20 ms·
Notepad++ V 7.3.3 – Fix CIA Hacking Notepad++ Issue
- mindbsters 10y agook
- nthcolumn 10y agoArgh, we have this all over our lan. Is there anywhere I can get a copy or the md5 of the trojan scilexer.dll? Also, - how many people just downloaded these binaries?
- thehardsphere 10y agoAre his release notes always this... upbeat?
- B0073D 10y agoI was wondering the same thing. Not sure if I've ever seen any other release notes quite that 'vulgar' either. Then again I've seen a few of Linus' emails... shrugs
- allover 10y agoSeems fairly restrained, think I'd be livid if the popularity of my project had been leveraged by The Man to screw over my users.
- hutzlibu 10y agoI don't think he allways gets notification, that the CIA uses his project to spy on people ...
- __jal 10y agoPretty sure that if I found the CIA subverting my work, I'd be just as pissed off and quite a bit saltier in my release notes.
- 1wd 10y agoNotepad++ 6.7.4 Je suis Charlie edition Notepad++ 666 Friday the 13th edition Notepad++ 6.6.4 Tiananmen June Fourth Incident Edition Notepad++ Workers' Day Edition (v6.6) The last release (v6.2.3) - End of World Edition Notepad++ 5.7 release (outside the USA)
- SyneRyder 10y agoAt first I thought you were kidding, but nope, those are all real updates. Those release notes are fun to read, it's inspiring me to write release notes with more personality.
- ruleabidinguser 10y agoItd be nice to have my own project like this
- Traubenfuchs 10y agoNPP still starts on my pc -I am kind of insulted that I am not important enough for the NSA to replace my .dll files. I mean I know I am not that important but it would have boosted my ego. Way to go NSA. Thanks for nothing.
- ProAm 10y agoYour password is hunter2, what did you expect?
- Traubenfuchs 10y agoYou have lost me there.
- probably_wrong 10y agoIt's a joke reference to an old IRC exchange [1] about passwords. [1] http://www.bash.org/?244321 http://www.bash.org/?244321
- sleet 10y agohttp://bash.org/?244321 http://bash.org/?244321
- ct0 10y agoThe message stated that after 7.3.3 it will check, you might have an earlier version. Im equally unimportant.
- notatoad 10y agoThis only means the CIA hasn't hacked you. The NSA has much more sophisticated methods, they're surely monitoring your every keystroke.
- eps 10y agoI wonder if they just check that WinVerifyTrust() returns OK or if they bother to also check the cert thumbprint. Because if it's the former, it's trivial to just sign dll with any key and add it to the local trusted store (if needed).
- landr0id 10y agoLooks like they check to see if the cert issuer is a trusted root CA and then they check that the subject name is "Notepad++" https://github.com/notepad-plus-plus/notepad-plus-plus/commit/b869163609473f05c4f5d1d72a579b9f6af66ccd https://github.com/notepad-plus-plus/notepad-plus-plus/commi...
- eps 10y agoYeah, that's trivial to bypass on a compromised machine without touching their binaries or hijacking system APIs.
- stupidgeek314 10y agowhich is exactly what the release note said...
- deleted 10y ago[deleted]
- contravariant 10y agoTo be fair, most things are trivial to bypass on a compromised machine. In fact what would even be the point of loading arbitrary code into Notepad++ on an already compromised machine?
- joesb 10y agoThe author of Notepad++ even said it, "It doesn't prevent your original notepad++.exe from being replaced by modified notepad++.exe while the CIA is controlling your PC." If CIA is already on your compromised machine and they want to target user of Notepad++, then they would just patched Notepad++ itself.
- vocatus_gate 10y agoThat was fast.
- curiousgal 10y agoHe's using Notepad++.
- benmcnelly 10y ago(¬‿¬) this guy
- stupidgeek314 10y agoit's been over 24 hours and it's a pretty trivial "fix"
- svenfaw 10y agoThat "fix" is kinda useless. But at least he admits it in the release notes.
- tgragnato 10y agoThinking that the author of a text editor should be concerned about the espionage activities of a superpower "is not how things should be". Useless, yes. Nobody thinks he should solve the problems of the world, that's just a message.
- infogulch 10y agoI suppose this could help anyone that is currently being targeted. Once they update it should be obvious that the dll is compromised. Maybe some will come out of the woodwork and show it.
- rossy 10y agoYep. > This solution only prevents from Notepad++ loading a CIA homemade DLL. It doesn't prevent your original notepad++.exe from being replaced by modified notepad++.exe while the CIA is controlling your PC. The CIA attack is an application directory attack, and the application directory is a trusted location on Windows. See: https://blogs.msdn.microsoft.com/oldnewthing/20161013-00/?p=94505 https://blogs.msdn.microsoft.com/oldnewthing/20161013-00/?p=... I guess the attack allowed them to inject code into a Notepad++ process without breaking the signature on notepad++.exe itself. There's probably some value to the CIA doing this, or they wouldn't have done it (...right?)
- kevincox 10y agoWell theoretically if you had a secure, verified boot chain this would plug a hole in it. However in practice we don't have a full signed and verified stack.
- brilliantcode 10y ago> Just like knowing the lock is useless for people who are willing to go into my house, I still shut the door and lock it every morning when I leave home. We are in a fking corrupted world, unfortunately. He fucking nailed it. This is what all of us are feeling. It's almost like, we are collectively being punished by trying to make shit more secure. It makes me dysphoric with hopelessness. I can no longer proudly claim the West is free. We are living in a surveillance state. It's going to be hard to point fingers at other authoritative regimes around the world using the same tools. I sometimes feel as if the West is a giant hypocrisy because of the double standards it upholds but relatively better than it's counterparts. Lesser evils.
- r00fus 10y agoWe don't just live in a surveillance state, it's also an oligarchy. Don't fret though - the security state has been building for a long time: http://www.huppi.com/kangaroo/CIAtimeline.html http://www.huppi.com/kangaroo/CIAtimeline.html
- Waterluvian 10y agoThe West, or the United States? I feel like many Western nations wouldn't do this crap if the Americans didn't just politically strongarm them.
- Someone1234 10y agoYou mean the West who are in the Five Eyes intelligence collective[0]? Alright, I get it, German may not be doing this and a few Nordic countries, but overall The West is waist high in this type of stuff. [0] https://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/Five_Eyes
- bigbugbag 10y agoThe west. See UKUSA agreement [1] and echelon [2] for a primer on how global surveillance[3] started mid 20th century. [1]: https://en.wikipedia.org/wiki/UKUSA_Agreement https://en.wikipedia.org/wiki/UKUSA_Agreement [2]: https://en.wikipedia.org/wiki/ECHELON https://en.wikipedia.org/wiki/ECHELON [3]: https://en.wikipedia.org/wiki/Global_surveillance https://en.wikipedia.org/wiki/Global_surveillance
- tptacek 10y agoI know it's annoying to hear this, but I'm going to keep saying it: this stuff is silly. The DLL injection stuff in the CIA leaks should embarrass the CIA. If you're calibrating your defenses based on the idea that application programs on Windows and OS X can defend against malware, you're playing to lose. Here's the rootkits track from Black Hat 2008 --- keep in mind that this is almost a decade old and that it's public work: * Deeper Door: Exploiting NIC Chipsets * A New Breed of Rootkit: The System Management Mode Rootkit * Insane Detection of Insane Rootkits * Crafting OS X Kernel Rootkits * Viral Infections on Cisco IOS * Detecting And Preventing Xen Hypervisor Subversions * Bluepilling (implementing a hypervisor rootkit) The Xen Hypervisor This is just one year's work. If you summed all of it together, you're talking ~2.5 FTEs across 7 different research projects which we will very generously assume took a full year to develop (spoiler: no, none of them did). People who can write hypervisor rootkits command a pretty decent salary, but it's not 2x the prevailing SFBA senior salary. So this is at most mid-single-digit millions worth of work. I don't know why the CIA has this team of people bumbling around with DLL injectors and AV bypasses. Maybe it's some weird turf thing they're doing against NSA? But the stuff in the CIA leaks is not the standard you need to be protecting yourself against.
- tripzilch 10y ago> I know it's annoying to hear this, but I'm going to keep saying it: this stuff is silly. The DLL injection stuff in the CIA leaks should embarrass the CIA. Are you calling Notepad++ or the CIA silly, here? If the first case (which I assume) you're comically missing the point yourself, which is a big middle finger to a hostile government agency. This is an international Open Source software, used worldwide, that has taken a stance against US politics before (export restrictions). So yeah maybe it is to embarrass the CIA, but not quite in the way you describe. By publicly releasing this "fix", they're making a noise calling out LOOK WHAT THE CIA IS DOING PEOPLE, instead of shrugging "eh, is that all, I sure hope they got better exploits from my tax money" and "gosh I wonder why whoever released all this is angry with the US or something, I bet it's cause they're biased". Now there's a public post on their site, on record, being shared everywhere that says BUGFIX BECAUSE THE CIA ACTIVELY TARGETED OUR SOFTWARE, so that people know this is no longer some "'They' could potentially do X and Y" but that it's actually happening and in this particular case "They" are the CIA. I think you understand perfectly well how this sends a very different message to a very different (broader) audience than the (admittedly much more serious) revelations at Blackhat conferences. You remember that all these serious capabilities have been around for a long time, but the public didn't really take it seriously because many people believe "they wouldn't really" or the attacks were surely theoretical or otherwise we'd hear more about it, right? Or even when the capabilities have been right there, clear as day, for a decade, to actually assume "They" are really listening on your Samsung Smart TV's microphones (or you name it), has been flat out conspiracy nut territory or at best you could say "surely they only deploy these capabilities on a very small, targeted scale, responsibly". And now they're not. We know it's happening. New proof of new scandalous breaches of privacy of individual indiscriminate members of the public comes out every other month or so. The whole world knows that the US/UK surveillance apparatus has spiralled out of control and is surveilling, spying and collecting data on everyone, everywhere. To say now, let's not make a big deal out of this because it just confirms what everybody could have known all along, is an idea that should have its motives questioned (by which I mean, you should maybe ask yourself, not that you're doing it deliberately). Does Notepad++ really believe that with this fix they've successfully defended their software against CIA (or other gov.actor) exploits? Of course not. But they do get to make a big fuss out of it. And that's important too. If the police beat you up, is that something to make a big fuss out of and try to fix and make sure they don't get away with, even if it doesn't help with them still getting away with actually shooting people dead elsewhere? You can argue about that, but I wouldn't call it "silly". Are there now people who will think "phew at least now Notepad++ is protected against CIA hacks"--well, probably, quite a few. But you're not addressing or helping those people by talking about Blackhat and hypervisor rootkits. (... and if it's the second case, "silly" is a bit of an understatement given what these people have been up to the past half century or so--it's not actually quite as funny as in the film Burn after reading)
- f4rker 10y ago"I can no longer proudly claim the West is free. We are living in a surveillance state." This has been the case for a very long time. Nothing is new under the sun - but now lots of people are seeing things for what they are.
- HalfwayToDice 10y agoCringy nonsense.
- thomastjeffery 10y agoThe problem is that it isn't only our state or other states that are surveilled. It's the entire internet.
- tastythrowaway2 10y agoThe problem is that the majority of people simply don't care.
- alephnil 10y agoIf you follow the links to from the release notes to the relevant wikileaks pages, you will find a list that also include chrome, firefox, vlc, opera, libreoffice as well as Kasparsky and McAfee antivirus and many other commonly used software packages, many of them open source. It is also the first time I have seen evidence that they also target Linux, since they have a hijacked "CMD prompt" on Linux, whatever that means. They may also have targeted Linux with the other software packages of cause. This is really scary.
- devopsproject 10y ago> Kasparsky and McAfee antivirus if you had high opinions of those programs, you have bigger problems
- alephnil 10y agoAntivirus software is likely a net negative for computer security in general. On the other hand they are without doubt used a lot, which makes them attractive targets. My point was more the length of the list of commonly used software than the quality of each item on the list.
- staunch 10y agoDoes anyone know where I can find the best summary/analysis of the CIA leaks? Is there someone I can follow on Twitter that's doing great analysis?
- sigmar 10y ago@josephfcox and @pwnallthethings have been covering the leaks well
- WillyOnWheels 10y agoI enjoy the commentary of https://twitter.com/briankrebs https://twitter.com/briankrebs and https://twitter.com/erratarob https://twitter.com/erratarob
- agumonkey 10y agoKudos for your first OSS contribution CIA.
- flukus 10y agoI win for vimscript, we can read the plugins.
- kevincox 10y agoWhen is the last time you have run a plugin audit? This is actually more secure as vim doesn't support plugin signing. (Not that this signing matters until you verify the entire stack which very few people do).
- flukus 10y agoI've never done it thoroughly,but I have looked through most plugins to get ideas on developing my own. All signing does is prove it wasn't modified, not that it's legit.
- kevincox 10y agoI'm not familiar with notepad++'s signing but I was hoping that you could somehow restrict the list of keys.
- everydaypanos 10y agoI wonder how many CIA agents pose as innocent HackerNews commenters? If this world is corrupted then spies are among us here too
- Mahn 10y agoThey don't even have to be spies; judging by the leak, which had a number of personal and informal comments, CIA employees appear to be people too. I wouldn't be surprised if those working on government malware frequent HN just like you and me.
- everydaypanos 10y agoImagine if most popular comment threads were actually actively manipulated by the CIA - sophisticated social engineering applied here too. Most popular thread here is: CIA is pathetic they just use silly tech (I miss John C. Dvorak)
- adamrezich 10y agoHe does a couple of really good podcasts that're worth checking out.
- joering2 10y agoHow can I check if my DLL is affected - I want to know..
- wila 10y agoThere's at least two ways. Right click the file scilexer.dll in your notepad folder and select properties. Then verify the certificate manually. Another way is to download the same version from the notepad++ website and compare your version with theirs. Really I wouldn't worry so much as long as you're not a CIA target they have no incentive to spent the time to deploy such a DLL on your system.
- infogulch 10y agoUpdate and run npp? Maybe copy your current dll to make sure it's not overwritten.
- Arnavion 10y agoFor v7.3.2, SHA1 for original SciLexer.dll: x86: D7F9B9FD1459EDF6B417244E14EB5D734A973914 x64: 506F6CE3F09BFD1B0A982F2E6ECCBA397FD07BC2 1. Downloaded .bin.zip and .bin.x64.zip from https://notepad-plus-plus.org/download/v7.3.2.html https://notepad-plus-plus.org/download/v7.3.2.html 2. Verified sha1 against https://notepad-plus-plus.org/repository/7.x/7.3.2/npp.7.3.2.sha1.md5.digest.txt https://notepad-plus-plus.org/repository/7.x/7.3.2/npp.7.3.2... (for posterity: E32326B860815688302DF006C37395F13E24AABD and C81E940B04BAF11DE485068D9DCA4CD5CCE0E418) 3. Extracted SciLexer.dll from zips 4. Generated sha1 of SciLexer.dll Note: The machine I tested this already had v7.3.2 installed. The hash of SciLexer.dll from my (x86) install matches the above, but independent verification is recommended over taking my word for it.
- hashflash 10y agoThis is for 7.3.3+
- Arnavion 10y ago>This is for 7.3.3+ v7.3.2 is the latest version without the cert check, and is thus the latest possibly vulnerable version.
- pryce 10y agoDon't use SHA1..
- Arnavion 10y agoYou'd rather I used MD5? Because those two are the only ones the NPP download manifest page provides.
- pryce 10y agoOf course not. But if (as in this case) we're trying to mitigate, broadly, against a threat with the resources[1] of the CIA, SHA1 should be considered completely inappropriate now, even though the recent SHA1 announcement was with respect to collisions rather than a preimage attack. Surely requesting they post SHA256 hashes is the appropriate step? [1] obviously after the leaks this specific attack is more likely to be coopted by many additional actors, but I don't think that's enough to explode my point.
- boznz 10y agoThere's a scilexer.dll in atmel studio which is based on visual studio. does anyone know if it is the same?
- Hydraulix989 10y agoYou could probably replace it with a "known safe" DLL and be just fine. SciLexer.dll is for Scintilla, which is a fancy GUI widget for code. The lexer is part of the parser that determines the things like what code to highlight, scope folding, etc.
- wila 10y agoSciLexer is also the editor control itself, not just the parser.
- 69mlgsniperdad 10y agoWow. This is huge.. Take a peek. https://wikileaks.org/ciav7p1/cms/page_17760284.html https://wikileaks.org/ciav7p1/cms/page_17760284.html
- hl5 10y agoIt's not every day you make a "fix CIA bug" commit. Kudos! lol
- truenames1 10y agoanyone else having a similar issue when updating? https://imgur.com/a/QoQsq https://imgur.com/a/QoQsq
- bagels 10y agoWhat is the actual attack vector? The leak document just lists a dll that could be replaced to do nefarious things. How are these dlls getting replaced?
- bigbugbag 10y agoMicrosoft provided backdoor into windows ?
- sytelus 10y agoIs there a real need to go at this level? Notepad++ has a 3rd party plugin model which it happily auto-updates all the time. I wonder what would it take for CIA (or any big pocketed attackers) to "buy" one of those things and push updates with their own stuff. Chrome extensions are even more merky. Many of these 3rd party popular extensions would be happy to sell their business for couple of millions dollars and let buyer push whatever they wanted.
- ManlyBread 10y agoThen you get caught once, no one ever downloads your extension ever again and you just wasted a couple of million dollars.
- shawnz 10y agoThis is a useless change. There was no issue in Notepad++. The attack involving scilexer.dll just happened to be a convenient way to inject code GIVEN you already have root access to write to the program directory. There are an endless number of other ways they could have done it in those circumstances.
- mistaken 10y agoExactly. They could replace notepad++.exe or install a rootkit or do it in a zillion other ways. I think this change was made so that already wiretapped people could detect this and to "calm" the public since the CIA is `OMG hacking into everybody's notepad, nobody is safe'.
- aleksei 10y agoIt says so right in the release notes..
- shawnz 10y agoThe release notes make some analogy about "locking your door" which is just ridiculous. This change doesn't even give the semblance of increased security. It is totally just an excuse for the author to make this politically charged changelog entry.
- nurettin 10y ago>> The DLL injection stuff in the CIA leaks should embarrass the CIA. Haha, nice try. No, it should embarrass the entire US public. CIA is not some autonomous entity, its actions directly relate to the will and wants of the US government. People are not going to stand by and clap as their text editors are wiretapped. Note: I noticed the homing behavior when using it in wine, so I switched to PSPad.
- pknerd 10y agoNow I can blame that it was CIA who wrote bad code, not Me!!
- menkaur 10y agoDude. If they are able to replace the dll, they can replace the exe and remove the checks
- mrweasel 10y agoHe writes that in the release notes: > Checking the certificate of a DLL makes it harder to hack. Note that once users’ PCs are compromised, the hackers can do anything on the PCs. This solution only prevents from Notepad++ loading a CIA homemade DLL. It doesn't prevent your original notepad++.exe from being replaced by modified notepad++.exe while the CIA is controlling your PC.