Post by @GossiTheDog@cyberplace.social

@GossiTheDog@cyberplace.social · 4 hours ago

RE: https://hachyderm.io/@ChrisShort/116606591908387955

If you want on to Microsoft's internal network, CORPNET, publish or own an existing a VSCode extension.

The Visual Studio Code Marketplace, which Microsoft own, is completely uncontrolled.

Anybody can publish an extension, it provides code execution on endpoints, extensions auto update by default, "verified" blue tick extensions just need any domain registration, and there's no endpoint security controls at all around what users can install.

VSCode is an absolute security shittip as a result.

Chris Short

@ChrisShort@hachyderm.io · 4 hours ago

GitHub was compromised via a VSCode extension on an employee's machine. Yikes on bikes. https://x.com/github/status/2056949168208552080

David Chisnall (*Now with 50% more sarcasm!*)

@david_chisnall@infosec.exchange · 3 hours ago

@GossiTheDog

VS Code started to be a thing people used when I was at MS. A lot of folks were using the remote extensions for working in Azure VMs. I saw that there was an open issue about FreeBSD support, so I reached out to some of the folks responsible internally. The things I learned about how that worked made me back away slowly and be very happy I used vim.

MacCruiskeen

@maccruiskeen@social.linux.pizza · 3 hours ago

@GossiTheDog I realize that this is tangential, but the network is named CORPNET? Really? Are we in a cheap 1980s techno-thriller?

Kevin Beaumont

@GossiTheDog@cyberplace.social · 3 hours ago

@maccruiskeen that's the main AD domain, yep. Keep in mind MS is an 80s company 😅

Michael Newton

@mavnn@bonfire.mavnn.eu · 2 hours ago

@GossiTheDog@cyberplace.social @maccruiskeen@social.linux.pizza also, this is the company that chose to call a flagship product family .NET

Kevin Beaumont

@GossiTheDog@cyberplace.social · 4 hours ago

Also - if you think 'none of our users run VSCode', check your telemetry. They do. It doesn't even need local admin rights to install.

I've tooted about this one for about two years now, Microsoft have created their own security bonfire and it's going off in their own backyard, they just haven't realised yet.

VessOnSecurity

@bontchev@infosec.exchange · 3 hours ago

@GossiTheDog Also check if they are running Cursor (the AI thing). It's VSCode in disguise, uses the same plugins, can import all the settings, etc.

D Ingram

@ingram@mastodon.social · 3 hours ago

@GossiTheDog And this is why my work PC is locked down so tight I can't even make and run my own batch files, let alone anything .exe. The organisation actually practices the Essential Eight.

Kevin Beaumont

@GossiTheDog@cyberplace.social · 4 hours ago

Also - if you think 'none of our users run VSCode', check your telemetry. They do. It doesn't even need local admin rights to install.

I've tooted about this one for about two years now, Microsoft have created their own security bonfire and it's going off in their own backyard, they just haven't realised yet.