> VSCode always first asks you if you trust the author of this code
until we do that, VSCode doesn't let us interact with the codebase, so we end up clicking that trust as soon as we open the directory and move on.
When VSCode detects launch commands in ".vscode", It should be rather explicit about running it, like "Trusting this workspace runs the following command on your behalf"
do you mean the machine which is connected through the victim's machine? if so, i should put this in a VM, run and see where it's sending/receiving requests from. i'll do that.
Yeah, exactly. If there's a C2 server, there's some protocol for communication between the C2 server and each victim node.
You can intentionally infect a machine with the malware but then watch the traffic between the victim node and the C2 server. If you get lucky, the C2 server assumes that the victim node is trusted and doesn't sanity check victim->server communication.
Note that this cranks up the danger quite a few notches, though it sounds like you know what you're doing.
But, I don't think anybody pays attention to the workspace trust. When ".vscode" has launch commands, it should rather say, "Trusting this workspace runs the following command on your behalf" or something similar.
Yeah, I had no idea Microsoft thinks trust means auto run immediately a script. I always just thought it was something more pedestrian, like restricting debug launch links or something. I will probably not use vs code at all for untrusted repos now.
> "I will probably not use vs code at all for untrusted repos now"
The meaning of "Trust" is pretty unambiguous. If you're clicking "Trust this" for a repository you don't trust, I'm not sure that switching IDEs is going to help you much.
I feel like vscode is doing everything right here and they cant really do much about users choosing to ignore security warnings. Other IDEs here do exactly the same or less.
Not saying there isn't room to improve, but again if you're uninstalling vscode what are you going to replace it with?
Hiding malicious behavior behind security warnings you can only click yes or no to is the Microsoft way of neatly denying responsibility, and it compounds and reinforces itself. This pdf looks like a pdf, acts like a pdf, opens like a pdf, what are you going to do? You clicked OK so you wanted that Outlook virus to email itself to everyone on your address book and send their bitcoin to Madagascar, not Microsoft.
reply