Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ supply chain attack breakdown

securelist.com

Post reply on HN
Print view View original

81–90 of 205 posts

Re: Notepad++ supply chain attack breakdown

#81

Post by hibikir »

troad wrote: post #14
ashishb wrote: post #3

I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…

Yet we look at phones, and we see people accepting outrageous permissions for many apps: They might rely on snooping into you for ads, or anything else, and yet the apps sell, and have no problem staying in stores.

So when it's all said and done, I do not expect practical levels of actual isolation to be that great.

Re: Notepad++ supply chain attack breakdown

#82

Post by Noumenon72 »

black_knight wrote: post #42
troad wrote: post #14

Earlier quoted context omitted.

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…

I think we could get a lot further if we implement proper capability based security. Meaning that the authority to perform actions follows the objects around. I think that is how we get powerful tools and freedom, but still address the security issues and actually achieve the principle of least privilege. For FreeBSD there is capsicum, but it seems a bit inflexible to me. Would love to see more experiments on Linux a…

Seems like a bad time to bring this up when it wouldn't have helped with this attack at all.

Re: Notepad++ supply chain attack breakdown

#83

Post by rectang »

autoexec wrote: post #49
rectang wrote: post #32

Earlier quoted context omitted.

There's a subtlety that's missing here: if your threat model doesn't include the actors who can access those backdoors, then computer security isn't so bad these days. That subtlety is important because it explains how the backdoors have snuck in — most people feel safe because they are not targeted, so there's no hue and cry.

The backdoors snuck in because literally everyone is being targeted. Few people ever see the impact of that themselves or understand the chain of events that brought those impacts about.

And yet, many people perceive a difference between “getting hacked” and “not getting hacked” and believe that certain precautions materially affect whether or not they end up having to deal with a hacking event.

Are they wrong? Do gradations of vulnerability exist? Is there only one threat model, “you’re already screwed and nothing matters”?

Re: Notepad++ supply chain attack breakdown

#84

Post by Findecanor »

black_knight wrote: post #42
troad wrote: post #14

Earlier quoted context omitted.

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…

I think we could get a lot further if we implement proper capability based security. Meaning that the authority to perform actions follows the objects around. I think that is how we get powerful tools and freedom, but still address the security issues and actually achieve the principle of least privilege. For FreeBSD there is capsicum, but it seems a bit inflexible to me. Would love to see more experiments on Linux a…

FreeBSD used to have an ELF target called "CloudABI" which used Capsicum by default. Parameters to a CloudABI program were passed in a YAML file to a launcher that acquired what was in practice the program's "entitlements"/"app permissions" as capabilities that it passed to the program when it started.

I had been thinking of a way to avoid the CloudABI launcher. The entitlements would instead be in the binary object file, and only reference command-line parameters and system paths. I have also thought of an elaborate scheme with local code signing to verify that only user/admin-approved entitlements get lifted to capabilities.

However, CloudABI got discontinued in favour of WebAssembly (and I got side-tracked...)

Redox is also moving towards having capabilities mapped to fd's, somewhat like Capsicum. Their recent presentation at FOSDEM: https://fosdem.org/2026/schedule/event/KSK9RB-capability-bas...

Re: Notepad++ supply chain attack breakdown

#85

Post by troad »

hibikir wrote: post #81
troad wrote: post #14

Earlier quoted context omitted.

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…

Yet we look at phones, and we see people accepting outrageous permissions for many apps: They might rely on snooping into you for ads, or anything else, and yet the apps sell, and have no problem staying in stores. So when it's all said and done, I do not expect practical levels of actual isolation to be that great.

> Yet we look at phones, and we see people accepting outrageous permissions for many apps

The data doesn't support the suggestion that this is happening on any mass scale. When Apple made app tracking opt-in rather than opt-out in iOS 14 ("App Tracking Transparency"), 80-90% of users refused to give consent.

It does happen more when users are tricked (dare I say unlawfully defrauded?) into accepting, such as when installing Windows, when launching Edge for the first time, etc. This is why externally-imposed sandboxing is a superior model to Zuck's pinky promises.

Re: Notepad++ supply chain attack breakdown

#86

Post by kijin »

Soerensen wrote: post #34

The WinGUp updater compromise is a textbook example of why update mechanisms are such high-value targets. Attackers get code execution on machines that specifically trust the update channel. What's concerning is the 6-month window. Supply chain attacks are difficult to detect because the malicious code runs with full user permissions from a "trusted" source. Most endpoint protection isn't designed to flag software fr…

The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way.

The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia.

Microsoft Store could have changed this situation, had it been better designed and better received. Unfortunately, nobody seems to use it unless they have no other choice.

WinGet looks much better, but so far it's only for developers and power users.

Re: Notepad++ supply chain attack breakdown

#87

Post by vondur »

troad wrote: post #25
symaxian wrote: post #21

Earlier quoted context omitted.

Sand-boxing such as in Snap and Flatpak?

Notoriously not actually secure, at least in the case of Flatpak. (Can't speak to Snap) Not sure how something can be called a sandbox without the actual box part. As Siri is to AI, Flatpak is to sandboxes.

I assumed the primary feature of Flatpak was to make a “universal” package across all Linux platforms. The security side of things seems to be a secondary consideration. I assume that the security aspect is now a much higher priority.

Re: Notepad++ supply chain attack breakdown

#88

Post by wyldberry »

gruez wrote: post #52
Erlangen wrote: post #48

> Notably, the first scan of this URL on the VirusTotal platform occurred in late September, by a user from Taiwan. Could this be the attacker? The scan happened before the hack was first exposed on the forum.

You would be a dumbass to do that, because virustotal allows security researchers to see submitted samples/urls. The last thing you want to do is to draw attention to your C&C server.

It's not uncommon to use VT and other sandbox tools as a proxy indicator for if your attacks have tripped defenders and tooling.

Re: Notepad++ supply chain attack breakdown

#89

Post by kijin »

yodon wrote: post #68

Is there a "detect infection and clean it up" app from a reputable source yet (beyond the "version 8.8.8 is bad" designator)?

The only way to clean up an infected Windows system is to wipe your disk and reinstall the OS.

There are so many nooks and crannies where malware can hide, and Windows doesn't enforce any boundaries that can't be crossed with a trivial UAC dialog.

Re: Notepad++ supply chain attack breakdown

#90

Post by da_chicken »

bee_rider wrote: post #76
da_chicken wrote: post #51

Earlier quoted context omitted.

This might be a better link: https://survey.stackoverflow.co/2025/technology#1-dev-id-es It's listed as the third most popular IDE after Visual Studio Code and Visual Studio by respondents to Stack Overflow's annual survey. Interestingly, it's higher among professionals than learners. Maybe that's because learners are going to be using some of those newer AI-adjacent editors, or because learners are less likely to be…

I think the argument you made for combining vim and neovim is pretty good actually. But it seems pretty unique to those two editors (well, throw vi in there if it ever shows up on the chart), so “worst” case notepad++ would be bumped down just one spot.

No, it's not.

If vim were good enough, neovim wouldn't exist. If neovim were that much better, vim wouldn't still be as popular as it is. And if neither of them did anything worth picking up, then vi would still outrank them.

The conclusion is that they don't do the same things. They just both have the vi interface. But having a vi interface isn't particularly weird anymore. SublimeText and vscode have vi bindings. So does PyCharm/IntelliJ. So does Notepad++! Heck, so does nano! So who gets to claim those editors? Vscode is the most popular editor that supports a vi-like interface. Shouldn't that mean that vscode is the best of the "vi descendants"? Or does it mean that all these people were okay with the vi interface, but had a good reason not to make the choice they did for another editor?

Fundamentally, the issue is: Either choice matters, or popularity doesn't matter. You can't have it both ways.

Post reply on HN