crap. I know it will not in the future be infected with crap from a down stream dependency. It seems to me this really took off with node to the point that i…

Most bosses look poorly upon spending their budget on rewriting software that already exists and simultaneously most bosses(although not the exact same set) don’t care about security until a disaster has already occurred.

And it’s also not like you’re going to literally write every piece of software you use, unless you’ve started all the way down at machine code you’re drawing the line somewhere on using code written by other people.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#107

Post by pixl97 »

midtake wrote: post #87
notnmeyer wrote: post #81

Earlier quoted context omitted.

i mean, then you say it like that…

Microsoft is the inverse hand of Midas, turns everything into shit.

With $101 billion in profit last year I wish I could turn things into $hit as well as they do.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#108

Post by pixl97 »

ozim wrote: post #94
fg137 wrote: post #44

The (lack of) security of VSCode has always been astounding. People have asked for sandboxing extensions for years [0] with little to no progress, and issues have been discussed a lot (e.g. [1][2]). I guess it hasn't been a big issue, likely because most developers are not complete idiots. But it only takes one developer and one bad extension to consequences like this. I mean, I understand that it is hard to sandbox…

Why would you sandbox extension? Just don’t install crap maybe.

This mans security onion has one layer.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#109

Post by fn-mote »

htrp wrote: post #77
PAndreew wrote: post #48

Earlier quoted context omitted.

As others have said it's just a fraction. I'm in a medium size tech-related company and we have 7500+ in one Github org. We have two orgs, so altogether easily 10K+. Of course most of it is stale, obsolete, sandbox, personal tools, etc. I wouldn't be surprised if Github would have 100K+ internal repos or even more.

no pruning of repos?

Breaks old stuff

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#110

Post by mcoliver »

Vs code extensions have been terrifying for a long time. Such a wild and obvious attack vector. I'm constantly getting pop ups in vscode to install an extension because it recognizes a certain file type. It's 50-50 whether that extension is owned by a company or some random dev. Some of these have millions of installs and on first glance appear to be official company owned extensions. I'm at a point in my life where I only installed official company owned extensions and even that is hard to be sure I'm not getting suckered. Sad state.
Post reply on HN