247
Malicious VSCode extensions with millions of installs discovered
(www.bleepingcomputer.com)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 10 Jun 2024
247 points (100.0% liked)
Programming
17022 readers
184 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 1 year ago
MODERATORS
They made themselves the extensions.
If you are talking about the other reverse shell, it hit a local IP address.
True, it’s a private (not local) IP. It could easily have connected to a remote system, as their proof-of-concept did.
This code execs
cmd.exeand pipes output to and from a hardcoded IP. That’s pretty weird. What’s running on that IP? How does the extension know something is there?It looks like VS Code has no review — human or automated — or enforced entitlement system that would have stopped this or at least had someone verify it was legit.
Thing is, tons of code extensions have an RCE in one form or another, but they always hit a localhost, or configurable IP. How do there automated analysis did any difference ?
Tons of extensions summon the cmd to summon the language devtools, their automated analysis flagged tons of package and they infer millions of infeections from that.