Andrew pfp

Andrew

@andrewmohawk

171 Following
172 Followers
Andrew pfp
1 reply
3 recasts
6 reactions
Andrew pfp
0 reply
0 recast
1 reaction
Andrew pfp
3 replies
1 recast
7 reactions
Andrew pfp
0 reply
0 recast
0 reaction
Andrew pfp
0 reply
0 recast
0 reaction
Andrew pfp
We are seeing a lot more attacks utilizing malicious VSCode and Browser extensions (although these have been around for a while). For browser extensions you can use "managed chrome" instances to control what can/cant be installed to make sure no extensions are installed that are malicious. You can also choose to block particularly bad extensions. For VSCode extensions you are basically SOL, right now my advice is this: Wherever possible please use [vscode.dev](http://vscode.dev) to open untrusted projects as it means that there is little chance they can execute code on your behalf. VSCode projects can execute arbitrary code when opening if you click “I trust this application/codebase” If you want to scan the extensions before installing you can use this to validate both chrome and vscode extensions: https://www.extensiontotal.com/
0 reply
0 recast
0 reaction
Andrew pfp
0 reply
0 recast
1 reaction
Andrew pfp
0 reply
0 recast
1 reaction
Andrew pfp
0 reply
0 recast
2 reactions
Andrew pfp
0 reply
0 recast
1 reaction
Andrew pfp
If you missed it I definitely recommend you take a look at @nick.eth 's tweet thread about a fairly clever phishing attack: https://x.com/nicksdjohnson/status/1912439023982834120 TL;DR the attackers change the app name to the message, Google sends it to you and then they host the actual phishing site on `sites.google.com` This attack underscores the value of using Passkeys and hardware security keys (like YubiKeys). Unlike traditional username/password logins or codes sent via SMS or used in Authenticator apps, passkeys and hardware tokens use cryptographic proofs that are tied directly to the exact domain of the legitimate site. They will refuse authentication on any other domain—even if it looks visually identical. This makes passkeys and YubiKeys effectively 100% immune to phishing attacks like these. Additionally, password managers can help by automatically identifying domain mismatches, preventing users from submitting credentials to fraudulent websites.
1 reply
0 recast
0 reaction
Andrew pfp
1 reply
0 recast
1 reaction
Andrew pfp
0 reply
0 recast
1 reaction
Andrew pfp
0 reply
0 recast
1 reaction
Andrew pfp
1 reply
0 recast
3 reactions
Andrew pfp
1 reply
2 recasts
10 reactions
Andrew pfp
0 reply
0 recast
4 reactions
Andrew pfp
0 reply
0 recast
2 reactions
Andrew pfp
0 reply
0 recast
0 reaction
Andrew pfp
0 reply
2 recasts
12 reactions