7 ms·

Wow. I'd love to know more how the targeted systems were actually compromised.

N_Lens 9mo ago
Probably backdooring end user machines by pushing updates with vulnerabilities for the purpose of spying, data exfiltration & control.
dgrin91 9mo ago
Agreed. Supply chain attacks are scary. I open all sorts of secrets in NPP - did they all get leaked?
- digdigdag 9mo ago
  Depends. Are you a Chinese/Taiwanese national or diplomat who holds a strategic value to the CCP?
hsbauauvhabzb 9mo ago
And who was targeted. The current messaging is very vague.
mapontosevenths 9mo ago
There is more detail linked below: https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html https://www.heise.de/en/news/Notepad-updater-installed-malwa... https://doublepulsar.com/small-numbers-of-notepad-users-reporting-security-woes-371d7a3fd2d9 https://doublepulsar.com/small-numbers-of-notepad-users-repo... The TLDR is that until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which was available in the Github source code. The author enabled this by not following best practices. The "good news" is that the attacks were very targeted and seemed to involve hands on keyboard attacks against folks in Asia. Blaming the hosting company is kind of shady, as the author should own at least some level of the blame for this.
- metalcrow 9mo ago
  out of curiosity, why is a self signed cert bad for this case? Can't the updater check the validity of the cert just as well regardless? Or did the attackers get access to the signing key as well?
  - tgsovlerkhgsel 9mo ago
    From the Heise article: > Until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which is available in the Github source code. This made it possible to create manipulated updates and push them onto victims, as binaries signed this way cause a warning „Unknown Publisher“ It also mentions "installing a root certificate". I suspect that it means that users who installed the root cert could check that a downloaded binary was legit but everyone else (i.e. the majority of users) were trained to blindly click through the warning.
    - kevin_thibedeau 9mo ago
      Notepad++ has way too many updates for a text editor. I purposely decline most of the nags to update for precisely this reason. It is too juicy of a target and was bound to get compromised.
      - lukan 9mo ago
        Well, some people use it as a IDE, so there are more feature they need. But I am not sure if a less frequent update routine would be safer.
  - mapontosevenths 9mo ago
    It would still have been less than ideal, but he might have gotten away with it if the private key wasnt stored within the public Github repo.
- idiotsecant 9mo ago
  If the attackers did limit themselves to a small number of Asian machines they gave up an absolute goldmine. I would venture to say a lot of technical people use notepad++ at work in jobs that would be very lucrative for an attacker to exploit. I know I definitely had an 'oh shit' moment when I read this and thought about where I have notepad++ installed.

Probably backdooring end user machines by pushing updates with vulnerabilities for the purpose of spying, data exfiltration & control.

dgrin91 9mo ago

Agreed. Supply chain attacks are scary. I open all sorts of secrets in NPP - did they all get leaked?

digdigdag 9mo ago
Depends. Are you a Chinese/Taiwanese national or diplomat who holds a strategic value to the CCP?

hsbauauvhabzb 9mo ago

And who was targeted. The current messaging is very vague.

mapontosevenths 9mo ago

There is more detail linked below: https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html https://www.heise.de/en/news/Notepad-updater-installed-malwa... https://doublepulsar.com/small-numbers-of-notepad-users-reporting-security-woes-371d7a3fd2d9 https://doublepulsar.com/small-numbers-of-notepad-users-repo... The TLDR is that until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which was available in the Github source code. The author enabled this by not following best practices. The "good news" is that the attacks were very targeted and seemed to involve hands on keyboard attacks against folks in Asia. Blaming the hosting company is kind of shady, as the author should own at least some level of the blame for this.

metalcrow 9mo ago
out of curiosity, why is a self signed cert bad for this case? Can't the updater check the validity of the cert just as well regardless? Or did the attackers get access to the signing key as well?
- tgsovlerkhgsel 9mo ago
  From the Heise article: > Until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which is available in the Github source code. This made it possible to create manipulated updates and push them onto victims, as binaries signed this way cause a warning „Unknown Publisher“ It also mentions "installing a root certificate". I suspect that it means that users who installed the root cert could check that a downloaded binary was legit but everyone else (i.e. the majority of users) were trained to blindly click through the warning.
  - kevin_thibedeau 9mo ago
    Notepad++ has way too many updates for a text editor. I purposely decline most of the nags to update for precisely this reason. It is too juicy of a target and was bound to get compromised.
    - lukan 9mo ago
      Well, some people use it as a IDE, so there are more feature they need. But I am not sure if a less frequent update routine would be safer.
- mapontosevenths 9mo ago
  It would still have been less than ideal, but he might have gotten away with it if the private key wasnt stored within the public Github repo.
idiotsecant 9mo ago
If the attackers did limit themselves to a small number of Asian machines they gave up an absolute goldmine. I would venture to say a lot of technical people use notepad++ at work in jobs that would be very lucrative for an attacker to exploit. I know I definitely had an 'oh shit' moment when I read this and thought about where I have notepad++ installed.