Security Issue

[KevinS-99]

We had an issue today where Crowdstrike isolated code.exe for VSCode. We updated some extensions and crowdstrike did not like bbfilter.exe. We are trying to understand if that is part of IBM i extensions or part of VSCode. Could one of the developers advise? We have whitelisted it and can continue to work but our security team is asking what it is and what does it do.

[sebjulliand]

Hi @KevinS-99, this must be part of VSCode (or something else). None of our extensions embeds a Windows executable.
Out of curiosity, do you know the location of this bbfilter.exe file?

[KevinS-99]

Within windows under my user directory according to Crowdstrike: \.vscode\extensions\.e966c537-ba34-4e35-a75f-0ff82bfd1695\out\bin\compilers\bB\ From: Sébastien Julliand ***@***.***> Sent: Wednesday, May 22, 2024 8:59 AM To: codefori/vscode-ibmi ***@***.***> Cc: Kevin Schreur ***@***.***>; Mention ***@***.***> Subject: [EXTERNAL] Re: [codefori/vscode-ibmi] Security Issue (Discussion #2067) External Sender. Please do not click on links or open attachments from senders you do not trust. Hi @KevinS-99<https://github.com/KevinS-99>, this must be part of VSCode (or something else). None of our extensions embeds a Windows executable. Out of curiosity, do you know the location of this bbfilter.exe file? - Reply to this email directly, view it on GitHub<#2067 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A6ZB52S7JQNMBHRTB7NMEJTZDSJCPAVCNFSM6AAAAABIDSE4WWVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TKMRRGU4DM>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>> The information contained in this electronic message is intended for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. It is intended only for the use of the individual(s) or entity named above. If the reader is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately and delete the electronic message and any associated attachments.

[sebjulliand]

Definitely not something we ship.
I did a bit of research and the only thing that seems to be related to this bbfilter binary is a basic compiler for Atari 2600 😅 https://github.com/batari-Basic/batari-Basic

[KevinS-99]

Thanks Sebastian, I’ll keep digging. If I find anything I’ll follow up on this discussion. From: Sébastien Julliand ***@***.***> Sent: Wednesday, May 22, 2024 9:22 AM To: codefori/vscode-ibmi ***@***.***> Cc: Kevin Schreur ***@***.***>; Mention ***@***.***> Subject: [EXTERNAL] Re: [codefori/vscode-ibmi] Security Issue (Discussion #2067) External Sender. Please do not click on links or open attachments from senders you do not trust. Definitely not something we ship. I did a bit of research and the only thing that seems to be related to this bbfilter binay is a basic compiler for Atari 2600 😅 https://github.com/batari-Basic/batari-Basic<https://github.com/batari-Basic/batari-Basic> — Reply to this email directly, view it on GitHub<#2067 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A6ZB52VLBU6IFCHQ26SB55TZDSLXTAVCNFSM6AAAAABIDSE4WWVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TKMRRHEYTA>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>> The information contained in this electronic message is intended for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. It is intended only for the use of the individual(s) or entity named above. If the reader is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately and delete the electronic message and any associated attachments.

[sebjulliand]

You're welcome @KevinS-99!
You may want to look at this extension: https://marketplace.visualstudio.com/items?itemName=chunkypixel.atari-dev-studio
I downloaded it and it contains that binary in the location you provided.

[KevinS-99]

I do not show that extension installed! Very odd. From: Sébastien Julliand ***@***.***> Sent: Wednesday, May 22, 2024 9:31 AM To: codefori/vscode-ibmi ***@***.***> Cc: Kevin Schreur ***@***.***>; Mention ***@***.***> Subject: [EXTERNAL] Re: [codefori/vscode-ibmi] Security Issue (Discussion #2067) External Sender. Please do not click on links or open attachments from senders you do not trust. You're welcome @KevinS-99<https://github.com/KevinS-99>! You may want to look at this extension: https://marketplace.visualstudio.com/items?itemName=chunkypixel.atari-dev-studio<https://marketplace.visualstudio.com/items?itemName=chunkypixel.atari-dev-studio> I downloaded it and it contains that binary in the location you provided. image.png (view on web)<https://github.com/codefori/vscode-ibmi/assets/11096890/27c82f2f-d324-4626-8973-aed8afeb8735> — Reply to this email directly, view it on GitHub<#2067 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/A6ZB52QOPYNG6BNUAQGFPOTZDSMZFAVCNFSM6AAAAABIDSE4WWVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4TKMRSGAZTE>. You are receiving this because you were mentioned.Message ID: ***@***.******@***.***>> The information contained in this electronic message is intended for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and exempt from disclosure under applicable law. It is intended only for the use of the individual(s) or entity named above. If the reader is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender immediately and delete the electronic message and any associated attachments.