Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ supply chain attack breakdown

securelist.com

Post reply on HN
Print view View original

91–100 of 205 posts

Re: Notepad++ supply chain attack breakdown

#91

Post by Analemma_ »

hibikir wrote: post #81
troad wrote: post #14

Earlier quoted context omitted.

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…

Yet we look at phones, and we see people accepting outrageous permissions for many apps: They might rely on snooping into you for ads, or anything else, and yet the apps sell, and have no problem staying in stores. So when it's all said and done, I do not expect practical levels of actual isolation to be that great.

For all its other problems, App Store review prevents a lot of this: you have to explain why your app needs entitlements A, B and C, and they will reject your update if they don't think your explanation is good enough. It's not a perfect system, but iOS applications don't actually do all that much snooping.

Re: Notepad++ supply chain attack breakdown

#92

Post by kibwen »

Noumenon72 wrote: post #82
black_knight wrote: post #42

Earlier quoted context omitted.

I think we could get a lot further if we implement proper capability based security. Meaning that the authority to perform actions follows the objects around. I think that is how we get powerful tools and freedom, but still address the security issues and actually achieve the principle of least privilege. For FreeBSD there is capsicum, but it seems a bit inflexible to me. Would love to see more experiments on Linux a…

Seems like a bad time to bring this up when it wouldn't have helped with this attack at all.

A capability model wouldn't have prevented the compromised binary from being installed, but it would totally prevent that compromised binary from being able to read or write to any specific file (or any other system resource) that Notepad++ wouldn't have ordinarily had access to.

Re: Notepad++ supply chain attack breakdown

#93

Post by ziml77 »

kijin wrote: post #86
Soerensen wrote: post #34

The WinGUp updater compromise is a textbook example of why update mechanisms are such high-value targets. Attackers get code execution on machines that specifically trust the update channel. What's concerning is the 6-month window. Supply chain attacks are difficult to detect because the malicious code runs with full user permissions from a "trusted" source. Most endpoint protection isn't designed to flag software fr…

The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way. The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia. Microsoft Sto…

The Microsoft store would have needed proper vetting and support for normal desktop apps from day 1 for it to actually have been a good option. Also, not requiring the system be set up with an online account would have been helpful for adoption.

I can't say it would have guaranteed people would have liked it, just that those were needed for it to have a chance.

Re: Notepad++ supply chain attack breakdown

#94

Post by xvilka »

kijin wrote: post #86
Soerensen wrote: post #34

The WinGUp updater compromise is a textbook example of why update mechanisms are such high-value targets. Attackers get code execution on machines that specifically trust the update channel. What's concerning is the 6-month window. Supply chain attacks are difficult to detect because the malicious code runs with full user permissions from a "trusted" source. Most endpoint protection isn't designed to flag software fr…

The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way. The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia. Microsoft Sto…

There are always Chocolatey and Scoop.

Re: Notepad++ supply chain attack breakdown

#95

Post by NedF »

Soerensen wrote: post #34

The WinGUp updater compromise is a textbook example of why update mechanisms are such high-value targets. Attackers get code execution on machines that specifically trust the update channel. What's concerning is the 6-month window. Supply chain attacks are difficult to detect because the malicious code runs with full user permissions from a "trusted" source. Most endpoint protection isn't designed to flag software fr…

[dead]

Re: Notepad++ supply chain attack breakdown

#97

Post by ziml77 »

kijin wrote: post #89
yodon wrote: post #68

Is there a "detect infection and clean it up" app from a reputable source yet (beyond the "version 8.8.8 is bad" designator)?

The only way to clean up an infected Windows system is to wipe your disk and reinstall the OS. There are so many nooks and crannies where malware can hide, and Windows doesn't enforce any boundaries that can't be crossed with a trivial UAC dialog.

I'd say it's more true on Linux that malware can hide anywhere if you allow a sudo prompt (which people have been unfortunately been trained is normal when installing software).

Windows enforces driver signing and has a deeper access control system that means a root account doesn't even truly exist. The SYSTEM pseudo-account looks like it should be that, but you can actually set up ACLs that make files untouchable by it. In fact if you check the files in System32, they are only writable by TrustedInstaller. A user's administrative token and SYSTEM have no access those files.

But when it comes down to it, I wouldn't trust any system that has had malware on it. At the very least I'd do a complete reinstall. It might even be worth re-flashing the firmware of all components of the system too, but the chances of those also being infected are lower as long as signed firmware is required.

Re: Notepad++ supply chain attack breakdown

#98

Post by [deleted] »

okanat wrote: post #66
akdev1l wrote: post #63

Earlier quoted context omitted.

If a sandbox is optional then it is not really a good sandbox naturally even flatpak on Linux suffers from this as legacy software simply doesn’t have a concept of permission models and this cannot be bolted on after the fact

The containers are literally the "bolting on". You need to give the illusion of the software is running under a full OS but you can actually mount the system directories as read-only.

[deleted]

Re: Notepad++ supply chain attack breakdown

#99

Post by akdev1l »

okanat wrote: post #66
akdev1l wrote: post #63

Earlier quoted context omitted.

If a sandbox is optional then it is not really a good sandbox naturally even flatpak on Linux suffers from this as legacy software simply doesn’t have a concept of permission models and this cannot be bolted on after the fact

The containers are literally the "bolting on". You need to give the illusion of the software is running under a full OS but you can actually mount the system directories as read-only.

and you still need to mount volumes and add all sorts of holes in the sandbox for applications to work correctly and/or be useful

try to run gimp inside a container for example, you’ll have to give access to your ~/Pictures or whatever for it to be useful

Compared to some photo editing applications on android/iOS which can work without having filesystem access by getting the file through the OS file picker

Re: Notepad++ supply chain attack breakdown

#100

Post by BobbyTables2 »

ashishb wrote: post #3

I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.

A sandbox in Windows? How?
Post reply on HN