The VSCode Marketplace is pretty easy to hack with malicious extensions

VSCode Marketplace, a repository for Visual Studio Code (VSC) externsions, has poor security defenses, allowing threat actors to abuse it and distribute malicious code among the millions of its users, experts have warned.

A report from AquaSec tested the platform and concluded that abusing it to distribute malware (opens in new tab) was ridiculously easy. 

Furthermore, the researchers claim they weren’t the first to spot the flaws – some threat actors were already active. 

Spoofing important details

In a blog post (opens in new tab), AquaSec’s team outlined how it tried to upload a typosquatted, malicious version of a popular extension with 27 million downloads. 

It realized that the malware needed not even be typosquatted –  the platform has a feature called ‘displayName’ allowing the authors to name their extensions however they like – the name does not need to be unique. So, they named it exactly the same as the legitimate one.

Then, they realized that they could also use the same logo and description as the legitimate project.

Also, the details, while they get pulled from GitHub, can later be edited. That means that the attackers can easily spoof the project details and present the malware as a legitimate tool with a long development history. The only thing that couldn’t be spoofed was the number of downloads and the search ranking. 

“However, over time an increasing pool of unknowing users will have downloaded our faux extension. As these figures grow, the extension will gain credibility,” AquaSec said. “Additionally, since in the dark web it is possible to purchase various services, an extremely determined attacker could potentially manipulate these numbers by buying services which would inflate the number of downloads and stars.”

AquaSec also looked at the verification badge on VSCode Marketplace and concluded that the feature is meaningless, as any published with a purchased domain gets one, regardless of the relevance of the domain to the software project.

While the researchers only made a proof-of-concept, they also found actual malicious code lurking in the store. These are named “API Generator Plugin” and “code tester”.

Visual Studio Code is Microsoft’s source-code editor, used by some 70% of professional software developers worldwide, according to BleepingComputer. The extensions can be used to install additional programs, steal source code, or tamper with it in other ways in the VSCode IDE.

Via: BleepingComputer (opens in new tab)