▲ 528 ▼ Notepad++ Hijacked by State-Sponsored Hackers (notepad-plus-plus.org) submitted 6 months ago by Beep@lemmus.org to c/technology@lemmy.world 91 comments fedilink hide all child comments
[–] ryannathans@aussie.zone 19 points 6 months ago (1 child) How would n++ devs know? permalink fedilink source parent hideshow 2 child comments replies: [–] Bane_Killgrind@lemmy.dbzer0.com 28 points 6 months ago (1 child) Expanding on this: the exploit was against their domain name, redirecting selected update requests away from the notepad++ servers. The software itself didn't validate that the domain actually points to notepad++ servers, and the notepad++ update servers would not see any information that would tell them what was happening. Likely they picked some specific developers with a known public IP, and only used this to inject those specific people with malware. permalink fedilink source parent hideshow 2 child comments replies: [–] isVeryLoud@lemmy.ca 15 points 6 months ago (2 children) So the solution would have been an SSL certificate check on the client side. permalink fedilink source parent hideshow 4 child comments replies: [–] Bane_Killgrind@lemmy.dbzer0.com 12 points 6 months ago (1 child) Can't tell if that would have helped which could have allowed the malicious actors to redirect some of the traffic going to https://notepad-plus-plus.org/getDownloadUrl.php to their own servers They could have just piped the binaries though the same server since they had this level of access. They would have had months to figure it out. permalink fedilink source parent hideshow 2 child comments replies: [–] isVeryLoud@lemmy.ca 11 points 6 months ago (1 child) Oof, I thought it was just a DNS hijack. If they had access to the server, it's game over regardless. permalink fedilink source parent hideshow 2 child comments replies: [–] Kissaki@feddit.org 7 points 6 months ago* (last edited 6 months ago) (1 child) It's not game over regardless if the updater checks a signature of the update installer. Then it wouldn't run an installer by someone else. permalink fedilink source parent hideshow 2 child comments replies: [–] isVeryLoud@lemmy.ca 2 points 6 months ago (1 child) That's true, assuming they didn't also put their private keys on the server permalink fedilink source parent hideshow 2 child comments replies: [–] elvith@feddit.org 6 points 6 months ago As the hoster wrote this: we immediately transferred all clients’ web hosting subscriptions from this server It looks like the binaries and the update check script were put on a simple web space. If that is the correct conclusion to draw from this excerpt, then it'd be rather strange to have the keys on that server as it's very unlikely that it was used to produce any builds. permalink fedilink source parent [–] MangoCats@feddit.it 8 points 6 months ago That's what they say they rolled out, after: "Within Notepad++ itself, WinGup (the updater) was enhanced in v8.8.9 to verify both the certificate and the signature of the downloaded installer" permalink fedilink source parent
[–] Bane_Killgrind@lemmy.dbzer0.com 28 points 6 months ago (1 child) Expanding on this: the exploit was against their domain name, redirecting selected update requests away from the notepad++ servers. The software itself didn't validate that the domain actually points to notepad++ servers, and the notepad++ update servers would not see any information that would tell them what was happening. Likely they picked some specific developers with a known public IP, and only used this to inject those specific people with malware. permalink fedilink source parent hideshow 2 child comments replies: [–] isVeryLoud@lemmy.ca 15 points 6 months ago (2 children) So the solution would have been an SSL certificate check on the client side. permalink fedilink source parent hideshow 4 child comments replies: [–] Bane_Killgrind@lemmy.dbzer0.com 12 points 6 months ago (1 child) Can't tell if that would have helped which could have allowed the malicious actors to redirect some of the traffic going to https://notepad-plus-plus.org/getDownloadUrl.php to their own servers They could have just piped the binaries though the same server since they had this level of access. They would have had months to figure it out. permalink fedilink source parent hideshow 2 child comments replies: [–] isVeryLoud@lemmy.ca 11 points 6 months ago (1 child) Oof, I thought it was just a DNS hijack. If they had access to the server, it's game over regardless. permalink fedilink source parent hideshow 2 child comments replies: [–] Kissaki@feddit.org 7 points 6 months ago* (last edited 6 months ago) (1 child) It's not game over regardless if the updater checks a signature of the update installer. Then it wouldn't run an installer by someone else. permalink fedilink source parent hideshow 2 child comments replies: [–] isVeryLoud@lemmy.ca 2 points 6 months ago (1 child) That's true, assuming they didn't also put their private keys on the server permalink fedilink source parent hideshow 2 child comments replies: [–] elvith@feddit.org 6 points 6 months ago As the hoster wrote this: we immediately transferred all clients’ web hosting subscriptions from this server It looks like the binaries and the update check script were put on a simple web space. If that is the correct conclusion to draw from this excerpt, then it'd be rather strange to have the keys on that server as it's very unlikely that it was used to produce any builds. permalink fedilink source parent [–] MangoCats@feddit.it 8 points 6 months ago That's what they say they rolled out, after: "Within Notepad++ itself, WinGup (the updater) was enhanced in v8.8.9 to verify both the certificate and the signature of the downloaded installer" permalink fedilink source parent
[–] isVeryLoud@lemmy.ca 15 points 6 months ago (2 children) So the solution would have been an SSL certificate check on the client side. permalink fedilink source parent hideshow 4 child comments replies: [–] Bane_Killgrind@lemmy.dbzer0.com 12 points 6 months ago (1 child) Can't tell if that would have helped which could have allowed the malicious actors to redirect some of the traffic going to https://notepad-plus-plus.org/getDownloadUrl.php to their own servers They could have just piped the binaries though the same server since they had this level of access. They would have had months to figure it out. permalink fedilink source parent hideshow 2 child comments replies: [–] isVeryLoud@lemmy.ca 11 points 6 months ago (1 child) Oof, I thought it was just a DNS hijack. If they had access to the server, it's game over regardless. permalink fedilink source parent hideshow 2 child comments replies: [–] Kissaki@feddit.org 7 points 6 months ago* (last edited 6 months ago) (1 child) It's not game over regardless if the updater checks a signature of the update installer. Then it wouldn't run an installer by someone else. permalink fedilink source parent hideshow 2 child comments replies: [–] isVeryLoud@lemmy.ca 2 points 6 months ago (1 child) That's true, assuming they didn't also put their private keys on the server permalink fedilink source parent hideshow 2 child comments replies: [–] elvith@feddit.org 6 points 6 months ago As the hoster wrote this: we immediately transferred all clients’ web hosting subscriptions from this server It looks like the binaries and the update check script were put on a simple web space. If that is the correct conclusion to draw from this excerpt, then it'd be rather strange to have the keys on that server as it's very unlikely that it was used to produce any builds. permalink fedilink source parent [–] MangoCats@feddit.it 8 points 6 months ago That's what they say they rolled out, after: "Within Notepad++ itself, WinGup (the updater) was enhanced in v8.8.9 to verify both the certificate and the signature of the downloaded installer" permalink fedilink source parent
[–] Bane_Killgrind@lemmy.dbzer0.com 12 points 6 months ago (1 child) Can't tell if that would have helped which could have allowed the malicious actors to redirect some of the traffic going to https://notepad-plus-plus.org/getDownloadUrl.php to their own servers They could have just piped the binaries though the same server since they had this level of access. They would have had months to figure it out. permalink fedilink source parent hideshow 2 child comments replies: [–] isVeryLoud@lemmy.ca 11 points 6 months ago (1 child) Oof, I thought it was just a DNS hijack. If they had access to the server, it's game over regardless. permalink fedilink source parent hideshow 2 child comments replies: [–] Kissaki@feddit.org 7 points 6 months ago* (last edited 6 months ago) (1 child) It's not game over regardless if the updater checks a signature of the update installer. Then it wouldn't run an installer by someone else. permalink fedilink source parent hideshow 2 child comments replies: [–] isVeryLoud@lemmy.ca 2 points 6 months ago (1 child) That's true, assuming they didn't also put their private keys on the server permalink fedilink source parent hideshow 2 child comments replies: [–] elvith@feddit.org 6 points 6 months ago As the hoster wrote this: we immediately transferred all clients’ web hosting subscriptions from this server It looks like the binaries and the update check script were put on a simple web space. If that is the correct conclusion to draw from this excerpt, then it'd be rather strange to have the keys on that server as it's very unlikely that it was used to produce any builds. permalink fedilink source parent
[–] isVeryLoud@lemmy.ca 11 points 6 months ago (1 child) Oof, I thought it was just a DNS hijack. If they had access to the server, it's game over regardless. permalink fedilink source parent hideshow 2 child comments replies: [–] Kissaki@feddit.org 7 points 6 months ago* (last edited 6 months ago) (1 child) It's not game over regardless if the updater checks a signature of the update installer. Then it wouldn't run an installer by someone else. permalink fedilink source parent hideshow 2 child comments replies: [–] isVeryLoud@lemmy.ca 2 points 6 months ago (1 child) That's true, assuming they didn't also put their private keys on the server permalink fedilink source parent hideshow 2 child comments replies: [–] elvith@feddit.org 6 points 6 months ago As the hoster wrote this: we immediately transferred all clients’ web hosting subscriptions from this server It looks like the binaries and the update check script were put on a simple web space. If that is the correct conclusion to draw from this excerpt, then it'd be rather strange to have the keys on that server as it's very unlikely that it was used to produce any builds. permalink fedilink source parent
[–] Kissaki@feddit.org 7 points 6 months ago* (last edited 6 months ago) (1 child) It's not game over regardless if the updater checks a signature of the update installer. Then it wouldn't run an installer by someone else. permalink fedilink source parent hideshow 2 child comments replies: [–] isVeryLoud@lemmy.ca 2 points 6 months ago (1 child) That's true, assuming they didn't also put their private keys on the server permalink fedilink source parent hideshow 2 child comments replies: [–] elvith@feddit.org 6 points 6 months ago As the hoster wrote this: we immediately transferred all clients’ web hosting subscriptions from this server It looks like the binaries and the update check script were put on a simple web space. If that is the correct conclusion to draw from this excerpt, then it'd be rather strange to have the keys on that server as it's very unlikely that it was used to produce any builds. permalink fedilink source parent
[–] isVeryLoud@lemmy.ca 2 points 6 months ago (1 child) That's true, assuming they didn't also put their private keys on the server permalink fedilink source parent hideshow 2 child comments replies: [–] elvith@feddit.org 6 points 6 months ago As the hoster wrote this: we immediately transferred all clients’ web hosting subscriptions from this server It looks like the binaries and the update check script were put on a simple web space. If that is the correct conclusion to draw from this excerpt, then it'd be rather strange to have the keys on that server as it's very unlikely that it was used to produce any builds. permalink fedilink source parent
[–] elvith@feddit.org 6 points 6 months ago As the hoster wrote this: we immediately transferred all clients’ web hosting subscriptions from this server It looks like the binaries and the update check script were put on a simple web space. If that is the correct conclusion to draw from this excerpt, then it'd be rather strange to have the keys on that server as it's very unlikely that it was used to produce any builds. permalink fedilink source parent
[–] MangoCats@feddit.it 8 points 6 months ago That's what they say they rolled out, after: "Within Notepad++ itself, WinGup (the updater) was enhanced in v8.8.9 to verify both the certificate and the signature of the downloaded installer" permalink fedilink source parent