Re:Obsidian plugin was abused to deploy a remote access trojan
by jon-wood on Monday May 11, 2026 @05:34AM
(#48092863)
On macOS at least those 99% of users are probably installing from the App Store, where apps are sandboxed by default and need to explicitly ask for access to paths outside that sandbox. Even when not installed from the App Store a permission dialogue is popped if an application tries to read from sensitive paths like your photo library.
[ Parent
| on HN ]
Re:Obsidian plugin was abused to deploy a remote access trojan
by silon42 on Monday May 11, 2026 @07:16AM
(#48093528)
For real security, operation should only be allowed after 24h of cooldown.
Re:Obsidian plugin was abused to deploy a remote access trojan
by SamBam on Monday May 11, 2026 @11:49AM
(#48096619)
User should be required to explain the situation to an older and a younger family member, and get permission from both of them.
Re:Obsidian plugin was abused to deploy a remote access trojan
by embedding-shape on Monday May 11, 2026 @08:34AM
(#48094166)
Does that help in this case though? I think the worry is that a rogue Obsidian plugin does bad stuff with your Obsidian vault, not just do stuff to the rest of the computer. But that vault/those notes live in the same sandbox as the (rogue) 3rd party plugin, which doesn't help with that, they really need to be isolated away from the notes themselves.
Re:Obsidian plugin was abused to deploy a remote access trojan
by zerkten on Monday May 11, 2026 @01:01PM
(#48097599)
Anything that reduces the blast radius helps. There should still be a focus on further hardening. Most value comes from exploits that enable pivots. Attackers will focus on other vectors that enable broader pivots because immediate high value notes only exist for a limited set of users.