Hello, welcome to the Monday, May 17, 2021 edition of the Sandcent Storm Center's Stormcast. My name is Johannes Ulrich and today I'm recording from Jacksonville, Florida.

Last week, I mentioned how Jan was looking at the slight decrease in exposed industrial control systems over the last year.

Xavier this weekend followed up with a quick look at exposed VNC services.

Now, when Ian looked at the data using Shodan, Jan focused on ports that are specific to industrial control protocols. VNC, of course,

is a more generic remote access protocol, but often used to expose industrial control systems

as well. Xavier used a tool called VNC snapshot, which takes, well, as the name implies, sort of a screenshot of a VNC service.

It does not attempt to log in, so there was no brute forcing involved in any way.

Well, and he didn't have to look long in order to figure out that many of the services that were exposed did not require

any kind of authentication and appeared to allow direct access to a number of industrial control

systems worldwide. No big news here, sad that it's really still happening. And yes, Xavier showed some

screenshots here showing that this is a worldwide problem, not really just the regional or

limited to particular industry problem. A lot of developers these days are using Visual Studio Code in order to edit their projects

in part because Visual Studio Code is available on multiple platforms.

It's free, it's supported by Microsoft, and it does provide a number of plugins for specific

languages.

For example, a Rust Analyzer plugin that according to the Visual Studio

marketplace site has been installed about 200,000 times.

The problem with this plugin is that if a developer does open a malicious project,

this may execute code and a proof-of-concept exploit has already been released. In the proof-of-concept

exploit, this vulnerability is used to exfiltrate the dot SSH directory from the developer's account.

So this could potentially include, for example, private SSH keys and, of course,

asage configuration files that may give an attacker access to various systems that the

...