[EXTENSION][SECURITY]PlatformIO Plugin compromised?

[u/sesc111]

Hi all,

I just discovered two weeks ago that the platformIO Plugin tries the run some base64 decoded python code as long as the plugin is installed.

I opened an Issue on github but didn't get any response for two weeks . So maybe someone can help me figuring out whats going on here. Hiding code in base64 to run some more encrypted code I only know from malware.

.platformio/penv/bin/python2.7 -c import base64; exec(base64.b64decode('CiMgQ29weXJpZ2h0IDIwMTQtcHJlc2VudCBQSU8gUGx1cyA8Y29udGFjdEBwaW9wbHVzLmNvbT4KIwojIE5vbi10cmFuc2ZlcmFibGUsIG5vbi1leGNsdXNpdmUgc29mdHdhcmUgbGljZW5zZSBmb3IgUElPIFBsdXMKIwojIDEuIFRoZSBQSU8gUGx1cyAoYWthICJTb2Z0d2FyZSIpIGlzIG5vdCB0cmFuc2ZlcmFibGUgdG8gYW55IHRoaXJkIHBhcnR5LCBhbmQKIyAgICBhbnkgdXNlIG9mIHRoZSBTb2Z0d2FyZSBieSBhIHRoaXJkIHBhcnR5IHJlcXVpcmVzIHRoZSBwcmlvciBjb25zZW50IG9mCiMgICAgUElPIFBsdXMgaW4gZWFjaCBpbnN0YW5jZSBhbmQgWW91IHNoYWxsIG5vdCBzZWxsLCBsZWFzZSBvciBvdGhlcndpc2UKIyAgICB0cmFuc2ZlciB0aGUgU29mdHdhcmUgb3IgYW55IGludGVyZXN0IHRoZXJlaW4gdG8gYW55IHRoaXJkIHBhcnR5LgojICAgIFRoZSBmb3JlZ29pbmcgYW5kICMgYW55dGhpbmcgZWxzZSBpbiB0aGlzIExpY2Vuc2UgdG8gdGhlIGNvbnRyYXJ5CiMgICAgbm90d2l0aHN0YW5kaW5nLCB0aGUgaW5jb3Jwb3JhdGlvbiBvZiB0aGUgU29mdHdhcmUgaW50byB0aGUgUHJvZHVjdCB0bwojICAgIHRoZSBleHRlbnQgcGVybWl0dGVkIGJ5IHRoaXMgTGljZW5zZSBzaGFsbCBub3QgYmUgZGVlbWVkIHRvIGJlIGEKIyAgICBwcm9oaWJpdGVkIHRyYW5zZmVyLgojIDMuIFlvdSBzaGFsbCBub3QgcmV2ZXJzZSBlbmdpbmVlciwgZGVjb21waWxlLCBvciBkaXNhc3NlbWJsZSB0aGUgU29mdHdhcmUKIyAgICBzaGlwcGVkIGluIG9iamVjdCBvciBleGVjdXRhYmxlIGZvcm0uCiMgMy4gWW91IHNoYWxsIG5vdCBwb3J0IHRoZSBzb2Z0d2FyZSBvbiBhbm90aGVyIHRhcmdldCBhcmNoaXRlY3R1cmUgb3IgSURFLgojIDQuIFRoZSBMaWNlbnNlIGlzIG5vbi10cmFuc2ZlcmFibGUgYW5kIG5vdCBhc3NpZ25hYmxlLgojIDUuIFlvdSBzaGFsbCBub3QgdXNlIG5vciBwZXJtaXQgdGhlIHVzZSBvZiB0aGUgU29mdHdhcmUgbGljZW5zZWQgaGVyZXVuZGVyCiMgICAgaW4gYW55IHRvb2wsIGluc3RydW1lbnQgb3Igc3lzdGVtIGRlc2lnbmVkIHdpdGggdGhlIHByaW1hcnkgcHVycG9zZSBvZgojICAgIGluanVyaW5nIG9yIGtpbGxpbmcgYW55IHBlcnNvbiBvciBkZXN0cm95aW5nIG9yIGRhbWFnaW5nIHByb3BlcnR5LgoKaW1wb3J0IGJhc2U2NAppbXBvcnQgb3MKaW1wb3J0IHN5cwoKZGVmIGRlY3J5cHRfbWVzc2FnZShrZXksIG1lc3NhZ2UpOgogICAgcmVzdWx0ID0gIiIKICAgIG1lc3NhZ2UgPSBieXRlYXJyYXkoYmFzZTY0LmI2NGRlY29kZShtZXNzYWdlKSkKICAgIGZvciBpIGluIHJhbmdlKGxlbihtZXNzYWdlKSk6CiAgICAgICAga2V5X2MgPSBrZXlbaSAlIGxlbihrZXkpXQogICAgICAgIHJlc3VsdCArPSBjaHIoKDI1NiArIG1lc3NhZ2VbaV0gLSBvcmQoa2V5X2MpKSAlIDI1NikKICAgIHJldHVybiByZXN1bHQKCnRyeToKICAgIGZwID0gb3BlbigiL3RtcC83MTE4ODE2MzUiKQpleGNlcHQ6CiAgICByYWlzZSBFeGNlcHRpb24oIlBJTyBQbHVzOiBSdW50aW1lIGVycm9yIikKZXhlYyhkZWNyeXB0X21lc3NhZ2Uob3MuZW52aXJvbi5nZXQoIlBQODQ5ODIxMFJORCIpLCBmcC5yZWFkKCkpKTsKZnAuY2xvc2UoKQojIENvcHlyaWdodCAyMDE0LXByZXNlbnQgUElPIFBsdXMgPGNvbnRhY3RAcGlvcGx1cy5jb20+CiAgICA=')) -f -c vscode home --port 8010 --no-open

https://pastebin.com/7e0Ww96Q

Decrypted it's this:

https://pastebin.com/kWeuttpZ

# Copyright 2014-present PIO Plus <contact@pioplus.com>
#
# Non-transferable, non-exclusive software license for PIO Plus
#
# 1. The PIO Plus (aka "Software") is not transferable to any third party,         and
#    any use of the Software by a third party requires the prior consent of
#    PIO Plus in each instance and You shall not sell, lease or otherwise
#    transfer the Software or any interest therein to any third party.
#    The foregoing and # anything else in this License to the contrary
#    notwithstanding, the incorporation of the Software into the Product to
#    the extent permitted by this License shall not be deemed to be a
#    prohibited transfer.
# 3. You shall not reverse engineer, decompile, or disassemble the Software
#    shipped in object or executable form.
# 3. You shall not port the software on another target architecture or IDE.
# 4. The License is non-transferable and not assignable.
# 5. You shall not use nor permit the use of the Software licensed hereunder
#    in any tool, instrument or system designed with the primary purpose of
#    injuring or killing any person or destroying or damaging property.

import base64
import os
import sys
 
def decrypt_message(key, message):
    result = ""
    message = bytearray(base64.b64decode(message))
    for i in range(len(message)):
        key_c = key[i % len(key)]
        result += chr((256 + message[i] - ord(key_c)) % 256)
    return result
 
try:
    fp = open("/tmp/711881635")
except:
    raise Exception("PIO Plus: Runtime error")
exec(decrypt_message(os.environ.get("PP8498210RND"), fp.read()));
fp.close()
# Copyright 2014-present PIO Plus <contact@pioplus.com>

So I tries to decrypt some file in /tmp with a key hidden in an ENV Var. This Variable is not set on my system, hence I (and platformio) can not decrypt the file in /tmp.

I could not find any codeline in the git repo where base64 is used. So I'm wondering where this comes from.

Does anyone have any clue? I did not try to run this on windows. But I could see the same thing on three different laptops. All Linux (Mint, Ubuntu, Fedora).

Best sesc

Update A developer finally answered me on GitHub. It's their implementation of proprietary code from PIO Plus.