Notepad++ Users, You May Have Been Hacked by China

Infrastructure delivering updates for Notepad++—a wide utilized substance exertion for Windows—was compromised for six months by suspected China-state hackers who utilized their power to present backdoored versions of the app to prime targets, developers said Monday.

“I profoundly apologize to each users affected by this hijacking,” the writer of a post published to the authoritative notepad-plus-plus.org tract wrote Monday. The station said that the onslaught began past June with an “infrastructure-level compromise that allowed malicious actors to intercept and redirect update postulation destined for notepad-plus-plus.org.” The attackers, whom aggregate investigators tied to the Chinese government, past selectively redirected definite targeted users to malicious update servers wherever they received backdoored updates. Notepad++ didn’t regain power of its infrastructure until December.

The attackers utilized their entree to instal a never-before-seen payload that has been dubbed Chrysalis. Security steadfast Rapid 7 described it arsenic a “custom, feature-rich backdoor.”

“Its wide array of capabilities indicates it is simply a blase and imperishable tool, not a elemental throwaway utility,” institution researchers said.

Hands-On Keyboard Hacking

Notepad++ said that officials with the unnamed supplier hosting the update infrastructure consulted with incidental responders and recovered that it remained compromised until September 2. Even then, the attackers maintained credentials to the interior services until December 2, a capableness that allowed them to proceed redirecting selected update postulation to malicious servers. The menace histrion “specifically targeted Notepad++ domain with the extremity of exploiting insufficient update verification controls that existed successful older versions of Notepad++.” Event logs bespeak that the hackers tried to re-exploit 1 of the weaknesses aft it was fixed but that the effort failed.

According to autarkic researcher Kevin Beaumont, 3 organizations told him that devices wrong their networks that had Notepad++ installed experienced “security incidents” that “resulted successful hands connected keyboard menace actors,” meaning the hackers were capable to instrumentality nonstop power utilizing a web-based interface. All 3 of the organizations, Beaumont said, person interests successful East Asia.

The researcher explained that his suspicions were aroused erstwhile Notepad++ mentation 8.8.8 introduced bug fixes successful mid-November to “harden the Notepad++ Updater from being hijacked to present something… not Notepad++.”

The update made changes to a bespoke Notepad++ updater known arsenic GUP, oregon alternatively, WinGUP. The gup.exe executable liable reports the mentation successful usage to https://notepad-plus-plus.org/update/getDownloadUrl.php and past retrieves a URL for the update from a record named gup.xml. The record specified successful the URL is downloaded to the %TEMP% directory of the instrumentality and past executed.

Beaumont wrote:

If you tin intercept and alteration this traffic, you tin redirect the download to immoderate determination it appears by changing the URL successful the property.

This postulation is expected to beryllium implicit HTTPS, nevertheless it appears you whitethorn beryllium [able] to tamper with the postulation if you beryllium connected the ISP level and TLS intercept. In earlier versions of Notepad++, the postulation was conscionable implicit HTTP.

The downloads themselves are signed—however immoderate earlier versions of Notepad++ utilized a aforesaid signed basal cert, which is connected Github. With 8.8.7, the anterior release, this was reverted to GlobalSign. Effectively, there’s a concern wherever the download isn’t robustly checked for tampering.

Because postulation to notepad-plus-plus.org is reasonably rare, it whitethorn beryllium imaginable to beryllium wrong the ISP concatenation and redirect to a antithetic download. To bash this astatine immoderate benignant of standard requires a batch of resources.

Beaumont published his moving mentation successful December, 2 months to the time anterior to Monday’s advisory by Notepad++. Combined with the details from Notepad++, it’s present wide that the proposal was spot on.

Beaumont besides warned that hunt engines are truthful “rammed full” of advertisements pushing trojanized versions of Notepad++ that galore users are unwittingly moving them wrong their networks. A rash of malicious Notepad++ extensions lone compounds the risk.