they got notepad++

Quick Overview

The Notepad++ software supply chain attack, attributed to suspected China-state-sponsored hackers, involved compromising the update infrastructure to deliver backdoored versions, which could be exploited by attackers performing MITM attacks over HTTP or exploiting older versions that lacked robust signature checking.

Key Points: Suspected China-state hackers compromised the Notepad++ update infrastructure for six months to deliver backdoored versions, confirmed by reports from three organizations. The attack exploited weaknesses in older Notepad++ versions where update downloads occurred over unencrypted HTTP and lacked robust signature checking, allowing for MITM redirection. The malicious update process involved GUP/WinGUP fetching a gup.xml file that pointed to a malicious GitHub URL, downloading an NSIS installer that contained the 'Chrysalis' backdoor. The backdoor utilized a custom, reflective, and obfuscated shellcode loader called 'LogInit' and 'LogWrite' to decrypt and execute further malicious components like 'BluetoothService.exe' and 'log.dll'. Recent versions (8.8.8 and above) fixed the vulnerability by forcing downloads over HTTPS from GitHub.com, making interception much harder. The attacker's commands allowed for remote shell execution, file writing/reading, process creation, and system information gathering. The video creator also plugged their 'Low Level Academy' to teach programming fundamentals like C, Assembly, and Rust.

Context: The video discusses a significant software supply chain compromise affecting Notepad++, a widely used text editor for Windows. The compromise, initially reported by security researchers, involved attackers hijacking the update mechanism to distribute malware known as the 'Chrysalis backdoor,' which was allegedly linked to Chinese state-sponsored hacking groups.

Detailed Analysis

The video details a supply chain attack targeting Notepad++ via its update mechanism, which allowed suspected China-state hackers to distribute a backdoor called 'Chrysalis.' The attack was effective because older versions of Notepad++ used an unencrypted HTTP connection for update checks, allowing attackers to intercept traffic and redirect the download URL within the manifest file to a malicious GitHub repository. This allowed the download of an NSIS installer containing the malicious payload, 'update.exe.' The analysis, sourced from Rapid7, shows that 'update.exe' uses an NSIS installer to deploy several components, including a malicious DLL named 'log.dll' loaded via DLL sideloading by a renamed Bitdefender utility ('BluetoothService.exe'). The malware employs sophisticated techniques like custom runtime decryption routines (using XOR operations and hardcoded keys) to unpack shellcode and an API hashing subroutine to resolve necessary Windows functions dynamically, evading static analysis. The attacker's commands supported full remote control, including spawning an interactive shell via 'cmd.exe' and exfiltrating system information using commands like 'netstat' and 'tasklist.' The vulnerability was fixed in Notepad++ version 8.8.8 by forcing update downloads over HTTPS exclusively from GitHub, which is resource-intensive to compromise at scale. The speaker also promotes his 'Low Level Academy' courses on low-level programming.