conv.

All stories
SecurityQuiet 11d · day 13

Major VS Code plugin compromised, pushes SSH backdoors

A trusted plugin from an established company was hijacked to distribute shell scripts installing remote access tools, validating long-standing security concerns.

newest coverage 10d agosummary written 10d ago5 pieces660 likes & upvotes32 comments Mastodon

What to know

  • A trusted VS Code plugin from an established company was compromised and used to distribute SSH backdoors, affecting developers who installed it.
  • The incident validates years of warnings from security researchers about VS Code's unsafe plugin architecture and Microsoft's refusal to implement restrictions.
  • Debate centers on whether the risk lies with VS Code's design or user responsibility, with skepticism that Microsoft will meaningfully address the underlying vulnerability.
most voices

VS Code's permissive plugin model is fundamentally unsafe and Microsoft must restrict it.

  • “we, people who like things to have some reasonable baseline amount of safety in our everyday tools, have been complaining for years that VS Code's plugin model is absurdly unsafe and an absolute open sewer”

    0xabad1dea · Mastodon ↗
some voices

The safest approach is to avoid third-party software altogether and only run code you write yourself.

  • “it is not only "not radical" but in fact "the only right choice" to only ever run software you yourself write, and to never connect such software to a network.”

    philip · Mastodon ↗

Microsoft VS Code maintainer0xabad1dea Security researcher

How it unfolded 2 developments, newest first · click a bar or a number to jump posts

Peak 2 pieces in 3h at Oct 30, 10 AM; 5 pieces over 13 days (5 posts) Oct 30, 7 AM — 1 piece · 1 post — Mastodon 1Oct 30, 10 AM — 2 pieces · 2 posts — Mastodon 2Oct 30, 1 PM — quietOct 30, 4 PM — 1 piece · 1 post — Mastodon 1Oct 30, 7 PM — quietOct 30, 10 PM — quietOct 31, 1 AM — quietOct 31, 4 AM — quietOct 31, 7 AM — quietOct 31, 10 AM — quietOct 31, 1 PM — quietOct 31, 4 PM — quietOct 31, 7 PM — quietOct 31, 10 PM — 1 piece · 1 post — Mastodon 1Nov 1, 1 AM — quietNov 1, 3 AM — quietNov 1, 6 AM — quietNov 1, 9 AM — quietNov 1, 12 PM — quietNov 1, 3 PM — quietNov 1, 6 PM — quietNov 1, 9 PM — quietNov 2, 12 AM — quietNov 2, 3 AM — quietNov 2, 6 AM — quietNov 2, 9 AM — quietNov 2, 12 PM — quietNov 2, 3 PM — quietNov 2, 6 PM — quietNov 2, 9 PM — quietNov 3, 12 AM — quietNov 3, 3 AM — quietNov 3, 6 AM — quietNov 3, 9 AM — quietNov 3, 12 PM — quietNov 3, 3 PM — quietNov 3, 6 PM — quietNov 3, 9 PM — quietNov 4, 12 AM — quietNov 4, 3 AM — quietNov 4, 6 AM — quietNov 4, 9 AM — quietNov 4, 12 PM — quietNov 4, 3 PM — quietNov 4, 6 PM — quietNov 4, 9 PM — quietNov 5, 12 AM — quietNov 5, 3 AM — quietNov 5, 6 AM — quietNov 5, 9 AM — quietNov 5, 12 PM — quietNov 5, 3 PM — quietNov 5, 6 PM — quietNov 5, 9 PM — quietNov 6, 12 AM — quietNov 6, 3 AM — quietNov 6, 6 AM — quietNov 6, 9 AM — quietNov 6, 12 PM — quietNov 6, 3 PM — quietNov 6, 6 PM — quietNov 6, 9 PM — quietNov 7, 12 AM — quietNov 7, 3 AM — quietNov 7, 6 AM — quietNov 7, 9 AM — quietNov 7, 12 PM — quietNov 7, 3 PM — quietNov 7, 6 PM — quietNov 7, 9 PM — quietNov 8, 12 AM — quietNov 8, 3 AM — quietNov 8, 6 AM — quietNov 8, 9 AM — quietNov 8, 12 PM — quietNov 8, 3 PM — quietNov 8, 6 PM — quietNov 8, 9 PM — quietNov 9, 12 AM — quietNov 9, 3 AM — quietNov 9, 6 AM — quietNov 9, 9 AM — quietNov 9, 12 PM — quietNov 9, 3 PM — quietNov 9, 6 PM — quietNov 9, 9 PM — quietYesterday, 12 AM — quietYesterday, 3 AM — quietYesterday, 6 AM — quietYesterday, 9 AM — quietYesterday, 12 PM — quietYesterday, 3 PM — quietYesterday, 6 PM — quietYesterday, 9 PM — quietToday, 12 AM — quietToday, 3 AM — quietToday, 6 AM — quietToday, 9 AM — quietToday, 12 PM — quietToday, 3 PM — quietToday, 6 PM — quiet 1–2
Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 9:51 PM ET
  1. 2

    Security researcher highlights years of unheeded warnings

    Infosec researcher notes that VS Code's unsafe plugin model has been criticized for years, with Microsoft consistently refusing to implement safety controls and deferring responsibility to users.

    “we, people who like things to have some reasonable baseline amount of safety in our everyday tools, have been complaining for years that VS Code's plugin model is absurdly unsafe and an absolute open sewer; Microsoft shrugs and says it's the user's responsibility…”
    — 0xabad1dea

    • RE: https:// infosec.exchange/@0xabad1dea/1 17529823729259748 With every passing day I become increasingly emboldened that it is not only “not radical” but in fact “the only right choice” to only ever run software you yourself write, and to never connect such software to a network. (No, I haven’t written my own kernel yet despite thinking I maybe…

      philip@mallegolhansen.comMastodon10d agoview on Mastodon ↗
    2 more of the top 3 · 4 posts in this stretch
    • Aecernist@mastodon.social

      RE: https:// infosec.exchange/@0xabad1dea/1 17529823729259748 I would politely suggest that any theft of crypto 'currency' is just fastracking what will eventually happen to all crypto 'currency'. The Microsoft scandal is small beans compared to the crypto-ponzi scandal.

      Aecernist@mastodon.socialMastodon12d agoview on Mastodon ↗
    • grumpybozo@toad.social

      RE: https:// infosec.exchange/@0xabad1dea/1 17529823729259748 I’m pretty sure she knows this, but the audience should be warned: DO NOT HOLD YOUR BREATH WAITING FOR MICROSOFT TO ADDRESS THIS

      grumpybozo@toad.socialMastodon12d agoview on Mastodon ↗
    all of them →
  2. 1

    Major VS Code plugin compromised to distribute SSH backdoors

    A plugin from an established company was hijacked and began pushing shell scripts that automatically install SSH backdoors to infected machines.

    “a major plugin from a major company is compromised and begins pushing shell scripts to automatically install ssh backdoors…”
    — 0xabad1dea
    • 0xabad1dea@infosec.exchange

      okay, so here's what I'm thinking right now: 1) we, people who like things to have some reasonable baseline amount of safety in our everyday tools, have been complaining for years that VS Code's plugin model is absurdly unsafe and an absolute open sewer; Microsoft shrugs and says it's the user's responsibility to only install reliable plugins 2)…

      0xabad1dea@infosec.exchangeMastodon12d ago660▲view on Mastodon ↗

What people are saying 1 voices from 1 site · best of 5 · verbatim