3 ms·
I wonder if they just check that WinVerifyTrust() returns OK or if they bother to also check the cert thumbprint. Because if it's the former, it's trivial to j
by eps 10y ago
I wonder if they just check that WinVerifyTrust() returns OK or if they bother to also check the cert thumbprint.
Because if it's the former, it's trivial to just sign dll with any key and add it to the local trusted store (if needed).
- landr0id 10y agoLooks like they check to see if the cert issuer is a trusted root CA and then they check that the subject name is "Notepad++" https://github.com/notepad-plus-plus/notepad-plus-plus/commit/b869163609473f05c4f5d1d72a579b9f6af66ccd https://github.com/notepad-plus-plus/notepad-plus-plus/commi...
- eps 10y agoYeah, that's trivial to bypass on a compromised machine without touching their binaries or hijacking system APIs.
- stupidgeek314 10y agowhich is exactly what the release note said...
- deleted 10y ago[deleted]
- contravariant 10y agoTo be fair, most things are trivial to bypass on a compromised machine. In fact what would even be the point of loading arbitrary code into Notepad++ on an already compromised machine?
- joesb 10y agoThe author of Notepad++ even said it, "It doesn't prevent your original notepad++.exe from being replaced by modified notepad++.exe while the CIA is controlling your PC." If CIA is already on your compromised machine and they want to target user of Notepad++, then they would just patched Notepad++ itself.
- cxseven 10y agoAre the permissions necessary to add a key to the local trusted store significantly less powerful than the permissions necessary to modify kernel memory? For instance, can adding a key to the local trusted store allow someone to forge a windows update?