3 ms·
ssh.exe seems to be on enough Windows machines these days. How's that different?
by _cenw 3y ago
ssh.exe seems to be on enough Windows machines these days. How's that different?
- eddythompson80 3y agopowershell.exe is on all of them. Just load up System.Net.TcpListener/Client and bob’s your uncle.
- deleted 3y ago[deleted]
- msm_ 3y agoRunning arbitrary Powershell scripts from disk during OS autostart is one of the (if not the) loudest things attacker could do. The point of this blog post is stealth. Nobody claims it's a vulnerability in VS code (or vulnerability in anything at all), just a convenient method of persistence.
- xg15 3y agossh.exe would at least show up on the firewall as "ssh connecting to a dubious host". The VSCode thing would show up as "VSCode connecting to some random Microsoft domain".
- Zetobal 3y agoYeah, sorry but if you are in an environment were you are actively monitoring your firewall and you didn't get that your machine was breached you have way other problems than vscode or an SSH process.
- hutzlibu 3y agoHow do you get that your machine(or one of the many you are observing) was breached, if the attacker is not doing obvious damage? I think monitoring connections is standard procedure to find this out?
- Zetobal 3y agoIf someone can access your machines physically, can login, play with an USB Stick or download malware. No form of monitoring your logs will keep your data safe.
- rat9988 3y agoThe question is not to keep your data safe, but to know that there is a breach to begin with.
- Zetobal 3y agoIf a user is logged in with high activity at a time the user should not be working and the only thing that would tick you off is your firewall log you got other problems than a remote access feature of vscode that "could" be abused ONLY if the attacker had previously breached your system.
- hutzlibu 3y agoAnd if the attacker is smart and uses active times to hide his activity, then monitoring active connections is a smart way, no?
- Zetobal 3y agoIt's nice to have especially if you need to find a rogue employee but if you catch a bad actor only when he is already exfiltrating, you failed at your job.
- hutzlibu 3y agoSure, but when some damage is already done, you can and must still prevent greater damage. And you have to assume, that one day something fails. So - "monitoring active connections is a smart way, no?"