Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1-Click GitHub Token Stealing via a VSCode Bug

blog.ammaraskar.com

Post reply on HN
Print view View original

101–110 of 116 posts

Re: 1-Click GitHub Token Stealing via a VSCode Bug

#101

Post by ammar2 »

EMM_386 wrote: post #86

This is an excellent and very interesting write-up. It's so refreshing to read technical articles that are clearly written by a knowledgeable human and explained perfectly like this. By walking the reader through this with the example screenshots it unfolds and gets more interesting as you continue reading. It's also strange to realize that these days, most articles are not like this.

heh, a friend actually pointed out a typo on a first draft and said "maybe you shouldn't fix it to show it's not LLM written".

Re: 1-Click GitHub Token Stealing via a VSCode Bug

#102

Post by worldsavior »

zuzululu wrote: post #99
worldsavior wrote: post #50

Earlier quoted context omitted.

Secret ad to orbstack.

first time I mentioned it on here and no it won't be enough but better than running npms from wild naked just pointing out what I use currently if you know something better/competitor please feel free to advertise them

Maybe...Docker? Orbstack is basically a wrapper over docker, and he advertises the program as something uniquely fast, which is just a docker behind the scens.

Re: 1-Click GitHub Token Stealing via a VSCode Bug

#103

Post by zuzululu »

worldsavior wrote: post #102
zuzululu wrote: post #99

Earlier quoted context omitted.

first time I mentioned it on here and no it won't be enough but better than running npms from wild naked just pointing out what I use currently if you know something better/competitor please feel free to advertise them

Maybe...Docker? Orbstack is basically a wrapper over docker, and he advertises the program as something uniquely fast, which is just a docker behind the scens.

This is getting weird

Re: 1-Click GitHub Token Stealing via a VSCode Bug

#104

Post by st3fan »

itopaloglu83 wrote: post #62
ammar2 wrote: post #10

Earlier quoted context omitted.

> it'd be awesome if the in-browser IDE launched with a temporary per-repo permission scope That's actually exactly what they do for codespaces. The token only has read/write on the repo you activated for the codespace [1]. They should definitely consider doing that for github.dev as well. [1] https://orca.security/resources/blog/hacking-github-codespac...

Or they could’ve kept their bounty program running smoothly. But instead they pissed off another security researcher and received a zero days heads-up before public disclosure.

There is no excuse. GitHub runs a great program on HackerOne and it should just have been submitted there.

Also note that the person who found this was pissed because they had a difficult experience with submitting a bug for VSCode THREE YEARS AGO through MSRC which is _completely different_ than the GitHub H1 program and no doubt much more challenging with a different experience.

There is really no excuse for this irresponsible disclosure. They could have at least tried instead of holding a grudge for three years.

Re: 1-Click GitHub Token Stealing via a VSCode Bug

#105

Post by DANmode »

ammar2 wrote: post #12
natpalmer1776 wrote: post #11

Earlier quoted context omitted.

It was the status quo for a long time, then the pesky security researchers started asking for compensation instead of clout.

> instead of clout I'm catching up on the infosec twitter side but it seems like it was even worse. A lot of people have the same story as me in 2023 of "they silently patch the bug and don't even credit you" which really stinks.

That’s most of the why it’s tough to be upset when people just release 0-days on Twitter - especially for big firms.

Re: 1-Click GitHub Token Stealing via a VSCode Bug

#106

Post by paulddraper »

zbentley wrote: post #3

This is a very good writeup. Zooming way out (perhaps to the point of useless observation), it's a pity that the web embedded VSCode editor is signed into GitHub at all . Defense-in-depth or not, a huge vulnerability surface arises from that original sin. It'd be like if you had a god-permissioned GitHub API token stored in world-readable plaintext on your workstation for the malicious-NPM-package-of-the-week to find…

> It'd be like if you had a god-permissioned GitHub API token stored in world-readable plaintext on your workstation for the malicious-NPM-package-of-the-week to find.

That's...exactly what the AWS CLI does.

Re: 1-Click GitHub Token Stealing via a VSCode Bug

#107

Post by ammar2 »

st3fan wrote: post #104
itopaloglu83 wrote: post #62

Earlier quoted context omitted.

Or they could’ve kept their bounty program running smoothly. But instead they pissed off another security researcher and received a zero days heads-up before public disclosure.

There is no excuse. GitHub runs a great program on HackerOne and it should just have been submitted there. Also note that the person who found this was pissed because they had a difficult experience with submitting a bug for VSCode THREE YEARS AGO through MSRC which is _completely different_ than the GitHub H1 program and no doubt much more challenging with a different experience. There is really no excuse for this i…

> GitHub runs a great program on HackerOne

I agree, for the record here's my HackerOne profile https://hackerone.com/ammar2/hacktivity?type=user

Just for context, that 2023 bug was initially reported to GitHub's HackerOne program and they explicitly told me it was out of scope for them and to take it to MSRC:

> We have reviewed the report and determined that the vulnerabilities is in VS code and the fix will be implemented by Microsoft. As a result, it is not eligible for reward under the Bug Bounty program. Please follow-up with Microsoft via the report you submitted.

There was also an additional bug that allowed an attacker to exfiltrate private repo contents with a github.dev link that MSRC also marked as not having security impact.

I absolutely loved working with GitHub folks on the GitHub bug bounty program, they're responsive, go into technical details with you and are awesome to deal with. MSRC is like the polar opposite of that.

Re: 1-Click GitHub Token Stealing via a VSCode Bug

#108

Post by troybetz »

zuzululu wrote: post #99
worldsavior wrote: post #50

Earlier quoted context omitted.

Secret ad to orbstack.

first time I mentioned it on here and no it won't be enough but better than running npms from wild naked just pointing out what I use currently if you know something better/competitor please feel free to advertise them

[dead]

Re: 1-Click GitHub Token Stealing via a VSCode Bug

#110

Post by ethanhq »

owl57 wrote: post #7
zbentley wrote: post #3

This is a very good writeup. Zooming way out (perhaps to the point of useless observation), it's a pity that the web embedded VSCode editor is signed into GitHub at all . Defense-in-depth or not, a huge vulnerability surface arises from that original sin. It'd be like if you had a god-permissioned GitHub API token stored in world-readable plaintext on your workstation for the malicious-NPM-package-of-the-week to find…

If the malicious-npm-package-of-the-week is reading arbitrary files on your workstation, isn't it usually able to run git clone/push/whatever with your current credentials anyway?

[flagged]
Post reply on HN