Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ supply chain attack breakdown

securelist.com

Post reply on HN
Print view View original

101–110 of 205 posts

Re: Notepad++ supply chain attack breakdown

#101

Post by BobbyTables2 »

troad wrote: post #14
ashishb wrote: post #3

I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…

I intensely hate that a stupid application can modify .bashrc and permanently persist itself.

Sure, in theory, SELinux could prevent this. But seems like an uphill battle if my policies conflict with the distro’s. I’d also have to “absorb” their policies’ mental model first…

Re: Notepad++ supply chain attack breakdown

#102

Post by BobbyTables2 »

lifeisgood99 wrote: post #57
ashishb wrote: post #35

Earlier quoted context omitted.

It also has persistent permissions. Think about it from a real world perspective. I knock on your door. You invite me to sit with you in your living room. I can't easily sneak into your bed room. Further, your temporary access ends as soon as you exit my house. The same should happen with apps. When I run 'notepad dir1/file1.txt', the package should not sneakily be able to access dir2. Further, as soon as I exit the…

A better example would be requiring the mailman to obtain written permission to step on your property every day. Convenience trumps maximal security for most people.

The early version of UAC in Windows did that…

Asking continuously is worse than not asking at all…

Re: Notepad++ supply chain attack breakdown

#103

Post by BobbyTables2 »

josephg wrote: post #17
taftster wrote: post #12

Earlier quoted context omitted.

I almost feel like this should just be the default action for all applications. I don't need them to escape out of a defined root. It's almost like your documents and application are effectively locked together. You have to give permissions for an app to extra data from outside of the sandbox. Linux has this capability, of course. And it seems like MacOS prompts me a lot for "such and such application wants to access…

I've been arguing for this for years. There's no reason every random binary should have unfettered, invisible access to everything on my computer as if it were me . iOS and Android both implement these security policies correctly. Why can't desktop operating systems?

And then there’s dbus…

Damn file protection not even enough…

Re: Notepad++ supply chain attack breakdown

#104

Post by iJohnDoe »

FTA - The original person posting about the unusual behavior was truly helpful.

https://community.notepad-plus-plus.org/topic/27212/autoupda...

Thankfully the responses weren’t outright dismissive, which is usually the case in these situations.

It was thought to be a local compromise and nothing to do Notepad++.

Good lessons to be learned here. Don’t be quick to dismiss things simply because it doesn’t fit what you think should be happening. That’s the whole point. It doesn’t fit, so investigate why.

Most tech support aims to prove the person wrong right out the gate.

Re: Notepad++ supply chain attack breakdown

#105

Post by josephg »

jofla_net wrote: post #72
josephg wrote: post #60

Earlier quoted context omitted.

Mobile platforms are far more secure than desktop computing software. I'd rather do internet banking on my phone than on my computer. You should too. We can make operating systems where the islands can interact. Its just needs to be opt in instead of opt out. A bad Notepad++ update shouldn't be able to invisibly read all of thunderbird's stored emails, or add backdoors to projects I'm working on or cryptolocker my do…

Both are true, and both should be allowed to exist as they serve different purposes. Sound engineers don't use lossy formats such as MP3 when making edits in preproduction work, as its intended for end users and would degrade quality cumulatively. In the same way someone working on software shouldn't be required to use an end-user consumption system when they are at work. It would be unfortunate to see the nuance mis…

I mostly agree but ...

> In the same way someone working on software shouldn't be required to use an end-user consumption system when they are at work.

I'm worried that many software developers (including me, a lot of the time) will only enable security after exhausting all other options. So long as there's a big button labeled "Developer Mode" or "Run as Admin" which turns off all the best security features, I bet lots of software will require that to be enabled in order to work.

Apple has quite impressive frameworks for application sandboxing. Do any apps use them? Do those DAWs that sound engineers use run VST plugins in a sandbox? Or do they just dyld + call? I bet most of the time its the latter. And look at this Notepad++ attack. The attack would have been stopped dead if the update process validated digital signatures. But no, it was too hard so instead they got their users' computers hacked.

I'm a pragmatist. I want a useful, secure computing environment. Show me how to do that without annoying developers and I'm all in. But I worry that the only way a proper capability model would be used would be by going all in.

Re: Notepad++ supply chain attack breakdown

#106

Post by uzerfcwn »

ashishb wrote: post #35
troad wrote: post #14

Earlier quoted context omitted.

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…

It also has persistent permissions. Think about it from a real world perspective. I knock on your door. You invite me to sit with you in your living room. I can't easily sneak into your bed room. Further, your temporary access ends as soon as you exit my house. The same should happen with apps. When I run 'notepad dir1/file1.txt', the package should not sneakily be able to access dir2. Further, as soon as I exit the…

> When I run 'notepad dir1/file1.txt', the package should not sneakily be able to access dir2.

What happens if the user presses ^O, expecting a file open dialog that could navigate to other directories? Would the dialog be somehow integrated to the OS and run with higher permissions, and then notepad is given permissions to the other directory that the user selects?

Re: Notepad++ supply chain attack breakdown

#107

Post by [deleted] »

troad wrote: post #14
ashishb wrote: post #3

I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…

[deleted]

Re: Notepad++ supply chain attack breakdown

#108

Post by Semaphor »

BobbyTables2 wrote: post #100
ashishb wrote: post #3

I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.

A sandbox in Windows? How?

https://learn.microsoft.com/en-us/windows/security/applicati...

Or the easier way with an external tool is using Sandboxie: https://sandboxie-plus.com/

Re: Notepad++ supply chain attack breakdown

#109

Post by what »

uzerfcwn wrote: post #106
ashishb wrote: post #35

Earlier quoted context omitted.

It also has persistent permissions. Think about it from a real world perspective. I knock on your door. You invite me to sit with you in your living room. I can't easily sneak into your bed room. Further, your temporary access ends as soon as you exit my house. The same should happen with apps. When I run 'notepad dir1/file1.txt', the package should not sneakily be able to access dir2. Further, as soon as I exit the…

> When I run 'notepad dir1/file1.txt', the package should not sneakily be able to access dir2. What happens if the user presses ^O, expecting a file open dialog that could navigate to other directories? Would the dialog be somehow integrated to the OS and run with higher permissions, and then notepad is given permissions to the other directory that the user selects?

Pretty sure that’s how it works on iOS. The app can only access its own sandboxed directory. If it wants anything else, it has to use a system provided file picker that provides a security scoped url for the selected file.
Post reply on HN