235
Malicious VSCode extensions with millions of installs discovered (www.bleepingcomputer.com)
submitted 2 years ago by to c/programming@programming.dev
53 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] -3 points 2 years ago (1 child)

They made themselves the extensions.
If you are talking about the other reverse shell, it hit a local IP address.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 2 years ago (1 child)

    True, it’s a private (not local) IP. It could easily have connected to a remote system, as their proof-of-concept did.

    This code execs cmd.exe and pipes output to and from a hardcoded IP. That’s pretty weird. What’s running on that IP? How does the extension know something is there?

    It looks like VS Code has no review — human or automated — or enforced entitlement system that would have stopped this or at least had someone verify it was legit.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] -2 points 2 years ago (1 child)

    Thing is, tons of code extensions have an RCE in one form or another, but they always hit a localhost, or configurable IP. How do there automated analysis did any difference ?
    Tons of extensions summon the cmd to summon the language devtools, their automated analysis flagged tons of package and they infer millions of infeections from that.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 years ago (1 child)

    infeections

    Since I read this I can't stop picturing you as Peter Lorre lmao.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •