A group of Israeli researchers explored the security of the Visual Studio Code marketplace and managed to "infect" over 100 organizations by trojanizing a copy of the popular 'Dracula Official theme to include risky code. Further research into the VSCode Marketplace found thousands of extensions with millions of installs.
Fake news headline. There is no virus installed on millions of computer.
An extension typosquatting an extension with million of install managed to be installed a few hundred of times.
I wouldn’t be so quick to write it off.
It’s a proof of concept showing the weaknesses in Microsoft’s vetting process for extensions published on the store. They then used the process to get pseudo-malicious code inside hundreds of organisations (not hundred of installs) some of which are high profile.
Microsoft doesn’t have a vetting process for publishing extensions in the store. Maybe the failure is that people assume they do?
Surely you mean “that Microsoft does not make it clear that they don’t”?
Maybe, but I think the only app store that does vet apps is the Apple one, so that should be the default expectation.
And I think even they wouldn’t manually look for something like this. They’re mainly concerned about people breaking the commercial rules.
I believe they’re referring to lower down in the article, where the researchers analyzed existing extensions on the marketplace:
If you look at the code of one of the “malicious code”, it hit a … local IP, not a remote one.
Does that mean the hacker is in my room??