Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

Post reply on HN
Print view View original

131–140 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#131

Post by ajross »

pamcake wrote: post #112
notnullorvoid wrote: post #45

I really hope this pushes Microsoft to add a explicit permission system to VS Code extensions, and improve security of dev containers.

I really hope this pushes users (here: devs and maintainers) to decrease their reliance on Microsoft and especially stop outsourcing security to them. Migrate off vscode already.

> Migrate off vscode already.

It's not the IDE, though. Any extensible, customizable display editor can be coerced into behaving badly by installing external code. Even this one: https://www.gnu.org/software/emacs/emacs-paper.html

The root(-ish) cause here is the ease of publishing and installing extension code, and in particular the fact that there's no independent validation/verification step between the upstream author and armageddon. And upstream authors aren't set up with the needed precautions themselves, they're just hackers.

Basically if you phish Just One Account with write access to an extension you wan pwn everyone who's running it.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#132

Post by dotwaffle »

I'd have thought that by now, most would have been swapping to WebAssembly. It's really nicely sandboxed, you expose it to only what you want, and you can compile a lot of languages into a WASM form meaning you're not stuck with only Javascript or similar. Am I naive for thinking that?

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#133

Post by schpet »

alexfoo wrote: post #85
schpet wrote: post #79

i'd love to be able to use fine grained tokens with gh and not expose every repo and org that i am connected to on github, but you can't see the results of a github actions check that way (no 'Checks' permission available). hoping these breaches push things in the direction of access being less annoying to manage.

The problem is that the main target for these repos are the internal IaaS type repos that contain much of the juicy information. A fine grained token is likely to have read access to the IaaS repo as that is likely the very repo they are operating on when the malware compromises them. 3800 repos up for blackmail may make a good headline but it's likely that Github don't really care about 3798 of those repos being mad…

i was more thinking like, if i am working on project ABC for org XYZ it's understandable that if my dev vm gets owned that ABC is leaked. it's not that acceptable if all of org XYZ's repos that i have access to get leaked. and especially not acceptable if everything i have access to, including other orgs, and the admin ability to do destructive operations on them, gets exposed. but status quo is that that's absolutely the case, and you basically need org specific github accounts to reduce the risk of that. or use the knee-capped fine grained PATs that github offers but don't work for common things like seeing if your PR is green.

agree generally with what your getting at though: doesn't solve this problem. but even just a basic reduction in blast radius would be nice.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#135

Post by [deleted] »

ozim wrote: post #91
psadauskas wrote: post #69

If only the company behind VSCode, the company behind NPM and the company behind GitHub could get together and figure out a solution to this.

It is also company behind NuGet. Guess what they did a year ago. They removed 700 or so packages from NuGet proactively but those turned out to be false positives. It is hard to do the right things.

[deleted]

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#136

Post by sieabahlpark »

hungryhobbit wrote: post #126
pamcake wrote: post #112

Earlier quoted context omitted.

I really hope this pushes users (here: devs and maintainers) to decrease their reliance on Microsoft and especially stop outsourcing security to them. Migrate off vscode already.

I won't say "you can take my VS Code from cold dead hands" or anything, but it is a very good tool, and Microsoft hasn't yet fucked it up the way they have so many other things. I guess I'd say "you take my VS Code ... willingly ... but only after M$ fucks it up and makes me not want it anymore (like they've done to everything else they acquired)".

[dead]

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#137

Post by arandomhuman »

leni536 wrote: post #127
arandomhuman wrote: post #121

Earlier quoted context omitted.

friendly reminder: use vim :)

It honestly surprises me we don't hear news about vim/neovim plugin supply chain attacks.

probably a much smaller dependency graph (lesser usage of transitive dependencies)

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#138

Post by Gigachad »

mcoliver wrote: post #110

Vs code extensions have been terrifying for a long time. Such a wild and obvious attack vector. I'm constantly getting pop ups in vscode to install an extension because it recognizes a certain file type. It's 50-50 whether that extension is owned by a company or some random dev. Some of these have millions of installs and on first glance appear to be official company owned extensions. I'm at a point in my life where…

The problem extends far beyond VS code. All extensions and executable code has the same problem. There was a case where Disney was hacked because an employee installed a BeamNG mod that had bundled malware.

A company that wants to remain secure would have to employ strict restrictions on installing software. Only installing npm packages and plugins from an internal preapproved repo for example.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#139

Post by Gigachad »

pamcake wrote: post #112
notnullorvoid wrote: post #45

I really hope this pushes Microsoft to add a explicit permission system to VS Code extensions, and improve security of dev containers.

I really hope this pushes users (here: devs and maintainers) to decrease their reliance on Microsoft and especially stop outsourcing security to them. Migrate off vscode already.

The problem is not VS code itself. It's the fact extensions can access things outside of the editor. As far as I am aware, no editor sandboxes extensions.
Post reply on HN