Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

Post reply on HN
Print view View original

151–160 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#151

Post by ToucanLoucan »

mcoliver wrote: post #110

Vs code extensions have been terrifying for a long time. Such a wild and obvious attack vector. I'm constantly getting pop ups in vscode to install an extension because it recognizes a certain file type. It's 50-50 whether that extension is owned by a company or some random dev. Some of these have millions of installs and on first glance appear to be official company owned extensions. I'm at a point in my life where…

About the level of security in software I expect from the vendor who came up with “screenshotting your desktop every few seconds, OCRing those, and dumping the results to disk unencrypted in plain text”

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#152

Post by getpokedagain »

psadauskas wrote: post #69

If only the company behind VSCode, the company behind NPM and the company behind GitHub could get together and figure out a solution to this.

Not trolling here but these things are by design cesspools ready for compromise. Any fully open ecosystem where contributions are not strictly reviewed is open to this problem. If you don't like it, don't use editor extensions and use a well audited editor.

If you want to use extensions or node packages or pypi packages without doing a detailed review you're accumulating technical debt. You're assuming a risk in order to ship rapidly. You can either pay that down at some point under control, or bear the interest when it comes due.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#153

Post by BowBun »

lacker wrote: post #116
psadauskas wrote: post #69

If only the company behind VSCode, the company behind NPM and the company behind GitHub could get together and figure out a solution to this.

Perfectly demonstrating the truth of the "Microsoft org chart" cartoon. https://bonkersworld.net/organizational-charts

I've seen this a million times, but aren't the Amazon and Apple ones kinda the same, just differently shaped?

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#154

Post by danielheath »

BowBun wrote: post #153
lacker wrote: post #116

Earlier quoted context omitted.

Perfectly demonstrating the truth of the "Microsoft org chart" cartoon. https://bonkersworld.net/organizational-charts

I've seen this a million times, but aren't the Amazon and Apple ones kinda the same, just differently shaped?

One has 1:2 fanout, the other has 1:50 fanout.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#156

Post by CivBase »

My company has extremely strict policies about installing software. We have to call up IT any time we want an application installed. As an engineer it's very annoying to deal with, but I understand it. Problem is they have no policy about extensions and npm/pip packages. It's a time bomb waiting to go off.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#157

Post by neya »

This has significant consequences for companies hosting their private repos with GitHub. It's a huge security threat if the attacked has access to the source code. At the very least, GitHub should let people know if their repo was part of the hack or not. It's the most responsible thing to do.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#158

Post by charlieyu1 »

Gigachad wrote: post #138
mcoliver wrote: post #110

Vs code extensions have been terrifying for a long time. Such a wild and obvious attack vector. I'm constantly getting pop ups in vscode to install an extension because it recognizes a certain file type. It's 50-50 whether that extension is owned by a company or some random dev. Some of these have millions of installs and on first glance appear to be official company owned extensions. I'm at a point in my life where…

The problem extends far beyond VS code. All extensions and executable code has the same problem. There was a case where Disney was hacked because an employee installed a BeamNG mod that had bundled malware. A company that wants to remain secure would have to employ strict restrictions on installing software. Only installing npm packages and plugins from an internal preapproved repo for example.

I don’t understand why we don’t just sandbox everything. We have done it for web browsers, we can definitely do it for VSCode extensions.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#160

Post by fhn »

ozim wrote: post #94
fg137 wrote: post #44

The (lack of) security of VSCode has always been astounding. People have asked for sandboxing extensions for years [0] with little to no progress, and issues have been discussed a lot (e.g. [1][2]). I guess it hasn't been a big issue, likely because most developers are not complete idiots. But it only takes one developer and one bad extension to consequences like this. I mean, I understand that it is hard to sandbox…

Why would you sandbox extension? Just don’t install crap maybe.

thanks for the sage advice. Next time you are infected with the flu you should just don't breath maybe.
Post reply on HN