So if one were theoretically infected right now, would a Malwarebytes scan indicate as such?
If you can get Malwarebytes to scan anything. It has been such a victim of enshittification, it's not remotely as useful as it were several years ago.
Notepad++ supply chain attack breakdown
131–140 of 205 posts
Re: Notepad++ supply chain attack breakdown
#132Earlier quoted context omitted.
> When I run 'notepad dir1/file1.txt', the package should not sneakily be able to access dir2. What happens if the user presses ^O, expecting a file open dialog that could navigate to other directories? Would the dialog be somehow integrated to the OS and run with higher permissions, and then notepad is given permissions to the other directory that the user selects?
Pretty sure that’s how it works on iOS. The app can only access its own sandboxed directory. If it wants anything else, it has to use a system provided file picker that provides a security scoped url for the selected file.
Yes, UIDocumentPickerViewController is 10+ years old at this point.
There’s also a similar photos picker (PHPicker) which is especially good from 2023 on. Signal uses this for instance.
Re: Notepad++ supply chain attack breakdown
#133I use Notepad++ as a Notepad replacement. I never understood why the network connectivity is enabled by default at all. The first thing I did was to disable it as the constant nagging interrupted my flow (VS Code would do the same thing BTW). I currently have a version from 2020 I'm very happy with.
If one day, maybe in 10 or 20 years time, I feel Notepad++ lacks something and I decide to upgrade, I will do it myself, I don't need a handy helper.
Re: Notepad++ supply chain attack breakdown
#134Notepad++ is one of my favourite editors, now it is forbidden by IT and checked for on security compliance checks if still installed, thanks to this attack.
Re: Notepad++ supply chain attack breakdown
#135Earlier quoted context omitted.
Malware can't modify files in System32, but it can drop extra files in there no problem. The only way to find and clean them up is a clean install. In Linux, one could write a script that reinstalls all packages, cleans up anything that doesn't belong to an installed package, and asks you about files it's not sure about. It's easy to modify a Linux system, but just as easy to restore it to a known state.
False . Even escalated sustem32 is blocked by protected folders. The write silently fails and logs to MS Defender
Well, try again. I just managed to copy a random .exe to C:\Windows\System32 using an administrator account. I got a typical UAC dialog that most people would blindly click "Continue" on, and the copy succeeded. :)
Re: Notepad++ supply chain attack breakdown
#136I just checked, I'm on version 8.8.8. With TinyWall firewall, it has no access to the internet without my explicit say so. This is why constantly trying to be on the bleeding edge of last updates will more likely bite you in the ass than leave your system/program open to attack with some unpatched vulnerability. Look at Windows 11 updates lately. I bet most users would be gladly behind with their updates right now.
Re: Notepad++ supply chain attack breakdown
#137Re: Notepad++ supply chain attack breakdown
#138Earlier quoted context omitted.
I love and hate it at the same time, just like my browser tabs hoarding, it means I currently have 218 open documents on Notepad++ (and 96 browser tabs). I might not even need them anymore, but it's always "I'll look at them... later".
For the browser you can use something like Session Buddy. Save the session and move on secure in the knowledge that the tabs are there IF you need them. https://sessionbuddy.com/
Thanks, I use https://www.visibotech.com/search/label/FreshStart but Session Buddy looks more polished.
Re: Notepad++ supply chain attack breakdown
#139Earlier quoted context omitted.
There are always Chocolatey and Scoop.
Why wouldn't those also become a target, if they would grow to be sizable? And if they have prevention mechanisms, why can't existing supply chains be secured with similar prevention mechanisms, instead of funneling to a single package manager provider?
The supply chain for Notepad++ updates was a PHP script on a shared hosting account pointing to the URL of an executable file.
Surely someone with more resources and more sets of eyes could do better than that? AFAIK nobody has compromised Debian's APT repositories and Red Hat's RPM repositories yet.
Re: Notepad++ supply chain attack breakdown
#140Earlier quoted context omitted.
> When I run 'notepad dir1/file1.txt', the package should not sneakily be able to access dir2. What happens if the user presses ^O, expecting a file open dialog that could navigate to other directories? Would the dialog be somehow integrated to the OS and run with higher permissions, and then notepad is given permissions to the other directory that the user selects?
Pretty sure that’s how it works on iOS. The app can only access its own sandboxed directory. If it wants anything else, it has to use a system provided file picker that provides a security scoped url for the selected file.
It's also how it works on macOS and even on modern Windows if you are running sandboxed apps.