This Week in Security: Malicious Themes, Crypto Heists, and Wallbleed

It's usually not a good sign when your downloaded theme contains obfuscated code. Yes, we're talking about the very popular Material Theme for VSCode. This one has a bit of a convoluted history.

The original Material Theme was yanked from the VSCode store, the source code (improperly) re-licensed as closed source, and replaced with freemium versions. And this week, those freemium versions have been pulled by Microsoft for containing malware. Now there's a quirk to this story.

No one has been able to answer a simple yet vital question: What exactly did the theme plugin do that was malicious? The official response is that “A theming extension with heavily obfuscated code”. But what does that even mean?

The lack of clarity on this issue raises concerns about transparency and accountability in the development of software. It's not just a matter of the code being difficult to read, but also whether it's been thoroughly tested for security vulnerabilities.

In other news, hackers have been using phishing attacks to gain access to internal machines within 48 minutes. The hack was simple and clever: start a mass spam and phishing campaign, pose as a helpful IT worker who could help end the carnage, and wait for an unsuspecting employee to fall for it.

But cybersecurity isn't just about individual hackers. Sometimes, it's about government agencies and their own devices being compromised.

A recent incident involved a cybercriminal gaining access to a device by opening a seemingly innocuous email attachment. The attack was so convincing that the victim didn't even suspect anything until after the damage had been done.

And then there's Wallbleed, a vulnerability in China's Great Firewall system that allows hackers to steal sensitive data from users' devices. The bug is similar to Heartbleed, but with a twist: it also allows for bi-directional DNS requests and responses.

This means that if you send a DNS request to a Chinese IP address, the firewall will spoof the response and send back a fake IP address. It's like having two separate networks stacked on top of each other – one that you think is real, but isn't.

The implications are huge. With this kind of access, hackers can learn everything they need to know about your device, including your location, browsing history, and even sensitive information like passwords and credit card numbers.

So what's being done about it? Researchers have been working on a fix for Wallbleed, but the Chinese authorities seem to be handling the situation in-house. It's not clear whether this is because they're too embarrassed to admit their mistake or if they're simply choosing to ignore the issue altogether.

In the meantime, cybersecurity experts are urging users to take precautions when accessing blocked websites or services from China.

They recommend using a VPN (Virtual Private Network) or Tor browser to mask your IP address and location. They also suggest being cautious when opening email attachments or clicking on links, even if they come from trusted sources.

And finally, there's the case of automslc, a PyPi package that secretly downloads and scrapes music from popular streaming services without users' knowledge or consent.

This is a stark reminder that cybersecurity threats can come in many forms, from malware and phishing attacks to rogue software packages and government censorship. It's essential to stay vigilant and take steps to protect your digital identity.