Is there any way to know if my repos were affected?
If you work for Github you are likely affected.
[deleted]
GitHub confirms breach of 3,800 repos via malicious VSCode extension
461–470 of 488 posts
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#462So presumably what this malicious extension did was steal the Github employee's tokens/cookies and then the attackers had access to the internal Github repos
Bad enough that the employee was able to install arbitrary executable code without review from anyone, but also why did they have access to 3,800 repos? Are they working on all of them right now? Are they pulling in code from all of them into their current projects?
People like to rail against traditional IT staffs and departments, especially the startup crowd that lives around here but there is a reason you put up controls and reviews and don't just let everyone have admin on their laptops (yes, I get that this wasn't necessarily abuse of admin on the employee's laptop)
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#463Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#464Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#465I really hope this pushes Microsoft to add a explicit permission system to VS Code extensions, and improve security of dev containers.
Oh, you mean like only extensions approved by MS can be published? Similarly to Google, Apple, Mozilla and others?
No I don't mean like that. Explicit permissions control what the extension can do, similar to websites needing explicit permission to access a users camera. An example is a theme extension with permission to change the theme, but having neither permission to run scripts/executables, nor dynamically access the filesystem.
There's no connection to authoritative approval, other than making ecosystems without or without that kind of strict approval safer.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#466I wonder if this was the compromised nx console extension that bit me yesterday. The timing seems identical. See https://github.com/nrwl/nx-console/security/advisories/GHSA-...
GitHub confirmed that it's indeed the nx console extension, in their blog post: https://github.blog/security/investigating-unauthorized-acce...
Nrwl are right to be sceptical about Microsoft’s published download numbers for the compromised extension. Given that my machine downloaded it a full two hours after it was supposedly unpublished.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#467Earlier quoted context omitted.
Answer: Because the "random stuff" (plugins for VS Code and other IDEs) solves real problems and nothing bad happens most of the time. Almost no manager will sign-off spending time on building stuff in-house if its available "for free". This is also in no way a new thing. How much code was written in notepad++ in the '00ies? Did anyone bother to check if the plugins did sth. malicious? We also used some weird closed-…
Can relate. A lot of the times it is the process that is slowing people down, and it is unrealistic for any corporation to do security audition for everything developers need on time, so unfortunately rules have to be bent. Some big corps resort to a different tactics: they ONLY allow in-house tools. IDEs, communication tools, everything you need on a daily basis, they make in-house tools for that. It costs a lot of…
Worse, is when the "team" doing the auditing is one guy, and that guy leaves with no replacement... and you need to explain to mgt that their new product release hasn't gone out for 3 months because you can't get the new versions of modules cleared and into the internal repo for production apps.
Actually happened at one of the largest banks in the world when I was contracting there. And that was mostly just a license/legal audit, not even a full source/security audit.
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#468Earlier quoted context omitted.
Just prevent VS Code from accessing the entire $HOME. The idea is that a well-made, modern desktop operating system would extremely limit an executable's access to user files and provide intuitive tools to allow access. Most applications shouldn't even need any access beyond their own configuration directory and maybe something like ~/Document/Source Code for source code editors and IDE. It shouldn't need to access ~…
For linux we have bubblewrap, firejail, apparmor and selinux (popular ones, there are far more). But it is often complicated and annoying to set up. Normally one would expect sw developers would write security rules for their apps but it is difficult due to amount of different sandboxing tools and various distro-specific configuration changes. It would be nice to have it sorted out somehow. Actually Snap is an intere…
Don't forget user accounts!
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#469In addition, we need a fundamental change in OS security. It's not OK that every application you run has access to all your files and unfiltered internet access by default.
I’ve been using Little Snitch on my Mac for years now because I want to be aware of (and be able to turn off) the connections programs make. Probably the weirdest one I’ve caught was a new seagate hdd that required you to run an executable file to be able to format the drive, which then tried to connect to baidu. https://fosstodon.org/@lukewrites/100907932236227641
It's so noisy though because of apps' built in update checks and other legitimate things initially, which you then grant a process exception for. Per destination allow rules would also generate a lot of popups. Then the user just grants exceptions for all traffic or suffers alert fatigue
It's useful for apps that should not have any outbound networking
But fundamentally I don't think it moves the needle that much on the bigger picture
Re: GitHub confirms breach of 3,800 repos via malicious VSCode extension
#470I've been telling less computer literate folks not to install random stuff since the nineties, and I can't understand how many devs are doing just that these days. I used to work in security auditing, and it makes me feel pretty jaded to think of the gigabytes upon gigabytes of random stuff that just gets pulled in from everywhere in IDEs, package managers, build pipelines and container images. At least back then the…
In AI era the way to install software is to pass a random script from internet to shell with sudo privileges.
Thats enough to see how much AI crowd cares about security.