A group of Israeli researchers explored the security of the Visual Studio Code marketplace and managed to "infect" over 100 organizations by trojanizing a copy of the popular 'Dracula Official theme to include risky code. Further research into the VSCode Marketplace found thousands of extensions with millions of installs.
  • towerful@programming.dev
    71·
    2 years ago

    What makes this even more sneaky is that JetBrains has a theme called “Darcula”.

    So, with a wider generic theme called Dracula and themes that duplicate JetBrains Darcula theme, it is no surprise that “Darcula Official” is being installed.
    It’s more than just a typosquat

    Edit:
    But why can a theme make web requests?!

      • towerful@programming.dev
        11·
        2 years ago

        I think that’s how themes are distributed for VSCode, right?
        With VSCode, everything is an extension.
        But the vscode marketplace seems to have filters for themes, so there must be some way to differentiate them.

        I think extensions need a permissions system

        • Tekhne@sh.itjust.works
          14·
          2 years ago

          You declare it in the package.json as a category when publishing. It’s completely self-selected with no oversight, review, or enforced permissions.

  • floofloof@lemmy.caOPEnglish
    44·
    2 years ago

    All malicious extensions detected by the researchers were responsibly reported to Microsoft for removal. However, as of writing this, the vast majority remains available for download via the VSCode Marketplace.

    Ah, the Microsoft tradition of always having the wrong priorities.

    • plz1@lemmy.worldEnglish
      8·
      2 years ago

      They didn’t put “AI” in the subject line of the emails, so Microsoft doesn’t care…

    • lysdexic@programming.devEnglish
      2·
      2 years ago

      Ah, the Microsoft tradition of always having the wrong priorities.

      I wouldn’t be too hard on Microsoft. The requirement to curate public package repositories only emerged somewhat recently, as demonstrated by the likes of npm, and putting in place a process to audit and pull out offending packages might not be straight-forward.

      I think the main take on this is to learn the lesson that it is not safe to install random software you come across online. Is this lesson new, though?

      • floofloof@lemmy.caOPEnglish
        2·
        2 years ago

        I think the main take on this is to learn the lesson that it is not safe to install random software you come across online. Is this lesson new, though?

        I think people often have a vaguely formed assumption that plugins are somehow sandboxed and less dangerous. But that all depends on the software hosting the plugin. There was a recent issue with a KDE theme wiping a user’s files which brought this to light. We can’t assume plugins or themes are any less dangerous than random executables.

  • Kuinox@lemmy.world
    5621·
    2 years ago

    Fake news headline. There is no virus installed on millions of computer.
    An extension typosquatting an extension with million of install managed to be installed a few hundred of times.

    • Tekhne@sh.itjust.works
      33·
      2 years ago

      I believe they’re referring to lower down in the article, where the researchers analyzed existing extensions on the marketplace:

      After the successful experiment, the researchers decided to dive into the threat landscape of the VSCode Marketplace, using a custom tool they developed named ‘ExtensionTotal’ to find high-risk extensions, unpack them, and scrutinize suspicious code snippets.

      Through this process, they have found the following:

      • 1,283 with known malicious code (229 million installs).
      • 8,161 communicating with hardcoded IP addresses.
      • 1,452 running unknown executables.
      • 2,304 that are using another publisher’s Github repo, indicating they are a copycat.
    • kinttach@lemm.eeEnglish
      6·
      2 years ago

      Their findings included an extension that opens an obvious reverse shell.

      • Kuinox@lemmy.world
        25·
        2 years ago

        They made themselves the extensions.
        If you are talking about the other reverse shell, it hit a local IP address.

        • kinttach@lemm.eeEnglish
          4·
          2 years ago

          True, it’s a private (not local) IP. It could easily have connected to a remote system, as their proof-of-concept did.

          This code execs cmd.exe and pipes output to and from a hardcoded IP. That’s pretty weird. What’s running on that IP? How does the extension know something is there?

          It looks like VS Code has no review — human or automated — or enforced entitlement system that would have stopped this or at least had someone verify it was legit.

          • Kuinox@lemmy.world
            13·
            2 years ago

            Thing is, tons of code extensions have an RCE in one form or another, but they always hit a localhost, or configurable IP. How do there automated analysis did any difference ?
            Tons of extensions summon the cmd to summon the language devtools, their automated analysis flagged tons of package and they infer millions of infeections from that.

    • lysdexic@programming.devEnglish
      2·
      2 years ago

      Remembering ActiveX Controls, the Web’s Biggest Mistake:

      Running JavaScript everywhere is looming as one of the biggest screwups in InfoSec. What do userscript extensions like Grease monkey teach us?

  • AIhasUse@lemmy.world
    15·
    2 years ago

    Is there a list of the malicious extensions? What should be done if we ha e malicious ones installed?