10 ms·

Just a reminder that powers agencies [0] [1] and malware have exploited dll hijacking on software as specific as Notepad++ , and also some common software used

Just a reminder that powers agencies [0] [1] and malware have exploited dll hijacking on software as specific as Notepad++ , and also some common software used by technically inclined people, so a targeted attack at Nirsoft is not so unthinkable. [0] https://stackoverflow.com/questions/43044855/explanation-how-dll-hijack-of-notepad-worked-please https://stackoverflow.com/questions/43044855/explanation-how... [1] https://www.ghacks.net/2017/03/09/notepad-7-3-3-update-fixes-cia-vulnerability/ https://www.ghacks.net/2017/03/09/notepad-7-3-3-update-fixes...

shawnz 7y ago
I think this is pretty misleading because the Notepad++ 7.3.3 update doesn't really improve the security of the product in any way. Those agencies used DLL hijacking as a convenient technique to inject code into Notepad++ but they could have just as easily accomplished the same thing by replacing the binary with a malicious one instead. The change in the 7.3.3 update was basically for political purposes only.
- geofft 7y ago
  > Those agencies used DLL hijacking as a convenient technique to inject code into Notepad++ From the linked posts, it was rather not convenient at all. > they could have just as easily accomplished the same thing by replacing the binary with a malicious one instead From the linked posts, they were going via a shared downloads directory, so they could not have. Occam's Razor implies there was actually something to the attack and it wasn't that some bored attacker took the long way around for fun.
  - nemetroid 7y ago
    > From the linked posts, they were going via a shared downloads directory, so they could not have. Do you mean the Stack Overflow answer? That looks like original research to me. Yes, Windows will by default try loading DLLs from the current working directory, but: 1. it has lower priority than the program's own directory, and Notepad++ ships with a copy of SciLexer.dll, and more importantly: 2. Notepad++ specifically only looks for SciLexer.dll in the same directory as the executable itself: https://github.com/notepad-plus-plus/notepad-plus-plus/commit/3fa8a89e76bf523cc4ea7ea1a111cb5ec8f21d4c https://github.com/notepad-plus-plus/notepad-plus-plus/commi... > it wasn't that some bored attacker took the long way around for fun. There are other conceivable reasons for putting the hijack inside a DLL, e.g. because you're more likely to inspect the executable. But permissions wise, it was no easier than modifying the executable.

shawnz 7y ago

I think this is pretty misleading because the Notepad++ 7.3.3 update doesn't really improve the security of the product in any way. Those agencies used DLL hijacking as a convenient technique to inject code into Notepad++ but they could have just as easily accomplished the same thing by replacing the binary with a malicious one instead. The change in the 7.3.3 update was basically for political purposes only.

geofft 7y ago
> Those agencies used DLL hijacking as a convenient technique to inject code into Notepad++ From the linked posts, it was rather not convenient at all. > they could have just as easily accomplished the same thing by replacing the binary with a malicious one instead From the linked posts, they were going via a shared downloads directory, so they could not have. Occam's Razor implies there was actually something to the attack and it wasn't that some bored attacker took the long way around for fun.
- nemetroid 7y ago
  > From the linked posts, they were going via a shared downloads directory, so they could not have. Do you mean the Stack Overflow answer? That looks like original research to me. Yes, Windows will by default try loading DLLs from the current working directory, but: 1. it has lower priority than the program's own directory, and Notepad++ ships with a copy of SciLexer.dll, and more importantly: 2. Notepad++ specifically only looks for SciLexer.dll in the same directory as the executable itself: https://github.com/notepad-plus-plus/notepad-plus-plus/commit/3fa8a89e76bf523cc4ea7ea1a111cb5ec8f21d4c https://github.com/notepad-plus-plus/notepad-plus-plus/commi... > it wasn't that some bored attacker took the long way around for fun. There are other conceivable reasons for putting the hijack inside a DLL, e.g. because you're more likely to inspect the executable. But permissions wise, it was no easier than modifying the executable.