Security begins with secure development environments
summary
Snyk discloses concrete VS Code extension flaws that enable remote code execution by tricking a developer to click a link; the demo targets the instant markdown extension, abuses its localhost socket to perform file traversal and exfiltrate a ~/passwords file to a PHP/ngrok listener, and it succeeds on version 1.4.6 but is fixed in 1.4.7. Numbers matter: VS Code has ~14 million monthly users and 225,000 extensions, so the issue is broadly exploitable.
AI-written summary · about
chapters (9)
- 0:00Start
- 1:00Vandana Verma Snyk Developer Advocate
- 1:56Security issues in this code?
- 6:02We missed something very important
- 17:06Lets hack a dev env
- 17:28Takeaways
- 18:46snykCon 2021
- 19:01Use your tech super powers for good
- 19:39Thank you!
related talks
36mExploiting Vulnerabilities and Flaws to Attack Supply Chain
46mVSCorode: Inside Your IDE, Inside Your Git Repository- 46mVSCorode: Inside Your IDE, Inside Your Git Repository
14mStranger Danger: Tracking Vulnerabilities in Your Third Party Code
24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
40mMarkDoom: How I Hacked Every Major IDE in 2 Weeks
29mHunting Malicious IDE Extensions: Building Detection at Scale... (Vinod Tiwari)
35mBreaking the Chain: An Attacker's Perspective on Supply Chain Vulnerabilities and Flaws