🧠 VS Code Tunnels & the Curious Case of Invisible Shells

🛰️ A Portal Opens

“When a developer tool becomes a stealthy portal for remote persistence…”

In a world where cloud meets local, developers found a magic mirror called Visual Studio Code Tunnels. This shiny new feature allowed coders to access their local environments from anywhere — no VPN, no RDP, just VS Code, a CLI incantation, and an internet connection.

But little did they know… that mirror could reflect more than just code. It could be used to summon shells, pivot networks, and plant persistence in ways that even red teamers would call sneaky.

💡 What is VS Code Tunnel?

Visual Studio Code’s tunnel feature lets you expose your local development environment to the internet securely (in theory). It’s basically remote port forwarding with extra steps:

You run: code tunnel
Your local machine opens a reverse tunnel to *.vscode.dev
You can now connect to your machine from VS Code anywhere in the world 🧳

Magical? Yes. Dangerous? Also yes.

🛠️ Weaponizing VS Code Tunnels

Imagine this: an attacker compromises a dev box or a misconfigured CI/CD pipeline runner. Instead of dropping a backdoor or setting up a RAT, they simply run:

code tunnel --accept-server-license-terms

🧬 Boom. Instant remote access via Visual Studio Code’s infrastructure.

What makes this terrifying:

No malware: It’s just VS Code, running as intended.
No firewall punch needed: It phones out to the internet.
Stealthy AF: Security teams often whitelist dev tools.
Auth optional (ish): With some manipulation, you can expose a shell without login prompts.

Now you’ve got a remote shell hosted on a dev box, behind the org’s firewall, accessible through Microsoft’s tunnel server. Spicy. 🌶️

🔎 Anatomy of the Tunnel Abuse

🧱 Initial Access

Compromise a dev machine (phish, RCE, local privilege escalation)

🔌 Establish Tunnel

code tunnel --accept-server-license-terms

Under the hood, VS Code starts a Node.js-based service that opens a tunnel to Microsoft’s servers.

You can then:

Attach to a VS Code session remotely
Open terminal access
Execute commands
Install malware or persistence in stealth

🪪 Optional: Token Hijacking

VS Code stores auth tokens in files like:

~/.vscode-server/data/Machine/settings.json

These can be exfiltrated to hijack an active tunnel session.

🔍 Detection: Watching the Portals

🌐 Network Indicators

Outbound connections to *.vscode.dev
Long-lived WebSocket sessions over ports 443 or 80

🧵 Process Activity

Look for code, code-tunnel, or node.exe with flags like --accept-server-license-terms
Monitor for code running outside of user sessions (e.g., SYSTEM or service context)

📂 Files to Watch

~/.vscode-server/
%USERPROFILE%\.vscode\

🛡️ Defense Against the Tunnel Trolls

Restrict code execution on production or sensitive endpoints
Monitor CLI invocations of code tunnel
Review allowed domains for egress traffic – do you really need vscode.dev outbound?
Token hygiene: Clear or encrypt VS Code tokens regularly
Session Alerts: Use SIEM or EDR to alert on abnormal code usage

Bonus: Set up a honeypot with code tunnel exposed and watch who comes knocking 🕵️

🧠 Final Thoughts

VS Code Tunnels are an amazing piece of engineering — for both devs and adversaries. When tools designed for productivity can double as covert access methods, it’s time for defenders to level up.

So next time you see a quiet dev box making friends with vscode.dev, ask yourself: is it just a coder working late… or a tunnel troll sneaking in? 🐾

Stay nerdy. Stay vigilant. And monitor your dev tools like they’re part of prod — because they are.

✍️ Brought to you by your caffeinated cyber-scribe who believes shell access should be earned, not gifted by your IDE.