Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

Post reply on HN
Print view View original

231–240 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#231

Post by cloudbonsai »

gus_ wrote: post #5
alexfoo wrote: post #3

Earlier quoted context omitted.

The 3800 repos weren't exfiltrated from the compromised machine. The malware (be it a VSCode plugin, an npm package, or whatever is next) simply slurps up all of the users private keys/tokens/env-vars it can find and sends this off somewhere covertly. It's trivial to do this in a way to avoid detection. The small payload can be encrypted (so it can't be pattern matched) and then the destination can be one of millions…

> It's trivial to do this in a way to avoid detection I'd love to see a real example/PoC. Anyway, we discussed this issue in the other thread. For me, unrestricted outbound requests to any url, whether it's well known domains like api.github.com or any other domain, are a red flag. Why does VS need to establish outbound requests to any domain, without authorization? There's no magic solution, and these attacks will e…

I found more details on how this particular attack worked:

https://github.com/nrwl/nx-console/security/advisories/GHSA-...

https://github.com/nrwl/nx-console/issues/3148

So the extension basically rewrites files in `.github/workflows` and pushes them to GitHub, which then sends all the sensitive information to the attacker. It also attempts to plant a malware on the local machine, too.

My impression is that it would be hard for an OS-level sandbox to completely stop this attack. The sandbox needs to determine whether if a git push originating from an IDE is malicious.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#232

Post by no-name-here »

zx8080 wrote: post #203

> "Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately," So great that they removed the extension! Do they do it only after their own employee was infected? And why "unnamed" extension?

1. Microsoft did link the extension in their official post. Under hacker news guidance, I think that original source link should been posted instead of bleeping computer. https://github.blog/security/investigating-unauthorized-acce...

> “unnamed”

Why is “unnamed” in quotation marks?

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#233

Post by ViAchKoN »

prodigycorp wrote: post #227

Someone scold me if I'm wrong but this is really worrying. Threat actors with Github's internal code means a huge acceleration in vulnerability discovery for the one platform where everybody warehouses their code. How is this not really, really bad?

It is really bad. But I think other Git providers also have weaknesses. Maybe it is just not a public knowledge or exploited.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#234

Post by Pxtl »

Microsoft: "you shouldn't run untrusted code, here's a mess of ugly dialogs for people to click through if they try."

Me: "Okay, I'd like to make signed trusted code, how do I do that?"

Microsoft: "don't worry, we have the most expensive and tedious signing process in the industry."

Me: "okay, will users be properly protected from malicious code then?"

Microsoft: "Nope!"

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#235

Post by GCUMstlyHarmls »

miki123211 wrote: post #176
unethical_ban wrote: post #114

Earlier quoted context omitted.

What's the difference between Podman and docker for volumes? Other than needing to add Z to get volumes to mount with SELinux

If you're root on a system and use Docker volumes, you can always `sudo ls` and access those volumes outside of the container. If you're just a user running containers under Podman, it's more tricky.

`podman unshare && podman mount`

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#236

Post by bgro »

stingraycharles wrote: post #202
dlcarrier wrote: post #177

Earlier quoted context omitted.

At first I though the Apple one had a half-dozen departments actually coordinating on something, but then I took a closer look and realized it's just more micromanagement.

I think the chart is still from the Steve Jobs era, who definitely was known to be a micromanager.

There’s an interview with someone talking about Steve having an extreme melt down rage about the header not being technically centered in one spot on the Apple page.

I want to see his reaction trying to type a message on the iPhone keyboard from anytime in the past 7 years.

Or navigate the random nonsensical grouping of stuff in settings that got so out of control they added a search bar or watch a pip video or really use anything. Every feature has some sloppy problem.

It used to be excusable as nobody else was trying and they’d be working to fix it. Now they just add a feature that’s sub par to things already out there, no innovation, and then it feels sloppy. Most things just don’t feel good to use down to the size and weight of phones now. Rather than fix the problem Apple just keeps copying the homework and claiming they can’t fix perfect.

Steve would be punching holes in the wall. Probably would stomp a hole through the floor to strangle the keyboard team

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#238

Post by cm11 »

stingraycharles wrote: post #202
dlcarrier wrote: post #177

Earlier quoted context omitted.

At first I though the Apple one had a half-dozen departments actually coordinating on something, but then I took a closer look and realized it's just more micromanagement.

I think the chart is still from the Steve Jobs era, who definitely was known to be a micromanager.

My thought on this was always that micromanaging in this structure is rational and maybe even the best. It's not really a Jobs thing—though he's (right or wrong) probably the picture most people have in their head when they think of visionary CEO—it's just that if the leader has a vision then it is great if they're capable of having everything run through them. It's when there's no vision at the top and no leaders sitting across the silos pulling things together that it helps the company to have people below with increasing autonomy. Whether the autonomous people should be higher or lower depends on which other org structure you've chosen. Silos are fine when leaders have a vision. That said, I haven't seen many groups that placed power in the place where their chosen org structure is meant to place power.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#239

Post by no-name-here »

mikeweiss wrote: post #226
vldszn wrote: post #55

friendly reminder: - disable auto-updates for extensions in VS Code/Cursor - use static analysis for GitHub Actions to catch security issues in pre-commit hook and on ci: https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security - for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e..…

Or how about just don't allow your VS extensions outbound Internet access ...

How? I haven’t found a way to do that on windows, as even with third-party monitoring firewalls, extension's network access is indistinguishable from the rest of VS code, so you’d either have to disallow network access from both VS code and all of its extensions combined, or none of them?

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#240

Post by -iad »

notnullorvoid wrote: post #120
pamcake wrote: post #112

Earlier quoted context omitted.

I really hope this pushes users (here: devs and maintainers) to decrease their reliance on Microsoft and especially stop outsourcing security to them. Migrate off vscode already.

> Migrate off vscode already. Zed is the closest thing I've found to meet my needs, and I do plan to try it. However it's dev container support looks to be lacking in some important ways so we'll see.

Let me save you some hassle. I test drove Zed for a week after the v1.0 release. My projects deal exclusively in dev containers. I spent more time troubleshooting issues than actually working. Things which VS Code handles transparently, like installing the support libraries to run a chrome debug session, say. Your local SSH agent isn’t forwarded into the container, so git push doesn’t work natively. That’s after you’ve had to add your project as a safe directory in your container’s git config, because it isn’t mapped to your local git config. Things which I was disappointed and surprised were not addressed prior to v1.
Post reply on HN