Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Obsidian plugin was abused to deploy a remote access trojan

cyber.netsecops.io

Post reply on HN
Print view View original

131–140 of 241 posts

Re: Obsidian plugin was abused to deploy a remote access trojan

#131

Post by lossyalgo »

kepano wrote: post #43

Obsidian CEO here. There is a major update coming soon for plugin security. I think it will address many of the concerns people have raised in this thread. It's a hard problem but we are working on it. That said, the headline is misleading. This article is about a social engineering attack that requires the user to actively reject multiple safety warnings in Obsidian. As far as I know this is a proof of concept, I ha…

I don't know how hard it would be but IMHO adding some kind of permissions dialog(?) akin to Android would go a long way. 99% of Obsidian plugins don't need full disk access, or internet access for that matter.

Re: Obsidian plugin was abused to deploy a remote access trojan

#132

Post by poulpy123 »

Groxx wrote: post #51
Ferret7446 wrote: post #37

Earlier quoted context omitted.

The same is true for all software on your machine.

Not even slightly. Browser extensions are a trivial counter-example, as are all flatpacks, and anything restricted by user/group. That covers probably literally a majority of all software on your computer, because people have been voluntarily restricting their software to protect you from their potential accidents for decades.

> flatpacks

flatpacks have access to all my files, they would be useless without. And they are the only sensitive files in my computers

Re: Obsidian plugin was abused to deploy a remote access trojan

#133

Post by lossyalgo »

BrissyCoder wrote: post #103
jjice wrote: post #33

I really like Obsidian. I use it every day and I don't use any community plugins because the permissions aren't up to snuff. I hope for a day where a plugin defines what it will need and that gets presented to me as a user. I have to imagine the Obsidian team is going to respond seriously to this and I look forward to seeing what they do. They have my full confidence. I'm surprised the system was initially designed a…

I started using it too when I got sick of using VS Code to look at md. Glad I never had the need to install any plug-ins! Very poor form on their part from what I can tell.

Just wait until you want to create a simple table with ADD/SUM.

Re: Obsidian plugin was abused to deploy a remote access trojan

#134

Post by lossyalgo »

Loocid wrote: post #15
kid64 wrote: post #9

Earlier quoted context omitted.

That's horse hockey. Obsidian is not a usable system without community plugins. Folks will reply "but I use it every day without plugins". That position disregards software usability as a formal discipline, along with decades of UX research and standards.

As one of those people that uses Obsidian without plugins, what plugins do you consider essential?

An ADD/SUM feature on tables was the first plugin I installed. It could be argued this should be part of the TABLE but I guess the dev team has a lot on their plate not to mention I'm not even sure if there's a feature request for this ability.

Re: Obsidian plugin was abused to deploy a remote access trojan

#135

Post by lossyalgo »

deafpolygon wrote: post #119
amipwndidunno wrote: post #110

Why the hell doesn't the article say WHICH plugins were affected so users can know if they were likely affected?

It does. > It enables malicious versions of legitimate Obsidian plugins ('Shell Commands' and 'Hider') that are present in the shared vault.

Thanks! I also scanned the detailed article looking for which plugins were affected and wasn't able to find it. Came to the comments looking for a quicker answer.

Re: Obsidian plugin was abused to deploy a remote access trojan

#136

Post by poulpy123 »

system2 wrote: post #90
sebastienbarre wrote: post #47

Earlier quoted context omitted.

Releasing the source code to the clients would also address many of our concerns.

LMAO. That won't happen in a million years. They are bending over backwards not to give proper file access on iOS so they can sell subscriptions. Do you think they would do such a crazy thing? I bet you my life savings it won't happen.

They are being roasted in the comments because they give file access to the plugins, now they are bad because they don't give file access. There is no winning lmao

Re: Obsidian plugin was abused to deploy a remote access trojan

#137

Post by TiredOfLife »

andersa wrote: post #121
coldtea wrote: post #94

Earlier quoted context omitted.

Hello, 2010s called. In 2026, applications, third or even first party, don't need to have full-disk access, and are not given either. They see a jailroot environment. I give full disk access to the terminal app, and a handful of others. 90% of them, nope. At least that's the case in macOS, I'm pretty sure Windows can do that too. Linux of course has had such capability since forever, but I guess most distros you need…

Sadly, Windows cannot do that. Every installed program has full disk access by default. It's very, very difficult to make it not so.

Windows has had that feature for 9 years. https://learn.microsoft.com/en-us/defender-endpoint/controll...

Re: Obsidian plugin was abused to deploy a remote access trojan

#139

Post by criddell »

gejose wrote: post #129

Love Obsidian but I've previously commented about the security model for plugins here: https://news.ycombinator.com/item?id=45308131 . TLDR: your entire vault (and possibly filesystem) is exposed to every single plugin you install. I really do think Obsidian needs 2 things to have any reasonable security: 1. It needs to be a lot more batteries-included. A user shouldn't need a plugin for basic functionality. 2. It ne…

> A user shouldn't need a plugin for basic functionality.

What functionality are you thinking of? I just looked and I've never enabled community plugins.

My Obsidian complaint is the opposite. I think its bloated well beyond the initial premise of a markdown editor over a directory of files. I think it was just about perfect right before the introduction of the Canvas feature.

Re: Obsidian plugin was abused to deploy a remote access trojan

#140

Post by embedding-shape »

lossyalgo wrote: post #131
kepano wrote: post #43

Obsidian CEO here. There is a major update coming soon for plugin security. I think it will address many of the concerns people have raised in this thread. It's a hard problem but we are working on it. That said, the headline is misleading. This article is about a social engineering attack that requires the user to actively reject multiple safety warnings in Obsidian. As far as I know this is a proof of concept, I ha…

I don't know how hard it would be but IMHO adding some kind of permissions dialog(?) akin to Android would go a long way. 99% of Obsidian plugins don't need full disk access, or internet access for that matter.

That'd require some sort of sandbox, which they already seem to not want to have, for whatever reason. If you don't want that, and you want to use JS, building any sort of permission system on top of that that you cannot easily work around, gets really tricky if not impossible.
Post reply on HN