this post was submitted on 10 Jun 2024
233 points (94.6% liked)

Programming

17313 readers
113 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities [email protected]



founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
[–] Kuinox -3 points 5 months ago (1 children)

They made themselves the extensions.
If you are talking about the other reverse shell, it hit a local IP address.

[–] [email protected] 4 points 5 months ago (1 children)

True, it’s a private (not local) IP. It could easily have connected to a remote system, as their proof-of-concept did.

This code execs cmd.exe and pipes output to and from a hardcoded IP. That’s pretty weird. What’s running on that IP? How does the extension know something is there?

It looks like VS Code has no review — human or automated — or enforced entitlement system that would have stopped this or at least had someone verify it was legit.

[–] Kuinox -2 points 5 months ago (1 children)

Thing is, tons of code extensions have an RCE in one form or another, but they always hit a localhost, or configurable IP. How do there automated analysis did any difference ?
Tons of extensions summon the cmd to summon the language devtools, their automated analysis flagged tons of package and they infer millions of infeections from that.

[–] [email protected] 1 points 5 months ago (1 children)

infeections

Since I read this I can't stop picturing you as Peter Lorre lmao.

[–] Kuinox 2 points 5 months ago (1 children)

Damn now I noticed i did tons of mistake/types there ^^'.

[–] [email protected] 1 points 5 months ago

Lol it was just one of those things where I read it in his voice for that word.