3 ms·
Looks like they check to see if the cert issuer is a trusted root CA and then they check that the subject name is "Notepad++" https://github.com/notepad-plus-p
by landr0id 10y ago
Looks like they check to see if the cert issuer is a trusted root CA and then they check that the subject name is "Notepad++"
https://github.com/notepad-plus-plus/notepad-plus-plus/commit/b869163609473f05c4f5d1d72a579b9f6af66ccd https://github.com/notepad-plus-plus/notepad-plus-plus/commi...
- eps 10y agoYeah, that's trivial to bypass on a compromised machine without touching their binaries or hijacking system APIs.
- stupidgeek314 10y agowhich is exactly what the release note said...
- deleted 10y ago[deleted]
- contravariant 10y agoTo be fair, most things are trivial to bypass on a compromised machine. In fact what would even be the point of loading arbitrary code into Notepad++ on an already compromised machine?
- joesb 10y agoThe author of Notepad++ even said it, "It doesn't prevent your original notepad++.exe from being replaced by modified notepad++.exe while the CIA is controlling your PC." If CIA is already on your compromised machine and they want to target user of Notepad++, then they would just patched Notepad++ itself.