Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ supply chain attack breakdown

securelist.com

Post reply on HN
Print view View original

11–20 of 205 posts

Re: Notepad++ supply chain attack breakdown

#11

Post by thatfunkymunki »

Willish42 wrote: post #5

> cmd /c "whoami&&tasklist&&systeminfo&&netstat -ano" > a.txt Naive question, but isn't this relatively safe information to expose for this level of attack? I guess the idea is to find systems vulnerable to 0-day exploits and similar based on this info? Still, that seems like a lot of effort just to get this data.

it's not "just to get that data", it's to confirm level of access, check for potential other exploiters or security software, identify the machine you have access to, identify what the machine has network connectivity to, etc. The attacker then maintains the c2 channel and can then perform their actual objective with the help of the data they have obtained.

Re: Notepad++ supply chain attack breakdown

#12

Post by taftster »

ashishb wrote: post #3

I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.

I almost feel like this should just be the default action for all applications. I don't need them to escape out of a defined root. It's almost like your documents and application are effectively locked together. You have to give permissions for an app to extra data from outside of the sandbox.

Linux has this capability, of course. And it seems like MacOS prompts me a lot for "such and such application wants to access this or that". But I think it could be a lot more fine-grained, personally.

Re: Notepad++ supply chain attack breakdown

#13

Post by worksonmine »

troad wrote: post #2

It now seems to be best practice to simultaneously keep things updated (to avoid newly discovered vulnerabilities), but also not update them too much (to avoid supply chain attacks). Honestly not sure how I'm meant to action those at the same time.

Debian stable. If you need something to be on the bleeding edge install it from backports or build from source. But keep most of your system boring and stable. It has worked fine for me for years.

Re: Notepad++ supply chain attack breakdown

#14

Post by troad »

ashishb wrote: post #3

I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions.

Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution of end user applications, then it will just end up entirely centralised in one of the big tech companies, as it already is on iOS and macOS by Apple.

Re: Notepad++ supply chain attack breakdown

#15

Post by taftster »

troad wrote: post #2

It now seems to be best practice to simultaneously keep things updated (to avoid newly discovered vulnerabilities), but also not update them too much (to avoid supply chain attacks). Honestly not sure how I'm meant to action those at the same time.

In the early days, updates quite often made systems less stable, by a demonstrable margin. My dad once turned off all updates on his Windows machine, with the ensuing peril that you can imagine.

Sadly, it feels like Microsoft updates lately have trended back towards being unreliable and even user hostile. It's messed up if you update and can't boot your machine afterwards, but here we are. People are going to turn off automatic updates again.

Re: Notepad++ supply chain attack breakdown

#17

Post by josephg »

taftster wrote: post #12
ashishb wrote: post #3

I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.

I almost feel like this should just be the default action for all applications. I don't need them to escape out of a defined root. It's almost like your documents and application are effectively locked together. You have to give permissions for an app to extra data from outside of the sandbox. Linux has this capability, of course. And it seems like MacOS prompts me a lot for "such and such application wants to access…

I've been arguing for this for years. There's no reason every random binary should have unfettered, invisible access to everything on my computer as if it were me.

iOS and Android both implement these security policies correctly. Why can't desktop operating systems?

Re: Notepad++ supply chain attack breakdown

#18

Post by krater23 »

TingPing wrote: post #7
troad wrote: post #2

It now seems to be best practice to simultaneously keep things updated (to avoid newly discovered vulnerabilities), but also not update them too much (to avoid supply chain attacks). Honestly not sure how I'm meant to action those at the same time.

I feel like supply chain attacks are the much rarer situation than real world exploits but I don’t have numbers.

Supply chain attacks have impact on more systems, so it's more likely that your system is one of it. Opening a poisoned textfile that contains a exploit that attacks your text editor and fits exactly to your version is a rare event compared to automatically contacting a server to ask for a executable to execute without asking you.

Re: Notepad++ supply chain attack breakdown

#19

Post by its_magic »

troad wrote: post #14
ashishb wrote: post #3

I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…

I'm sure that will contribute to the illusion of security, but in reality the system is thoroughly backdoored on every level from the CPU on up, and everyone knows it.

There is no such thing as computer security, in general, at this point in history.

Re: Notepad++ supply chain attack breakdown

#20

Post by krater23 »

worksonmine wrote: post #13
troad wrote: post #2

It now seems to be best practice to simultaneously keep things updated (to avoid newly discovered vulnerabilities), but also not update them too much (to avoid supply chain attacks). Honestly not sure how I'm meant to action those at the same time.

Debian stable. If you need something to be on the bleeding edge install it from backports or build from source. But keep most of your system boring and stable. It has worked fine for me for years.

As long as you do regulary updates of your debian stable, you are not secured against supply chain attacks.
Post reply on HN