Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ supply chain attack breakdown

securelist.com

Post reply on HN
Print view View original

111–120 of 205 posts

Re: Notepad++ supply chain attack breakdown

#111

Post by expedition32 »

BobbyTables2 wrote: post #102
lifeisgood99 wrote: post #57

Earlier quoted context omitted.

A better example would be requiring the mailman to obtain written permission to step on your property every day. Convenience trumps maximal security for most people.

The early version of UAC in Windows did that… Asking continuously is worse than not asking at all…

Some of the stuff that I install is actually meant to behave like malware.

But fine lock windows down for normal users as long as I can still disable all the security. We don't need another Apple.

Re: Notepad++ supply chain attack breakdown

#112

Post by themafia »

kijin wrote: post #86
Soerensen wrote: post #34

The WinGUp updater compromise is a textbook example of why update mechanisms are such high-value targets. Attackers get code execution on machines that specifically trust the update channel. What's concerning is the 6-month window. Supply chain attacks are difficult to detect because the malicious code runs with full user permissions from a "trusted" source. Most endpoint protection isn't designed to flag software fr…

The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way. The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia. Microsoft Sto…

Do you really need the entire walled garden of the store? It's not impervious just harder to attack but due to it's scale and value it will be constantly attacked. Not a great trade.

What happened to just good old OS APIs? You could wrap the entire "secure update" process into a function call. Does Windows somehow not already have this?

Re: Notepad++ supply chain attack breakdown

#113

Post by themafia »

BobbyTables2 wrote: post #101
troad wrote: post #14

Earlier quoted context omitted.

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…

I intensely hate that a stupid application can modify .bashrc and permanently persist itself. Sure, in theory, SELinux could prevent this. But seems like an uphill battle if my policies conflict with the distro’s. I’d also have to “absorb” their policies’ mental model first…

I tend to think things like .bashrc or .zshrc are bad ideas anyways. Not that you asked but I think the simpler solution is to have those files be owned by root and not writable by the user. You're probably not modifying them that often anyways.

Re: Notepad++ supply chain attack breakdown

#114

Post by themafia »

its_magic wrote: post #19
troad wrote: post #14

Earlier quoted context omitted.

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…

I'm sure that will contribute to the illusion of security, but in reality the system is thoroughly backdoored on every level from the CPU on up, and everyone knows it. There is no such thing as computer security, in general, at this point in history.

I'm sure you're right; however, there is still a distinction between the state using my device against me and unaffiliated or foreign states using my device against me or more likely simply to generate cash for themselves.

It's still worth solving one of these problems.

Re: Notepad++ supply chain attack breakdown

#115

Post by NetMageSCW »

bigstrat2003 wrote: post #75
LostMyWords wrote: post #44

Earlier quoted context omitted.

Yes, but I start with the browser. What are the Notepad++ alternatives on Linux and MacOS, for those times when I have to use them?

Sublime Text. I think it's better than Notepad++ and is available for all computer platforms, not just Windows.

I don’t think licensed software is a valid alternative to freeware.

Re: Notepad++ supply chain attack breakdown

#116

Post by kijin »

themafia wrote: post #112
kijin wrote: post #86

Earlier quoted context omitted.

The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way. The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia. Microsoft Sto…

Do you really need the entire walled garden of the store? It's not impervious just harder to attack but due to it's scale and value it will be constantly attacked. Not a great trade. What happened to just good old OS APIs? You could wrap the entire "secure update" process into a function call. Does Windows somehow not already have this?

I'm sure updating can be done with OS APIs, though MS doesn't look like they're in any hurry to integrate even their own store with the Windows Update mechanism.

The problem is finding and installing new software. Without a well-known official repository, people end up downloading Windows apps from random websites filled with ads and five different "Download" buttons, bundled with everything from McAfee to Adobe Reader.

We should be asking how to enable adding external sources like Ubuntu PPAs (which can then be updated like the rest), not whether there should be an official repository to bootstrap the package manager in the first place. "Store" is just a typical name for such a repository, it's not mandatory.

Re: Notepad++ supply chain attack breakdown

#117

Post by tonymet »

kijin wrote: post #89
yodon wrote: post #68

Is there a "detect infection and clean it up" app from a reputable source yet (beyond the "version 8.8.8 is bad" designator)?

The only way to clean up an infected Windows system is to wipe your disk and reinstall the OS. There are so many nooks and crannies where malware can hide, and Windows doesn't enforce any boundaries that can't be crossed with a trivial UAC dialog.

This hasn’t been true for 15 years

Re: Notepad++ supply chain attack breakdown

#118

Post by kijin »

ziml77 wrote: post #97
kijin wrote: post #89

Earlier quoted context omitted.

The only way to clean up an infected Windows system is to wipe your disk and reinstall the OS. There are so many nooks and crannies where malware can hide, and Windows doesn't enforce any boundaries that can't be crossed with a trivial UAC dialog.

I'd say it's more true on Linux that malware can hide anywhere if you allow a sudo prompt (which people have been unfortunately been trained is normal when installing software). Windows enforces driver signing and has a deeper access control system that means a root account doesn't even truly exist. The SYSTEM pseudo-account looks like it should be that, but you can actually set up ACLs that make files untouchable by…

Malware can't modify files in System32, but it can drop extra files in there no problem. The only way to find and clean them up is a clean install.

In Linux, one could write a script that reinstalls all packages, cleans up anything that doesn't belong to an installed package, and asks you about files it's not sure about. It's easy to modify a Linux system, but just as easy to restore it to a known state.

Re: Notepad++ supply chain attack breakdown

#119

Post by tonymet »

ziml77 wrote: post #97
kijin wrote: post #89

Earlier quoted context omitted.

The only way to clean up an infected Windows system is to wipe your disk and reinstall the OS. There are so many nooks and crannies where malware can hide, and Windows doesn't enforce any boundaries that can't be crossed with a trivial UAC dialog.

I'd say it's more true on Linux that malware can hide anywhere if you allow a sudo prompt (which people have been unfortunately been trained is normal when installing software). Windows enforces driver signing and has a deeper access control system that means a root account doesn't even truly exist. The SYSTEM pseudo-account looks like it should be that, but you can actually set up ACLs that make files untouchable by…

not to mention secure boot kernel protection, protected folders , memory protection, real time scanning , real time behavioral scanning, signature scanning, code signing. And Windows S mode protection.

Malware and supply chain attack landscape is totally different now. Linux has many more viruses than in the past . People don’t actively scan because they are operating on a 1990s mindset

Re: Notepad++ supply chain attack breakdown

#120

Post by tonymet »

kijin wrote: post #118
ziml77 wrote: post #97

Earlier quoted context omitted.

I'd say it's more true on Linux that malware can hide anywhere if you allow a sudo prompt (which people have been unfortunately been trained is normal when installing software). Windows enforces driver signing and has a deeper access control system that means a root account doesn't even truly exist. The SYSTEM pseudo-account looks like it should be that, but you can actually set up ACLs that make files untouchable by…

Malware can't modify files in System32, but it can drop extra files in there no problem. The only way to find and clean them up is a clean install. In Linux, one could write a script that reinstalls all packages, cleans up anything that doesn't belong to an installed package, and asks you about files it's not sure about. It's easy to modify a Linux system, but just as easy to restore it to a known state.

False . Even escalated sustem32 is blocked by protected folders. The write silently fails and logs to MS Defender
Post reply on HN