Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ supply chain attack breakdown

securelist.com

Post reply on HN
Print view View original

191–200 of 205 posts

Re: Notepad++ supply chain attack breakdown

#191

Post by tonymet »

kijin wrote: post #178
tonymet wrote: post #170

Earlier quoted context omitted.

And you likely have protected folders and certainly s mode disabled

It's a testing box, sure, but a lot of people have the same setting, usually because of some legacy app that requires it. It does contradict your insistence that Windows would never allow such things. An exploit doesn't need to do its thing silently in order to be effective. If a security apparatus can be bypassed by tricking a user to flip a switch, it WILL be bypassed. Heck, just trying to install or update Notepad…

I'm not going to say that any OS is perfect. and it's great that you actually test Windows. most critiques I see are 1990s assessments of ACLs and memory protection.

Generally protected folders (CFA) will protect system32 , but trusted apps can make it through. e.g. explorer.exe and powershell.exe if it's run in the terminal. Untrusted apps are expected to be blocked.

My general point is that modern windows landscape has an incredible number of protections that linux systems don't. and linux has become a bigger target over the past 10+ years as well.

It's not so much to say that Windows is better, but to encourage Linux users to be more careful with their systems, and Windows users to enable those features if they turned them off in the past.

Re: Notepad++ supply chain attack breakdown

#192

Post by DANmode »

dizhn wrote: post #55
LostMyWords wrote: post #44

Earlier quoted context omitted.

Yes, but I start with the browser. What are the Notepad++ alternatives on Linux and MacOS, for those times when I have to use them?

I love a feature of notepad++ where when you have documents open and exit, it won't bother you with a save dialog and when you open it again the previous state will be there. I found that mousepad on linux can do this. For something functionality close I would look at Kate.

or notepadqq

Re: Notepad++ supply chain attack breakdown

#193

Post by acdha »

the_harpia_io wrote: post #190
acdha wrote: post #159

Earlier quoted context omitted.

> developers and users increasingly trust code they haven't personally reviewed. This has been true since we left the era where you typed the program in each time you ran it. Ken Thompson rather famously wrote about this four decades ago: https://www.cs.umass.edu/~emery/classes/cmpsci691st/readings... Sandboxing certainly helps but it’s not a panacea: for example, Notepad++ is exactly the kind of utility people would…

[flagged]

Yes and LLMs also shift the economics for writing new versus reusing code as well as generating attacks so I think we’ll see some odd variations of old bugs which can’t be widely attacked (not many copies in the world) but might be surprising to someone thinking that problem has been solved (like what happened with Cloudflare’s experimental OAuth library).

Re: Notepad++ supply chain attack breakdown

#194

Post by 3371 »

kijin wrote: post #86
Soerensen wrote: post #34

The WinGUp updater compromise is a textbook example of why update mechanisms are such high-value targets. Attackers get code execution on machines that specifically trust the update channel. What's concerning is the 6-month window. Supply chain attacks are difficult to detect because the malicious code runs with full user permissions from a "trusted" source. Most endpoint protection isn't designed to flag software fr…

The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way. The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia. Microsoft Sto…

Hey, just wanna remind people Google Play is full of crap.

Re: Notepad++ supply chain attack breakdown

#195

Post by the_harpia_io »

acdha wrote: post #193
the_harpia_io wrote: post #190

Earlier quoted context omitted.

[flagged]

Yes and LLMs also shift the economics for writing new versus reusing code as well as generating attacks so I think we’ll see some odd variations of old bugs which can’t be widely attacked (not many copies in the world) but might be surprising to someone thinking that problem has been solved (like what happened with Cloudflare’s experimental OAuth library).

[flagged]

Re: Notepad++ supply chain attack breakdown

#196

Post by araes »

ashishb wrote: post #35
troad wrote: post #14

Earlier quoted context omitted.

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…

It also has persistent permissions. Think about it from a real world perspective. I knock on your door. You invite me to sit with you in your living room. I can't easily sneak into your bed room. Further, your temporary access ends as soon as you exit my house. The same should happen with apps. When I run 'notepad dir1/file1.txt', the package should not sneakily be able to access dir2. Further, as soon as I exit the…

Attempt at real life version (starts with idea they are actually not trustworthy)

  - You invite someone to sit in your living room
    - There must have been a reason to begin with (or why invite them at all)
    - Implied (at least limited) trust of whoever was invited
  - Access enabled and information gained heavily depends on house design
    - May have to walk past many rooms to finally reach the living room
    - Significant chances to look at everything in your house
    - Already allows skilled appraiser to evaluate your theft worthiness
  - Many techniques may allow further access to your house
    - Similar to digital version (leave something behind)
      - Small digital object accessing home network
      - "Sorry, I left something, mind if I search around?"
    - Longer con (advance to next stage of "friendship" / "relationship", implied trust)
      - "We should hang out again / have a cards night / go drinking together / ect..."
      - Flattery "Such a beautiful house, I like / am a fan of , could you show it to me?"
  - Already provides a survey of your home security
    - Do you lock your doors / windows?
    - What kind / brand / style do you have?
    - Do you tend to just leave stuff open?
    - Do you have onsite cameras or other features?
    - Do you easily just let anybody into your house who asks?
    - General cleanliness and attention to security issues

  - In the case of Notepad++, they would also be offering you a free product
    - Significant utility vs alternatives
    - Free
    - Highly recommended by many other "neighbors"
  - In the case of Notepad++, they themselves are not actively malicious (or at least not known to be)
    - Single developer
    - Apparently frazzled and overworked by the experience
    - Makes updates they can, yet also support a free product for millions.
    - It doesn't really work with the friend you invite in scenario (more like they sneezed in your living room or something)

Re: Notepad++ supply chain attack breakdown

#198

Post by bdavbdav »

fjnrnfjfn wrote: post #184

The Notepad++ auto updater was quit bad * Enabled by default * No use of verification of the either the update metadata nor the update payload itself Looks like someone wanted to write an auto updater without having the knowledge to do so properly Very sad

Or the TLS cert of the update server seemingly?

Re: Notepad++ supply chain attack breakdown

#199

Post by bdavbdav »

LostMyWords wrote: post #44
kotaKat wrote: post #29

Earlier quoted context omitted.

First three things I install on any machine - 7zip, Notepad++, alternate browser.

Yes, but I start with the browser. What are the Notepad++ alternatives on Linux and MacOS, for those times when I have to use them?

VSCode in UI land, nano/vim in terminal.

Re: Notepad++ supply chain attack breakdown

#200

Post by acdha »

the_harpia_io wrote: post #195
acdha wrote: post #193

Earlier quoted context omitted.

Yes and LLMs also shift the economics for writing new versus reusing code as well as generating attacks so I think we’ll see some odd variations of old bugs which can’t be widely attacked (not many copies in the world) but might be surprising to someone thinking that problem has been solved (like what happened with Cloudflare’s experimental OAuth library).

[flagged]

That last part is really interesting to me: humans are notoriously bad at things like looking at a large block of code and recognizing that something is missing from the middle. Offensive LLMs guided by control flow analysis are probably going to do some really interesting things finding flaws in that bespoke code but I bet most companies jumping on the vibe-coding bandwagon aren’t going to invest nearly as much.
Post reply on HN