Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ hijacked by state-sponsored actors

notepad-plus-plus.org

Post reply on HN
Print view View original

101–110 of 560 posts

Re: Notepad++ hijacked by state-sponsored actors

#101

Post by b65e8bee43c2ed0 »

ryandrake wrote: post #44
LoganDark wrote: post #33

Earlier quoted context omitted.

I can't help but feel there must some better venue for such messaging. When I see politics in software updates or documentation, nothing happens because I'm not looking to use the software for political activism. Maybe I tell my adblocker to remove the messaging, and carry on with my task. I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a be…

Similar comments also come up in the [now regular] "I don't want to see political articles on HN" threads, and I think the response is similar: Asking for "no politics" is itself a strong political view: One in support/service of whatever the current status quo is. Trying to set oneself apart from (or above) politics is itself political. If you're lucky enough to be one of the fortunate people on earth who are not un…

[flagged]

Re: Notepad++ hijacked by state-sponsored actors

#102

Post by firesteelrain »

adzm wrote: post #71
bakugo wrote: post #41

Earlier quoted context omitted.

So they just conveniently decided not to sign their releases right around the time they were supposedly "hacked"? Something doesn't seem right here.

Code signing certs are unfortunately expensive

$700+ at Sectigo for two years

Something of Notepad++ size might think about it now

Re: Notepad++ hijacked by state-sponsored actors

#103

Post by gruez »

getcrunk wrote: post #21

So they say at the provider level update traffic was redirected . Does this also mean their update endpoints didn’t do encryption?

It's also possible the update manifest contained an url that the updater blindly trusted, and by modifying that file you could change what got downloaded.

Re: Notepad++ hijacked by state-sponsored actors

#104

Post by tgsovlerkhgsel »

metalcrow wrote: post #65
mapontosevenths wrote: post #54

Earlier quoted context omitted.

There is more detail linked below: https://www.heise.de/en/news/Notepad-updater-installed-malwa... https://doublepulsar.com/small-numbers-of-notepad-users-repo... The TLDR is that until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which was available in the Github source code. The author enabled this by not following best practices. The "good news" is that the attacks were very targeted a…

out of curiosity, why is a self signed cert bad for this case? Can't the updater check the validity of the cert just as well regardless? Or did the attackers get access to the signing key as well?

From the Heise article:

> Until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which is available in the Github source code. This made it possible to create manipulated updates and push them onto victims, as binaries signed this way cause a warning „Unknown Publisher“

It also mentions "installing a root certificate". I suspect that it means that users who installed the root cert could check that a downloaded binary was legit but everyone else (i.e. the majority of users) were trained to blindly click through the warning.

Re: Notepad++ hijacked by state-sponsored actors

#105

Post by x_may »

tragiclos wrote: post #70

> Traffic from certain targeted users was selectively redirected to attacker-controlled served malicious update manifests. I'd be curious to know if there was any pattern as to which users were targeted, but the post doesn't go into any further detail except to say it was likely a Chinese state-sponsored group.

It might have been explicitly targeted, but they did say that there were older versions of Notepad ++ with ""insufficient update verification controls" so it might have just been there was only one subset of users actually susceptible to this.

Re: Notepad++ hijacked by state-sponsored actors

#106

Post by dymk »

b65e8bee43c2ed0 wrote: post #101
ryandrake wrote: post #44

Earlier quoted context omitted.

Similar comments also come up in the [now regular] "I don't want to see political articles on HN" threads, and I think the response is similar: Asking for "no politics" is itself a strong political view: One in support/service of whatever the current status quo is. Trying to set oneself apart from (or above) politics is itself political. If you're lucky enough to be one of the fortunate people on earth who are not un…

[flagged]

Ukraine and Taiwan are only relevant to Americans, right

Re: Notepad++ hijacked by state-sponsored actors

#107

Post by t-3 »

LoganDark wrote: post #33
icelancer wrote: post #6

Earlier quoted context omitted.

Yeah, Notepad++ is known for political messaging in their updates. Taiwan, Ukraine, etc.

I can't help but feel there must some better venue for such messaging. When I see politics in software updates or documentation, nothing happens because I'm not looking to use the software for political activism. Maybe I tell my adblocker to remove the messaging, and carry on with my task. I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a be…

Any other venue would be less effective. Many people use Notepad++, few people care about the opinions of the person who makes it. Segregating their opinion to a space where it would be ignored by anyone who wasn't already interested would barely be better than staying silent.

Re: Notepad++ hijacked by state-sponsored actors

#108

Post by kijin »

daemonhunter wrote: post #62

So what mitigations should the end user be doing? How do we know if anything compromised?

Download the latest version and install that, instead of using the auto update feature of an old version that might not properly check signatures.

As for whether anything else has been compromised, it depends on whether you were targeted. And the payload might have been tailored to each target, so there's no way to know unless you have access to the exact binary. Unfortunately, binaries downloaded through the auto update feature tend not to linger in your Downloads folder.

Re: Notepad++ hijacked by state-sponsored actors

#109

Post by 93po »

guessmyname wrote: post #37
jmole wrote: post #4

i always worry about tools like this, maintained by small teams, that are so universal that even if only a small fraction of installs are somehow co-opted by malicious actors, you have a wide open attack surface on most tech companies. e.g. iTerm, Cyberduck, editors of all shades, various VSCode extensions, etc.

I don’t get it, why don’t you all—absolutely all of you reading—use Little Snitch? [1] It really doesn’t compute in my head why would any macOS user not use a network firewall like this, or similar, to block unwanted outgoing HTTP(s) requests. You can easily inspect the packet with tools like Wireshark or Burp Suite Professional (or Community) edition, or any other proxy tool, of which there are many in the macOS eco…

because i dont want to deal with constant whitelist management and i simply don't install applications i don't trust. if there's anything really absolutely essential or damaging if it were to leak i would not put it on a internet connected device to begin with

Re: Notepad++ hijacked by state-sponsored actors

#110

Post by kemotep »

guessmyname wrote: post #68
scratchyone wrote: post #57

Earlier quoted context omitted.

It wouldn't protect against this attack though. The Notepad++ update servers were hijacked. Presumably you would allow Notepad++ updates through Little Snitch so you would be equally as vulnerable.

No, why would you allow automatic updates? It makes no sense. You should audit every update as if each payload could contain malware. It’s a paranoid way to live, but that’s what it takes. We also need better computer science education in high schools, teaching students how to inspect network packets, verify SSL certificates, and evaluate whether a binary blob might contain malicious code. People have gotten complace…

So you only run software on an operating system and on hardware that you have personally vetted each line of code for?
Post reply on HN