Security Concern Lurking in the Shadows of Your Favorite Text Editor: What You Need to Know About Notepad++.
If you're a regular user of Notepad++, a widely used text editor for Windows, it's essential to take notice. The update infrastructure for this application has been compromised by suspected China-state hackers who have delivered backdoored versions to select targets. Yes, you read that right - your favorite text editor may be hosting malicious code without your knowledge.
The vulnerability was discovered last June when the attackers intercepted and redirected update traffic destined for Notepad++. From there, they selectively redirected certain targeted users to malicious update servers where they received infected updates. Fortunately, Notepad++ regained control of its infrastructure in December, but not before the attack had a six-month window to wreak havoc.
The attackers used their access to install a never-before-seen payload called Chrysalis, which is essentially a custom feature-rich backdoor. According to security firm Rapid7, this tool has wide-ranging capabilities and appears to be sophisticated and permanent - not your run-of-the-mill throwaway utility.
But how did the hackers manage to get their hands on Notepad++'s update infrastructure? Independent researcher Kevin Beaumont discovered that the update process for older versions of Notepad++ was vulnerable due to insufficient update verification controls. This allowed the attackers to sit inside the ISP chain and redirect users to malicious servers, which they could only do by intercepting and changing traffic.
Beaumont's working theory, published two months prior to Monday's advisory by Notepad++, is now vindicated. It appears that the attackers used a bespoke updater known as GUP or WinGUP to inject malware into updates. The gup.exe executable would report its version in use to https://notepad-plus-plus.org/update/getDownloadUrl.php and retrieve an update URL from a file named gup.xml, which was then downloaded to the %TEMP% directory of the device.
Beaumont's advice is straightforward: run official Notepad++ updates manually from notepad-plus-plus.org. However, due to recent developments, developers now urge users to ensure they're running 8.9.1 or higher.
But that's not all - Beaumont also warns that search engines are flooded with malicious Notepad++ extensions that can infect users unknowingly. Users who want to investigate whether their devices have been targeted should refer to the indicators of compromise listed in a previously linked Rapid7 post.
The situation is a sobering reminder that even seemingly innocuous applications like text editors can harbor vulnerabilities that could be exploited by malicious actors. It's essential for users to stay vigilant and keep up-to-date with security patches - after all, Notepad++'s weaknesses are a stark reminder of the importance of robust monitoring and proper software updates.
If you're a regular user of Notepad++, a widely used text editor for Windows, it's essential to take notice. The update infrastructure for this application has been compromised by suspected China-state hackers who have delivered backdoored versions to select targets. Yes, you read that right - your favorite text editor may be hosting malicious code without your knowledge.
The vulnerability was discovered last June when the attackers intercepted and redirected update traffic destined for Notepad++. From there, they selectively redirected certain targeted users to malicious update servers where they received infected updates. Fortunately, Notepad++ regained control of its infrastructure in December, but not before the attack had a six-month window to wreak havoc.
The attackers used their access to install a never-before-seen payload called Chrysalis, which is essentially a custom feature-rich backdoor. According to security firm Rapid7, this tool has wide-ranging capabilities and appears to be sophisticated and permanent - not your run-of-the-mill throwaway utility.
But how did the hackers manage to get their hands on Notepad++'s update infrastructure? Independent researcher Kevin Beaumont discovered that the update process for older versions of Notepad++ was vulnerable due to insufficient update verification controls. This allowed the attackers to sit inside the ISP chain and redirect users to malicious servers, which they could only do by intercepting and changing traffic.
Beaumont's working theory, published two months prior to Monday's advisory by Notepad++, is now vindicated. It appears that the attackers used a bespoke updater known as GUP or WinGUP to inject malware into updates. The gup.exe executable would report its version in use to https://notepad-plus-plus.org/update/getDownloadUrl.php and retrieve an update URL from a file named gup.xml, which was then downloaded to the %TEMP% directory of the device.
Beaumont's advice is straightforward: run official Notepad++ updates manually from notepad-plus-plus.org. However, due to recent developments, developers now urge users to ensure they're running 8.9.1 or higher.
But that's not all - Beaumont also warns that search engines are flooded with malicious Notepad++ extensions that can infect users unknowingly. Users who want to investigate whether their devices have been targeted should refer to the indicators of compromise listed in a previously linked Rapid7 post.
The situation is a sobering reminder that even seemingly innocuous applications like text editors can harbor vulnerabilities that could be exploited by malicious actors. It's essential for users to stay vigilant and keep up-to-date with security patches - after all, Notepad++'s weaknesses are a stark reminder of the importance of robust monitoring and proper software updates.
they injected malware through update servers & now theres this custom backdoor called chrysalis 
it has crazy wide-ranging capabilities & is permanent too 
so basically dont download any suspicious updates from the net u should only get them frm notepad++ official site 
& make sure ur running 8.9.1 or higher lol stay safe 
. Six months is a looong time to be vulnerable, you know? And those Chrysalis backdoors sound super sneaky 
... I mean, who needs all that extra power in their text editor? 
. I mean, it's not like we can just sit back and wait for someone else to fix everything 
... we gotta take responsibility for our own security.
. I mean, they're not fancy, but at least you know they won't be compromised by some sneaky hacker 
.
)... just kidding, sorta...
... like, who wouldn't want their favorite text editor compromised? 
I mean, I've heard of people using it for all sorts of stuff from coding to writing notes, so the thought of malicious code being injected into those updates is super unsettling. And the fact that they were able to get away with it for six whole months? That's just crazy 
. And the worst part? We don't even know how many people might have fallen victim to this without realizing it 
.
. It's just not worth the risk of having malicious code lurking in the shadows 
. It's crazy to think that someone managed to sneak in malicious code into the updates without even realizing it 
.
. I mean, who has time for that? And what if you're not even aware of the risk in the first place? It's like, we need better security measures, like, yesterday 
.
. Let's all just be more vigilant and keep our software up to date, okay? 
that's like a permanent backdoor 
anyway it's good that notepad++ regained control but still be careful when updating 
anyway i'm gonna make sure to update my notepad++ ASAP and also check for any malware extensions on my search engine results 
but apparently there's some dodgy stuff going on behind the scenes 
and be extra careful when installing extensions 
. And if anyone needs me, I'll be running official Notepad++ updates manually from now on 
anyway, i'm gonna make sure to run updates manually from now on, like Beaumont said, no more relying on auto-updates. and btw, have u heard of this 'Chrysalis' payload? sounds like something outta a sci-fi movie 
. And, yeah, manually checking for updates might seem like an extra step, but trust me, it's better than being unwittingly infected by malware 
I've been using Notepad++ for ages and it never occurred to me that my fave text editor could be hacked like this 
. I guess it's good that Notepad++ has regained control of its infrastructure, but it's still super unsettling to know our trusty text editor could be hosting bad code without us knowing 
Not me, that's for sure. Anyway, I'm gonna go make sure my updates are legit and hope that the next time someone tries to hack me, they'll at least be able to figure out how to do it a bit better than these guys did.