The VSCode Marketplace is pretty easy to hack with malicious extensions

Date:
Mon, 09 Jan 2023 18:04:26 +0000

Description:
There are very few roadblocks to uploading malware to the marketplace, researchers warn.

FULL STORY ======================================================================

VSCode Marketplace, a repository for Visual Studio Code (VSC) externsions,
has poor security defenses, allowing threat actors to abuse it and distribute malicious code among the millions of its users, experts have warned.

A report from AquaSec tested the platform and concluded that abusing it to distribute malware was ridiculously easy.

Furthermore, the researchers claim they werent the first to spot the flaws - some threat actors were already active. Spoofing important details

In a blog post , AquaSec's team outlined how it tried to upload a typosquatted, malicious version of a popular extension with 27 million downloads.

It realized that the malware needed not even be typosquatted - the platform has a feature called displayName allowing the authors to name their
extensions however they like - the name does not need to be unique. So, they named it exactly the same as the legitimate one.

Then, they realized that they could also use the same logo and description as the legitimate project.

Also, the details, while they get pulled from GitHub, can later be edited. That means that the attackers can easily spoof the project details and
present the malware as a legitimate tool with a long development history. The only thing that couldnt be spoofed was the number of downloads and the search ranking.

"However, over time an increasing pool of unknowing users will have
downloaded our faux extension. As these figures grow, the extension will gain credibility," AquaSec said. "Additionally, since in the dark web it is possible to purchase various services, an extremely determined attacker could potentially manipulate these numbers by buying services which would inflate the number of downloads and stars." Read more

Malicious Google Chrome extensions installed on more than one million

devices

Millions of us are using malicious browser extensions without realizing

These are the best endpoint protection tools around

AquaSec also looked at the verification badge on VSCode Marketplace and concluded that the feature is meaningless, as any published with a purchased domain gets one, regardless of the relevance of the domain to the software project.

While the researchers only made a proof-of-concept, they also found actual malicious code lurking in the store. These are named API Generator Plugin and code tester.

Visual Studio Code is Microsofts source-code editor, used by some 70% of professional software developers worldwide, according to BleepingComputer . The extensions can be used to install additional programs, steal source code, or tamper with it in other ways in the VSCode IDE. Check out the best firewalls around

Via: BleepingComputer



======================================================================
Link to news story: https://www.techradar.com/news/the-vscode-marketplace-is-pretty-easy-to-hack-w ith-malicious-extensions


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)