Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

Post reply on HN
Print view View original

271–280 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#271

Post by yard2010 »

Gigachad wrote: post #138
mcoliver wrote: post #110

Vs code extensions have been terrifying for a long time. Such a wild and obvious attack vector. I'm constantly getting pop ups in vscode to install an extension because it recognizes a certain file type. It's 50-50 whether that extension is owned by a company or some random dev. Some of these have millions of installs and on first glance appear to be official company owned extensions. I'm at a point in my life where…

The problem extends far beyond VS code. All extensions and executable code has the same problem. There was a case where Disney was hacked because an employee installed a BeamNG mod that had bundled malware. A company that wants to remain secure would have to employ strict restrictions on installing software. Only installing npm packages and plugins from an internal preapproved repo for example.

The shit show that's called lastpass, which I unfortunately know, was hacked because a developer installed a bad version of Plex Media Server on his work computer.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#272

Post by no-name-here »

wyclif wrote: post #263
mcoliver wrote: post #110

Vs code extensions have been terrifying for a long time. Such a wild and obvious attack vector. I'm constantly getting pop ups in vscode to install an extension because it recognizes a certain file type. It's 50-50 whether that extension is owned by a company or some random dev. Some of these have millions of installs and on first glance appear to be official company owned extensions. I'm at a point in my life where…

I don't use VSCode, but doesn't their plugin ecosystem indicate if the plugin is MSFT-approved?

I'm guessing you're referring to the "Verified Publisher" blue checkmark next to the publisher's name and domain name, which proves the publisher owns the domain name and has 6+ months in the marketplace? https://code.visualstudio.com/docs/configure/extensions/exte...

(Separately, it doesn't help that MS doesn't allow VS Code forks to use the official marketplace, including as verified publisher doesn't seem to exist there - example: https://open-vsx.org/extension/esbenp/prettier-vscode )

(Ancillary links: https://code.visualstudio.com/docs/configure/extensions/exte... / https://marketplace.visualstudio.com/VSCode )

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#273

Post by Gigachad »

moring wrote: post #250
Gigachad wrote: post #212

Earlier quoted context omitted.

Because it's hard to create a system that is both sandboxed and powerful. You can't have an extension system that allows a plugin to run a locally installed linter or view the status of docker containers but can't execute something malicious. I do agree though that it is incredibly important to start taking sandboxing seriously. But there is a lot of difficulty and friction, and most of the users will scream and cry…

> You can't have an extension system that (...) Yes you can. Extension systems of today have multiple problems that prevent that. The basic assumption that has to go, though, is that a core application like VSCode can be written once, then be extended to infinity without the core evolving . That's an assumption you see everywhere in extension systems, and it restricts everything to "features or security, but not both…

These kinds of permissions lists have been mostly a failure in history. Users see a massive list of permissions, or permissions constantly changing between updates and just ignore them because there’s no way to reasonably audit them or take any action on them.

Securing VS code would require making malware that has access to the system impossible, not just making it add a permission to the permission list.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#274

Post by danpalmer »

wyclif wrote: post #262
danpalmer wrote: post #256

Why does a company in GitHub's place allow employees to install random VSCode extensions?! That seems grossly irresponsible.

You're assuming they allow it, but it might be against policy.

Fair point, I hadn't considered this, but wouldn't they just disallow it?

Like, I use a VSCode fork at work, but the enforced extensions store backend is based on an allowlist and extensions need reviewing to be available there.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#275

Post by gizzlon »

Interesting, this went Tanstack -> Nx Console -> GitHub

I wonder how many other secrets and tokens have been stolen, just waiting to be abused to publish a malicious version of.. something.

IMO, the problem is [1] that actually rotation all secrets just because you might have installed a compromised packe is a huuge PITA. So it's tempting to take it lightly and hope for the best. And even if you really try, it's easy to miss one.

1: in addition to "running code from whereever" with little sandboxing

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#276

Post by Gigachad »

skydhash wrote: post #261
Gigachad wrote: post #144

Earlier quoted context omitted.

Electron has nothing to do with the exploit here. A Vim plugin would have just as much ability to run malware.

No one using vim will install the kind of extensions I found on the usual VS Code setup. And most don't even autoupdates.

I’m not sure this is true. Vim needs extensions even more than VS code since many basic features like full project code search or go to definition aren’t in the base vim.

And vim has package managers that make installing and updating packages as easy as vs code.

VS Code like npm are only the targets because they are the most popular, not because they are uniquely vulnerable.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#277

Post by Balinares »

camkego wrote: post #258

The security model, or almost lack of any whatsoever in VSCode drove me to only install MSFT extensions, then use Code Server in a docker container, but I decided I didn’t like using my editor in a browser. Finally I have decided to start using Zed, which isn’t perfect on the security front, but much better IMHO. The combination of WASM extensions, and the ability to put language servers, etc, in dev-containers seems…

Wait, how do you arrive at the thought that Zed is more secure? The one time I gave it a try, it tried to silently run npm -- yes, THIS[1] npm -- in the background without telling me, and I noped the heck out. Did I miss something?

[1] https://www.reddit.com/r/programming/comments/1tapmvi/mass_n...

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#278

Post by nicce »

platevoltage wrote: post #195
miki123211 wrote: post #174

Earlier quoted context omitted.

*since coding agents caused their commit rate to increase 14x.

A problem that they contributed to.

Maybe they actually try to increase the uptime now by making Copilot plans worse.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#279

Post by giancarlostoro »

Balinares wrote: post #277
camkego wrote: post #258

The security model, or almost lack of any whatsoever in VSCode drove me to only install MSFT extensions, then use Code Server in a docker container, but I decided I didn’t like using my editor in a browser. Finally I have decided to start using Zed, which isn’t perfect on the security front, but much better IMHO. The combination of WASM extensions, and the ability to put language servers, etc, in dev-containers seems…

Wait, how do you arrive at the thought that Zed is more secure? The one time I gave it a try, it tried to silently run npm -- yes, THIS[1] npm -- in the background without telling me, and I noped the heck out. Did I miss something? [1] https://www.reddit.com/r/programming/comments/1tapmvi/mass_n...

Pretty sure any IDE worth anything that has JS support pulls NPM packages at some point to lint code, no? You're not giving me much to be outraged about without more information. Zed tries to set things up for you so you're not wasting hours trying to figure out how to set them up in a brand new editor.
Post reply on HN