Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ hijacked by state-sponsored actors

notepad-plus-plus.org

Post reply on HN
Print view View original

471–480 of 560 posts

Re: Notepad++ hijacked by state-sponsored actors

#471

Post by MisterTea »

Pet_Ant wrote: post #465
Saris wrote: post #456

I guess my habit of running a firewall and not allowing programs to access the internet unless they actually need it is helpful for stuff like this. Absolutely no reason a text editor needs internet access. I only update stuff through winget, which fetches the installer from github in a lot of cases, and changing a package requires a PR to the winget repo AFAIK. Not foolproof of course though.

Checking for updates and pulling in plug-ins. Both are valid.

It's because of issues like these that I do not agree with your statement of validity. It's also cheaper code wise to not have these contraptions.

Re: Notepad++ hijacked by state-sponsored actors

#472

Post by sunaookami »

wiseowise wrote: post #380
sunaookami wrote: post #364

Earlier quoted context omitted.

Always hiliarious when westerners think they know how life works in Russia, China, etc because they heard from it on TV.

Of course it’s all propaganda, comrade, you can openly protest against the ~~war~~ SMO. Don’t forget your Z insignia, though.

Proving me right I see.

Re: Notepad++ hijacked by state-sponsored actors

#473

Post by just_testing »

Saris wrote: post #456

I guess my habit of running a firewall and not allowing programs to access the internet unless they actually need it is helpful for stuff like this. Absolutely no reason a text editor needs internet access. I only update stuff through winget, which fetches the installer from github in a lot of cases, and changing a package requires a PR to the winget repo AFAIK. Not foolproof of course though.

Which firewall software do you use? I should probably start using firewalls in my computers as well...

Re: Notepad++ hijacked by state-sponsored actors

#474

Post by sciencejerk »

Saris wrote: post #456

I guess my habit of running a firewall and not allowing programs to access the internet unless they actually need it is helpful for stuff like this. Absolutely no reason a text editor needs internet access. I only update stuff through winget, which fetches the installer from github in a lot of cases, and changing a package requires a PR to the winget repo AFAIK. Not foolproof of course though.

LittleSnitch is great for MacOS; it is easily configured to alert you every time your machine makes ip/domain connections, which can then be accepted, denied, or rules made

Re: Notepad++ hijacked by state-sponsored actors

#475

Post by sciencejerk »

drum55 wrote: post #56
guessmyname wrote: post #37

Earlier quoted context omitted.

I don’t get it, why don’t you all—absolutely all of you reading—use Little Snitch? [1] It really doesn’t compute in my head why would any macOS user not use a network firewall like this, or similar, to block unwanted outgoing HTTP(s) requests. You can easily inspect the packet with tools like Wireshark or Burp Suite Professional (or Community) edition, or any other proxy tool, of which there are many in the macOS eco…

It’s a false sense of security, more or less. If an application wants to talk to a C2 they don’t have to make a connection at all, just proxy a connection through something already allowed, or tunnel through DNS. Those juicy cryptocurrency keys? Pop Safari with them in the URL and they’re sent to the malicious actor instantly. If you’re owned Little Snitch does nothing at all for you except give you the impression th…

This is far too cynical of a take. LittleSnitch might not save you from well-established malware on your machine, but it will certainly hamper attempts to get payloads and exploits on your machine in the first place

Re: Notepad++ hijacked by state-sponsored actors

#476

Post by sciencejerk »

scratchyone wrote: post #57
guessmyname wrote: post #37

Earlier quoted context omitted.

I don’t get it, why don’t you all—absolutely all of you reading—use Little Snitch? [1] It really doesn’t compute in my head why would any macOS user not use a network firewall like this, or similar, to block unwanted outgoing HTTP(s) requests. You can easily inspect the packet with tools like Wireshark or Burp Suite Professional (or Community) edition, or any other proxy tool, of which there are many in the macOS eco…

It wouldn't protect against this attack though. The Notepad++ update servers were hijacked. Presumably you would allow Notepad++ updates through Little Snitch so you would be equally as vulnerable.

No you wouldn't allow updates with Notepad++

Re: Notepad++ hijacked by state-sponsored actors

#477

Post by umcill »

subsistence234 wrote: post #291
LoganDark wrote: post #81

Earlier quoted context omitted.

You can't take a break from that. I have transgender friends who fear for their life every day. They don't know what is going to happen to their rights or their healthcare. I have diabetic friends who can't work and also fear for their life because losing Medicaid would mean they will stop being able to afford insulin and will die . This is what people mean when they talk about politics being important. It's not just…

[flagged]

[flagged]

Re: Notepad++ hijacked by state-sponsored actors

#478

Post by avazhi »

the_fall wrote: post #444
avazhi wrote: post #355

Earlier quoted context omitted.

> The odds may be better if you operate the way OpenSSH does: move slow, security first, architect everything to be very difficult to attack. But if you're building a text editor, it's not your mindset, and probably never will be. I mean, if you look at the Notepad++ website this developer seems just as concerned at spamming political messaging all over everything as much as he is with writing the software he's distr…

First, you're getting upset at a random person on the internet for expressing their political views. Second, your objection almost certainly has nothing to do with this attack. It targeted some specific subset of users of Notepad++, not the maintainer.

You think the developer/publisher/maintainer of software as ubiquitous as Notepad++ is some 'random person on the internet'? Or are you referring to the commenter I was replying to?

I definitely am not upset at the commenter I replied to, and while I'm definitely upset at the maker of Notepad++ I don't think he qualifies as some random person on the internet. If you publish software that security conscious people use (and certainly Notepad++ is used by tech savvy security-conscious people) then you, really by definition, aren't some random person - that's kinda the whole point. Security conscious and tech savvy people tend not to install things from random people on the internet.

Notepad++ was a trusted website/trusted developer, and they got caught with their pants down doing some truly dumb and lazy shit, and then they published a blogpost that doesn't explain much of anything. So yeah, that's pretty infuriating my friend.

Re: Notepad++ hijacked by state-sponsored actors

#479

Post by np1810 »

sciencejerk wrote: post #474
Saris wrote: post #456

I guess my habit of running a firewall and not allowing programs to access the internet unless they actually need it is helpful for stuff like this. Absolutely no reason a text editor needs internet access. I only update stuff through winget, which fetches the installer from github in a lot of cases, and changing a package requires a PR to the winget repo AFAIK. Not foolproof of course though.

LittleSnitch is great for MacOS; it is easily configured to alert you every time your machine makes ip/domain connections, which can then be accepted, denied, or rules made

> LittleSnitch is great for MacOS; it is easily configured to alert you every time your machine makes ip/domain connections, which can then be accepted, denied, or rules made

For an open-source alternative, consider checking out - Lulu [0]. It's not as feature rich nor has impressive UI like the former but gets the main work done.

[0] https://github.com/objective-see/LuLu

Re: Notepad++ hijacked by state-sponsored actors

#480

Post by Saris »

just_testing wrote: post #473
Saris wrote: post #456

I guess my habit of running a firewall and not allowing programs to access the internet unless they actually need it is helpful for stuff like this. Absolutely no reason a text editor needs internet access. I only update stuff through winget, which fetches the installer from github in a lot of cases, and changing a package requires a PR to the winget repo AFAIK. Not foolproof of course though.

Which firewall software do you use? I should probably start using firewalls in my computers as well...

I've been using Fort: https://github.com/tnodir/fort

It's the best one I found after trying a few, because it's pretty easy to use, and lets me disable notification popups which is a part that always frustrates me about other options.

Post reply on HN