News for hackers. Stuff that matters.

A comment on Supply-chain attack hits RubyGems repository with malicious packages. Parent comment

Re:Supply-chain attack hits RubyGems repository with malicio... by ajsharp on Saturday April 18, 2020 @12:10PM (#22908655)
How would a dev vm prevent this? Vms can still call out to the internet.
[ Parent | on HN ]
Re:Supply-chain attack hits RubyGems repository with malicio... by badrabbit on Saturday April 18, 2020 @12:31PM (#22908803)
No host FS or clipboard access means it would be rendered useless.
[ Parent | on HN ]
Re:Supply-chain attack hits RubyGems repository with malicio... by justinclift on Saturday April 18, 2020 @09:11PM (#22912605)
Hmmm, that depends on the virtualisation solution being used.

If someone's using (say) VMware Workstation or Fusion, if they've loaded the VMware tools into the VM it can share the clipboard and be configured with access to the hosts filesystem (at defined points).

[ Parent | on HN ]
Re:Supply-chain attack hits RubyGems repository with malicio... by badrabbit on Saturday April 18, 2020 @11:34PM (#22913293)
If you set it up that way it will. If you are doing this intentionally then just don't set it up that way.
[ Parent | on HN ]