Blocking Visual Studio Code embedded reverse shell before it's too late
> <i>this tunnel can be triggered from the cmdline with the portable version of code.exe. An attacker just has to upload the binary</i><p>If the attacker can run commands and upload binaries, it really doesn't matter what VS Code does. There are lots of commands and binaries that can open network connections.<p>Edit: The attacker apparently needs to control the URL and exfiltrate the activation code [0], so if they can already execute commands and open network connections, then this enables them to execute commands and open network connections. So, as mentioned by other commenters, this does sound a lot like Raymond Chen's airtight hatchway [1].<p>[0] <a href="https://badoption.eu/blog/2023/01/31/code_c2.html" rel="nofollow noreferrer">https://badoption.eu/blog/2023/01/31/code_c2.html</a><p>[1] <a href="https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31283" rel="nofollow noreferrer">https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31...</a>