Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Obsidian plugin was abused to deploy a remote access trojan

cyber.netsecops.io

Post reply on HN
Print view View original

221–230 of 241 posts

Re: Obsidian plugin was abused to deploy a remote access trojan

#221

Post by wolvoleo »

kepano wrote: post #43

Obsidian CEO here. There is a major update coming soon for plugin security. I think it will address many of the concerns people have raised in this thread. It's a hard problem but we are working on it. That said, the headline is misleading. This article is about a social engineering attack that requires the user to actively reject multiple safety warnings in Obsidian. As far as I know this is a proof of concept, I ha…

Will that new security interfere with plugin functionality though? I can't really do without some of them, in particular selfhosted-livesync. It's not even that I don't want to pay you for hosting my notes, it's that I don't want them on somebody else's server even end to end encrypted. If I could pay and run my own official sync server I probably would.

Re: Obsidian plugin was abused to deploy a remote access trojan

#222

Post by wolvoleo »

sharps1 wrote: post #220
kepano wrote: post #190

Earlier quoted context omitted.

Obsidian is only seven people but we are working on this from all three angles: 1. Make community plugins less necessary over time as basic features become part of core 2. Improve the security of community plugins 3. Make it easy to create your own plugins that you can fully trust, e.g. with the recent release of Obsidian CLI

If you can build in one thing, I'd pick something equivalent to Omnisearch. That makes it much easier to find things. I always struggle with the default search.

True the default search is really good at not bringing up what I'm looking for. It's the #1 improvement point for me.

Re: Obsidian plugin was abused to deploy a remote access trojan

#223

Post by wolvoleo »

kevinmgranger wrote: post #157
Daedren wrote: post #93

Earlier quoted context omitted.

The pop-ups and "social engineering" in question are things that any users in HN likely already accepted, which is to enable community plugins. These community plugins are the backbone of Obsidian and where a lot of the meat is behind its fame come from. There's no protections beyond that, community plugins can do whatever they want. Thankfully, the vast majority of them are open-source.

I'm gonna push back against the "backbone of Obsidian" part. I'll argue that vanilla Obsidian is plenty powerful enough. I know many people swore / swear by the datatables plugin, but now that Bases in core, you can get pretty far without it, no?

I can't do without the livesync plugin. And also copilot (connected to a locally hosted LLM of course) and readitlater.

Re: Obsidian plugin was abused to deploy a remote access trojan

#224

Post by wolvoleo »

Loocid wrote: post #15
kid64 wrote: post #9

Earlier quoted context omitted.

That's horse hockey. Obsidian is not a usable system without community plugins. Folks will reply "but I use it every day without plugins". That position disregards software usability as a formal discipline, along with decades of UX research and standards.

As one of those people that uses Obsidian without plugins, what plugins do you consider essential?

For me these are the self hosted livesync, copilot and readitlater for better web clippings.

I really don't want my notes on other people's servers so the official sync will never be an option unless they enable that to be self hosted as an option.

Re: Obsidian plugin was abused to deploy a remote access trojan

#225

Post by system2 »

poulpy123 wrote: post #136
system2 wrote: post #90

Earlier quoted context omitted.

LMAO. That won't happen in a million years. They are bending over backwards not to give proper file access on iOS so they can sell subscriptions. Do you think they would do such a crazy thing? I bet you my life savings it won't happen.

They are being roasted in the comments because they give file access to the plugins, now they are bad because they don't give file access. There is no winning lmao

I O S.

I O S. APPLE ECOSYSTEM. MOBILE STUFF.

Re: Obsidian plugin was abused to deploy a remote access trojan

#227

Post by twentyfiveoh1 »

gejose wrote: post #167
kepano wrote: post #165

Earlier quoted context omitted.

> More batteries-included Can I ask, what basic functionality is Obsidian missing in 2026? (I work on the app)

Hey kepano, really love the work you're doing! Here are some feature I wish existed in Obsidian without any plugins: * Dataview [1] (this is now solved with Bases, so I really appreciate that) * Folder Note [2] (I, and I assume many others come from Notion, and I wish this were a thing) * Recent files [3] * A built in calendar [4] * Link embeds [5] (or something to store previews for pasted links) * Waypoint [6], or…

I had a recent files plugin but bases let me remove it.

I have a "system" base that I put on the ribbon. it defaults to "recently created", but I have a bunch of different views for hunting down anomalies too.

Re: Obsidian plugin was abused to deploy a remote access trojan

#228

Post by eviks »

pdntspa wrote: post #176
eviks wrote: post #175

Earlier quoted context omitted.

Because a box is an intuitive way to limit the blast radius of arbitrary code? But the wasn't a requirement, I'd be fine with sandbox-free secure plugin systems

There are tons and tons of successful plugin systems out there that do not have such ridiculous requirements. I have thousands of VSTs installed and have never been RAT'ed. What happened to practicing internet hygiene? At some point we need to acknowledge the problem is cultural, and address accordingly. I realize that the business objective for many is to make computing as brainless as possible but we need to be pus…

> What happened to practicing internet hygiene?

Nothing happened, it never worked, and the more people got exposed to the internet, the more obvious it was, your personal RAT history notwithstanding. Post your own hygiene list in some security-related public forum and get some comments on how easy it is to circumvent it and/or how impossible it would be to comply with

> tons of successful plugin systems

The requirement here is secure, not generically successful. Tons of bad insecure systems get popular

> problem is cultural, and address accordingly

That's exactly what all those sandbox and permissions do - address the cultural problem of the impossibility of following a set of very stringent rules without a fault at an individual level when there are more than a few individuals

Re: Obsidian plugin was abused to deploy a remote access trojan

#229

Post by eviks »

joemi wrote: post #218
eviks wrote: post #61

Earlier quoted context omitted.

To make an actual counter, you need numbers. If only a tiny niche of users use it without community plugins, then yes, it's unusable (in a practical definition of the term)

If that's so, then without numbers, it's neither usable nor unusable.

Indeed, if you don't know anything about use, you can't say much about usability.

Re: Obsidian plugin was abused to deploy a remote access trojan

#230

Post by concinds »

eneveu wrote: post #113
coldtea wrote: post #94

Earlier quoted context omitted.

Hello, 2010s called. In 2026, applications, third or even first party, don't need to have full-disk access, and are not given either. They see a jailroot environment. I give full disk access to the terminal app, and a handful of others. 90% of them, nope. At least that's the case in macOS, I'm pretty sure Windows can do that too. Linux of course has had such capability since forever, but I guess most distros you need…

Interesting. Do I get this sandboxing out of the box when I install apps with Homebrew? Or do I need to do something specific? Would love to enable this for all apps, and add exceptions for the ones that need more access. I installed Lulu and BlockBlock recently, and want to do more to harden my Mac.

That's probably all the hardening the average person needs. BlockBlock because most malware tries to get persistence. Little Snitch or LuLu for fine-grained whitelisting of network requests for any apps that have plugins (e.g. you give Documents permissions to Obsidian, plugins inherit that, but they can't exfiltrate if you only allow requests to trusted domains).
Post reply on HN