3 ms·
> Those agencies used DLL hijacking as a convenient technique to inject code into Notepad++ From the linked posts, it was rather not convenient at all. > they
by geofft 7y ago
> Those agencies used DLL hijacking as a convenient technique to inject code into Notepad++
From the linked posts, it was rather not convenient at all.
> they could have just as easily accomplished the same thing by replacing the binary with a malicious one instead
From the linked posts, they were going via a shared downloads directory, so they could not have.
Occam's Razor implies there was actually something to the attack and it wasn't that some bored attacker took the long way around for fun.
- nemetroid 7y ago> From the linked posts, they were going via a shared downloads directory, so they could not have. Do you mean the Stack Overflow answer? That looks like original research to me. Yes, Windows will by default try loading DLLs from the current working directory, but: 1. it has lower priority than the program's own directory, and Notepad++ ships with a copy of SciLexer.dll, and more importantly: 2. Notepad++ specifically only looks for SciLexer.dll in the same directory as the executable itself: https://github.com/notepad-plus-plus/notepad-plus-plus/commit/3fa8a89e76bf523cc4ea7ea1a111cb5ec8f21d4c https://github.com/notepad-plus-plus/notepad-plus-plus/commi... > it wasn't that some bored attacker took the long way around for fun. There are other conceivable reasons for putting the hijack inside a DLL, e.g. because you're more likely to inspect the executable. But permissions wise, it was no easier than modifying the executable.