• 0 Posts
  • 363 Comments
Joined 3 years ago
cake
Cake day: June 19th, 2023

help-circle









  • Setting the SSH service to a random high port doesn’t make security better and may make security worse. Linux has a restriction that low numbered ports require special permissions but high numbered ports do not. If an attacker manages to get low privilege code execution on your machine, they may manage to bind their service to the SSH port instead. If the server and client are configured correctly, this will cause a host key mismatch error. Continuing anyway could allow the attacker to take over your account on the server. It’s unlikely unless you are a high value target.











  • This problem has nothing to do with NPM. Checkmarx was compromised last month, and during that compromise there were malicious VS Code extensions published to Visual Studio Code Marketplace. A Bitwarden developer says that somebody ran one of those malicious extensions, and GitHub API keys were stolen which were used in publishing the malicious CLI package.

    It’s probably better that it happened on NPM. If the CLI were only downloadable from the Bitwarden website, it would have likely taken longer for somebody to notice something was wrong.