Worming Through IDEs
David Dworken challenges the developer trust model by discovering critical vulnerabilities in modern IDEs (VS Code, IntelliJ) that execute code simply upon opening a repo.
Summary
The Flawed Threat Model of Developer IDEs
Developers frequently clone untrusted open-source code under the assumption that merely opening and reviewing a repository in an IDE without clicking 'Run' is safe.
Auditing Extension Ecosystems and Workspace Trust
David Dworken evaluates popular IDEs (such as Visual Studio Code, IntelliJ IDEA, and Eclipse), analyzing automatic build triggers, language servers, and linter integrations.
Executing Arbitrary Code on Repository Checkout
By embedding malicious workspace configuration files and task definitions in a project, an attacker triggers silent remote code execution the moment the repository is loaded in the IDE.
Introducing Workspace Trust Boundaries
Dworken reviews industry responses—such as VS Code's Workspace Trust feature—and provides developers with guidelines for safely inspecting untrusted repositories.
Related talks
Main Stage·38 min
Thomas Chauchefoin · Paul Gerste
Uncovers critical RCE vulnerabilities in Visual Studio Code, demonstrating how malicious repository configurations bypass Workspace Trust protections.
Main Stage·45 min
Rotem Bar
Rotem Bar turns static application security testing (SAST) tools and linters against developers, weaponizing malicious repositories to achieve RCE during source code scanning.
Blacks in Cyber Village·44 min
Ochuan Marshall
Ochuan Marshall breaks down Log4Shell (CVE-2021-44228), demonstrating how to exploit JNDI lookups in a Minecraft homelab and secure software supply chains.