Notepad++ hijacked by state-sponsored actors
299 points
1 hour ago
| 20 comments
| notepad-plus-plus.org
| HN
simlevesque
1 hour ago
[-]
reply
icelancer
1 hour ago
[-]
Yeah, Notepad++ is known for political messaging in their updates. Taiwan, Ukraine, etc.
reply
tjpnz
10 minutes ago
[-]
I wouldn't brush off Taiwan or Ukraine as "political". In both cases it's about survival, and in one it's a literal fight.
reply
MengerSponge
4 minutes ago
[-]
Bro, it's political. Political isn't synonymous with "bad" or with "propaganda". Wars are waged on many fronts, and securing economic and hardware support takes messaging.
reply
lobito25
1 hour ago
[-]
Probably the real motive.
reply
LoganDark
1 hour ago
[-]
I can't help but feel there must some better venue for such messaging.

When I see politics in software updates or documentation, nothing happens because I'm not looking to use the software for political activism. Maybe I tell my adblocker to remove the messaging, and carry on with my task.

I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a better place for activism, IMHO.

I almost always see activists using the argument that if I don't like the messaging then I'm part of the problem. Somehow I doubt that, given I don't mind messaging at all, where it's appropriate.

reply
ryandrake
1 hour ago
[-]
Similar comments also come up in the [now regular] "I don't want to see political articles on HN" threads, and I think the response is similar: Asking for "no politics" is itself a strong political view: One in support/service of whatever the current status quo is. Trying to set oneself apart from (or above) politics is itself political. If you're lucky enough to be one of the fortunate people on earth who are not under attack by political forces or who benefit from status quo politics, I'd encourage you to simply reflect on that good luck and try to ignore the "politics" that others are deeply affected by and care about.
reply
esperent
45 minutes ago
[-]
I partially agree, but as a non-US user of the English speaking internet, the issue is with specifically US politics and social issues being everywhere. It drowns out all attempts at discourse for anything else, and Americans, including people here, seem uniquely incapable of nuance in their thinking when it comes to politics.

So, while I fully agree with your stance that banning political discourse is support for the status quo, I also think that it's reasonable to ask for it to be toned down a bit, especially when the politics and social issues of one country is basically drowning out everything else.

All that said, I'm talking mostly about HN or other community forums here. The owner of Notepad++ has the right to put whatever they want into their software, and if we're discussing that here on HN then it's an occasion where discussing politics is valid.

reply
p_ing
15 minutes ago
[-]
> Similar comments also come up in the [now regular] "I don't want to see political articles on HN" threads

In the context of forums, the political threads are generally /not interesting/[0]. Political threads often devolve; they bring nothing 'new' or 'fresh' to the table, and they lead absolutely no where. It's a fart-in-the-wind situation no matter what your position is. Leave that stuff on reddit where the rest of the farts-in-the-wind go to waste. It's like watching commentators on Fox News or CNN or <insert favorite cable TV show here>. They're a large waste of time and they're often geared towards re-enforcing your side, aka echo chamber.

Now, if a thread actually evolved into real measurable action, that might actually be interesting. But that's not what happens on these forums. There's probably very few of us that see some HN thread talking about something awful happening somewhere and they take direct action, such as petitioning their government, protesting, etc. It's probably happened once or twice, but most of the farts in those threads just hang around and stink up the place.

Please stop stinking up HN.

[0] https://news.ycombinator.com/newsguidelines.html

reply
getnormality
44 minutes ago
[-]
Nah, it doesn't mean they support the status quo. It just means some political tactics are pointless, incompetent, and counterproductive.

Political opinions about how things should be don't automatically dictate the actions that should be taken in support of those opinions. I can be mad about a law or a court decision and still have the good sense to, for example, not throw red paint on a lawmaker or judge.

Some behaviors just aren't helpful, and neither being right nor being upset changes that.

reply
da_chicken
5 minutes ago
[-]
Maybe, but telling people who are speaking to their audience on the platforms that audience is voluntarily visiting that they need to shut up is even more pointless, incompetent, and counterproductive.

Notepad++ is free, open source software for which there are dozens of alternative packages of equivalent quality. The entire cost of using this software and benefiting from the work of the developer, is having to scroll past or close a few political opinions.

If the reaction, if someone vehemently dislikes this sort of thing, is to tell that developer to "just shut up and make your software" rather than to stop using that software? Then I think that's possibly the most entitled and hypocritical position that I think it's possible to have.

reply
popalchemist
11 minutes ago
[-]
It intrinsically does. Whatever stance changes nothing or prefers to change nothing is a vote for the status quo, by definition.
reply
eunos
9 minutes ago
[-]
> Asking for "no politics" is itself a strong political view

We are all Schmittian now

reply
gruez
25 minutes ago
[-]
>Similar comments also come up in the [now regular] "I don't want to see political articles on HN" threads, and I think the response is similar: Asking for "no politics" is itself a strong political view: One in support/service of whatever the current status quo is.

Before I respond to your comment, allow me first to acknowledge the following injustices happening in the world:

* war in gaza

* war in ukraine

* civil war in sudan

* civil war in yemen

* civil war in myanmar

* ethnic violence in syria

* insurgent attacks in nigeria

* insurgent attacks in congo

* attacks on protesters in Iran

...

Wait, what's that? You don't want every comment to start with some sort of land acknowledgement-esque disclaimer of all injustices happening in the world? What are you, some sort of gaza war/ukraine war/sudanese civil war/ ... sympathizer? Tens, if not hundreds of millions have been affected by the event listed above, so at the very least you can spare a thought for them before discussing about some text editor getting compromised? You might argue acknowledging the war in gaza is beating a dead horse, but do you think the median HN reader has thought about the civil war in myanmar in the past month?

reply
joejoe638
30 minutes ago
[-]
This is about being productive and weighing the overall value of things.

The politicisation of software is as harmful as requiring every research paper to be published with a political allegiance banner.

Software like most Sciences, Engineering, and, Trade is a much longer game for humanity than politics de jour.

It is easy to forget that extent of contributions from all sides of politics that has contributed to this trade, from Mohammed Algorithm to English, Russian, Chinese, and, everyone else to computing; but forgetting that and forging that for quick political hack points is a disservice to humanity.

reply
pixl97
25 minutes ago
[-]
>Software like most Sciences, Engineering, and Trade are much longer game for humanity than politics de jour.

Not really, software, like sciences and engineering must survive politics first. If humans start tossing around nukes like angry apes then those that survive may be scratching simple arithmetic with a charcoal stick on a cave wall.

reply
joejoe638
22 minutes ago
[-]
This take is completely blind to how sciences has worked throughout history of humanity and specifically post major world wars.

Additionally, it is based on a false notion that political banners in software helps in pursuing anyone let alone change political outcomes.

reply
Aeglaecia
54 minutes ago
[-]
i dont see how saying "no politics" is similar to asking "why is there political messaging literally everywhere" , do you see how conflating the two is the exact behaviour that the original commenter was trying to discuss ?
reply
idiotsecant
45 minutes ago
[-]
Choosing not to engage politically is not a neutral action. Life is politics. The world is full of people that are trying to control your life in a thousand different ways. Choosing to not engage in support or opposition to that control doesn't mean you aren't participating, it means your default position is letting them do what they want.
reply
iamnothere
13 minutes ago
[-]
Is choosing to set certain parts of one’s life apart from politics equivalent to “choosing not to engage politically?” If so then shouldn’t every action that you take be imbued with politics, including the choice of how long you brush your teeth and when, where, and how you sleep? Or are certain things exempt from the rule, but not posting on HN? If that’s the case, why does posting on HN require political engagement but not, say, your interactions with the clerk at the grocery store? Are those of us who fail to inform every person we meet about our political views choosing not to engage politically? Even if we dedicate a certain portion of our lives to political engagement?

Edit: I’ll also add that political messaging is highly contextual. What is appropriate and effective in one place may be counterproductive or actively harmful elsewhere. Format and tone actually matter if you care about your pet cause succeeding, believe it or not.

reply
davorak
19 minutes ago
[-]
> Choosing to not engage in support or opposition

I do not think it is uncommon for someone to do this, then see the side they oppose win more in elections, public perception, etc then decide to engage more and that is "why is there political messaging literally everywhere".

Since we can't remove it, the next best alternative is to participate and advocate for responsible political engagement. I think until we have some shared understanding of what responsible political engagement is we will continue to have it everywhere.

reply
Aeglaecia
16 minutes ago
[-]
the original commenter has explicitly stated willingness to engage politically , he has also stated this is not something he is willing to do when it is interrupting his seperate personal choices , concluding with an observation that others tend to conflate non-constant political will with a constant apolitical view. can you please explain how you are not conflating these two concepts ?
reply
LoganDark
1 hour ago
[-]
I don't care for the current status quo at all. The current administration has wrecked this country and completely compromised its position in the global economy potentially forever. But there is a time and a place for those arguments and activism, as well as the same for other parts of the world suffering from similar or worse issues. Like, I wouldn't be receptive to hearing about Ukraine every time I go to the grocery store. When I want to hear about it I go to the YouTube channels documenting it! They're very interesting, but I need to be in a space to receive it. Similarly there are places where I'm not specifically looking for it but where I'd be receptive because it's not immediately irrelevant to something I'm doing. Otherwise it is just noise. This is absolutely no statement about the status quo, but just how my brain works. It's also not a statement against activism in general, just about my personal opinion of it in certain places.
reply
eloisius
40 minutes ago
[-]
It’s all well and good for you if you want to be a consumer of political content when it suits you, but for a creator, the creation’s whole purpose may be a delivery mechanism for their message which may otherwise go unheard. Not saying this is necessarily what Don Ho (Notepad++) is doing, but it’s possible. Create something so good that people can’t help but use it (preferably the demographic you most want to reach, for example a country with a huge base of Windows users) and then use it as your message delivery mechanism.
reply
davorak
49 minutes ago
[-]
> Otherwise it is just noise. This is absolutely no statement about the status quo, but just how my brain works. It's also not a statement against activism in general, just about my personal opinion of it in certain places.

I considered the majority of the population to be affected by repeated messaging, messages in the background, or in other words availability bias. So the messaging be having the desired effect on society in general but not on some subset who filter it out completely.

reply
LoganDark
44 minutes ago
[-]
It has an effect on me too: it makes me begin to extra-quickly ignore any messaging of that sort. I become so tired of it that it starts actively frustrating me to see. And I bother people to take it elsewhere. This is a behavioral issue on my part, but I'm still struggling to justify to myself that they couldn't be getting more out of it by putting it somewhere more appropriate.
reply
davorak
29 minutes ago
[-]
> I become so tired of it that it starts actively frustrating me to see.

Something similar, significantly different though, happen to a friend. They started distrusting the incogni.com after seeing their advertisements over and over again. To them they saw/felt/reasoned that only an untrustworthy actor would be pushing the messaging so much and a trustworthy actor would rely more on word of mouth via their good product inspiring people to speak up about them. I had to point out that they probably saw much more of incogni's advertising due to their rate and type of media consumption and most people probably do not get that level of exposure. If incogni lowered their advertisements to hit them correctly it would not be nearly enough advertising to reach the average consumer.

I see the frustration at the repeated messaging to likely be a natural protective mechanism. Instinctively reject repeated messages is not necessarily a bad instinct since manipulative people will use repeated messaging to manipulate, but repeated message exposure does not only happen due to an attempt to manipulate.

reply
Der_Einzige
44 minutes ago
[-]
The whole reason why Notepad ++, vim, etc have to do this is because no one wants to take one for the team and protest/put their neck on the line.

I don't want to either, and indeed I really want others to do it for me. As such, I really want to see even MORE political stuff like this to hopefully create folks who will actually protest and put their neck on the line.

Similar reason why US military propaganda is good. I never EVER want to be drafted and indeed if you put a gun in my hand and military fatigues on me, I will die with a shot in the ass (because I am running away). Thankfully, we have a bunch of hardened 20-somethings "manipulated" into joining the military and protecting us so that I can be lazy.

So please ratchet up the politics and get others out so I don't have to. It's not that hard to ignore yet another plea for help. We do it every hour of every day.

reply
suprstarrd
50 minutes ago
[-]
I want to start by saying it's good that you are at least taking the time to look for this information! Stay healthily informed.

I see this as a bad analogy though: you wouldn't hear about it every time you go to the grocery store. Or, at the very least, you wouldn't stop and listen for the fifth time. You already know, and that's the point: the intention of most activism in technology (at least that I see) is to make you initially aware of it so you start to seek the information out and learn more elsewhere. (...And to give themselves good PR. We love rainbow capitalism /s)

Instagram and Twitter both get your attention during election season because they want you to be informed about how to vote. To me, that's a similar thing.

reply
NuclearPM
10 minutes ago
[-]
There’s a difference between arguing over the tax rate and ignoring fascism. At a certain point there is nothing more important than “politics”.
reply
stirfish
53 minutes ago
[-]
Sometimes when the politics deeply affects you, you just need a little break from it.
reply
LoganDark
47 minutes ago
[-]
You can't take a break from that. I have transgender friends who fear for their life every day. They don't know what is going to happen to their rights or their healthcare. I have diabetic friends who can't work and also fear for their life because losing Medicaid would mean they will stop being able to afford insulin and will die. This is what people mean when they talk about politics being important. It's not just things that don't affect you, which is what most people mean when they say they don't care about politics. As soon as something affects you, you will understand.
reply
orbisvicis
45 minutes ago
[-]
Vim is Charityware. You can use and copy it as much as you like, but you are encouraged to make a donation for needy children in Uganda. Please see |kcc| below or visit the ICCF web site, available at these URLs:

http://iccf-holland.org/ http://www.vim.org/iccf/ http://www.iccf.nl/

You can also sponsor the development of Vim. Vim sponsors can vote for features. See |sponsor|. The money goes to Uganda anyway.

reply
melagonster
11 minutes ago
[-]
Notepad++ is close to a personal project. The author can add any message he wants. Usually, he just wrote something in the updating log; most people do not read it anymore.
reply
wodenokoto
19 minutes ago
[-]
It’s an excellent venue, just like songs and movies.

Being political isn’t a hobby you attend on Tuesdays, it’s real decision that affect people’s lives every single day, sometimes with deadly consequences.

reply
nophunphil
29 minutes ago
[-]
> I can't help but feel there must some better venue for such messaging.

I would argue that this has been an effective avenue for messaging/protest. You’re responding to it on this very board - that means you’re thinking about it.

Another angle: would such free protest be allowed if the developers of Notepad++ were based in China or Russia? I seriously doubt it.

reply
iamnothere
5 minutes ago
[-]
Typically when I see such messaging in an out of place venue it nudges me slightly against both the message and the venue pushing the message. This occurs regardless of whether I agree with the message. I feel the same way as when I see an ad: this does not belong here.

I don’t think I am the only one who has this reaction. People who do this should consider if it’s actually helping their cause. If not it’s just feelgood signaling, or possibly even counterproductive.

reply
p_ing
10 minutes ago
[-]
> I would argue that this has been an effective avenue for messaging/protest. You’re responding to it on this very board - that means you’re thinking about it.

I think about a lot of things I do absolutely nothing about (or with).

Thinking about whatever messaging is here is like saying "thoughts and prayers". It means shit all nothing. The messaging was a waste of my time and your time. It was an ad for a product you'll never purchase.

reply
nophunphil
3 minutes ago
[-]
I don’t see it as a waste of my time. I am not in the habit of seeing conflicts in which innocent people die as a “waste of my time”. The idea that my time is somehow more valuable than another person’s is narcissistic.
reply
kvemkon
18 minutes ago
[-]
> would such free protest be allowed if the developers of Notepad++ were based in

- US arguing for independence of any of the States for whatever reasons?

- Spain for Catalonia?

- France for Basque?

and many more just in Europe.

https://en.wikipedia.org/wiki/List_of_active_separatist_move...

reply
nophunphil
9 minutes ago
[-]
Not pertinent. My point is more in reference to the ancestor comment with respect to Ukraine and Taiwan:

> Yeah, Notepad++ is known for political messaging in their updates. Taiwan, Ukraine, etc.

If you’re calling Ukraine in particular a “separatist movement”, I don’t think we can have a productive conversation.

reply
handedness
27 minutes ago
[-]
Whether people talk about something isn't a measure of success, it's whether it changes public sentiment.

He who politicizes everything politicizes nothing.

reply
t-3
32 minutes ago
[-]
Any other venue would be less effective. Many people use Notepad++, few people care about the opinions of the person who makes it. Segregating their opinion to a space where it would be ignored by anyone who wasn't already interested would barely be better than staying silent.
reply
icelancer
1 hour ago
[-]
I generally agree with you. But I put up with it since Notepad++ is good software. It is what it is.
reply
LoganDark
1 hour ago
[-]
Yep
reply
idiotsecant
43 minutes ago
[-]
I am just fine with people tagging their art and their craft with causes they believe in. The person behind the work is part of the work. If you didn't pay for it or contribute sweat equity you don't get to decide otherwise. Your only recourse is to not use it.
reply
popalchemist
21 minutes ago
[-]
You don't know that nothing happens. Perhaps others are more empathetic than you. Perhaps it produces change. You have literally no way to know.
reply
vkou
50 minutes ago
[-]
There's generally a better venue for a lot of messaging, but I don't get a vote in it.
reply
com2kid
20 minutes ago
[-]
Open source has always been political.

Freedom of speech is political.

The right to privacy is political.

Letting people on to the Internet without censorship is political.

Government policies that support startups are political.

Threatening to arrest teens for pirating mp3s is political.

> I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a better place for activism, IMHO.

For the people actually impacted by politics, reality rarely waits for a convenient time to interrupt.

Political reality tends to knock down doors and blow up buildings when it wants to really get someone's attention. "Don't bother me during my software updates" is a privileged position to be able to take.

reply
orsorna
1 hour ago
[-]
And this https://notepad-plus-plus.org/news/v781-free-uyghur-edition/

I distinctly remember their GH page being flooded with issues written in Chinese.

reply
nickorlow
2 minutes ago
[-]
Owner who the targets were/what the malicious binaries did. Assuming some gov related shop + sent the contents of files on the host to attackers.
reply
tragiclos
50 minutes ago
[-]
> Traffic from certain targeted users was selectively redirected to attacker-controlled served malicious update manifests.

I'd be curious to know if there was any pattern as to which users were targeted, but the post doesn't go into any further detail except to say it was likely a Chinese state-sponsored group.

reply
x_may
33 minutes ago
[-]
It might have been explicitly targeted, but they did say that there were older versions of Notepad ++ with ""insufficient update verification controls" so it might have just been there was only one subset of users actually susceptible to this.
reply
pavon
28 minutes ago
[-]
No, the additional update verification was added after this attack was discovered. All Notepad++ installations were vulnerable during the time of the hijacking campaign.
reply
jmole
1 hour ago
[-]
i always worry about tools like this, maintained by small teams, that are so universal that even if only a small fraction of installs are somehow co-opted by malicious actors, you have a wide open attack surface on most tech companies.

e.g. iTerm, Cyberduck, editors of all shades, various VSCode extensions, etc.

reply
guessmyname
1 hour ago
[-]
I don’t get it, why don’t you all—absolutely all of you reading—use Little Snitch? [1]

It really doesn’t compute in my head why would any macOS user not use a network firewall like this, or similar, to block unwanted outgoing HTTP(s) requests. You can easily inspect the packet with tools like Wireshark or Burp Suite Professional (or Community) edition, or any other proxy tool, of which there are many in the macOS ecosystem.

And this is not unique to macOS, this is all possible in Windows, Linux and any other OS.

[1] https://www.obdev.at/products/littlesnitch/index.html

reply
drum55
59 minutes ago
[-]
It’s a false sense of security, more or less. If an application wants to talk to a C2 they don’t have to make a connection at all, just proxy a connection through something already allowed, or tunnel through DNS. Those juicy cryptocurrency keys? Pop Safari with them in the URL and they’re sent to the malicious actor instantly. If you’re owned Little Snitch does nothing at all for you except give you the impression that you’re not.
reply
worthless-trash
49 minutes ago
[-]
I find it difficult to believe that there is levels of cooperation between different companies that would allow this to work.

Source. I work for a company for longer than the internet has been alive.

reply
drum55
48 minutes ago
[-]
My example is “living off the land”, safari already has access to everything, open it and use it to communicate. Needs no permissions, bypasses little snitch entirely.
reply
worthless-trash
12 minutes ago
[-]
Ah . I was thinking of non web apps.
reply
scratchyone
59 minutes ago
[-]
It wouldn't protect against this attack though. The Notepad++ update servers were hijacked. Presumably you would allow Notepad++ updates through Little Snitch so you would be equally as vulnerable.
reply
guessmyname
52 minutes ago
[-]
No, why would you allow automatic updates? It makes no sense. You should audit every update as if each payload could contain malware. It’s a paranoid way to live, but that’s what it takes.

We also need better computer science education in high schools, teaching students how to inspect network packets, verify SSL certificates, and evaluate whether a binary blob might contain malicious code.

People have gotten complacent about the internet, which is why they still get hacked, when it should be the other way around. With everything we’ve learned over the years, why are breaches more common than ever? I don’t understand why people are so careless about online security today, compared to decades ago when we were taught not to share personal information and not to trust anything on the internet.

reply
drum55
49 minutes ago
[-]
Do you go by the smell of the executable or just general vibes? Nobody has never reviewed even a tiny fraction of the software they run, closed source or open source.
reply
kemotep
30 minutes ago
[-]
So you only run software on an operating system and on hardware that you have personally vetted each line of code for?
reply
jonas21
1 hour ago
[-]
Isn't little Snitch exactly the sort of application they're worried about?
reply
3eb7988a1663
10 minutes ago
[-]
Zing!

The state of the world is such that I have started running everything inside VMs. Baseline OS install + virtual machine management and that is it. Which is still not immune, but makes me feel a lot better than core OS utilities are probably getting better vetting than nifty-utility-123 on which I depend.

reply
93po
31 minutes ago
[-]
because i dont want to deal with constant whitelist management and i simply don't install applications i don't trust. if there's anything really absolutely essential or damaging if it were to leak i would not put it on a internet connected device to begin with
reply
josho
1 hour ago
[-]
Similarly I worry about how these apps automatically update themselves. I know it can be done securely. I also doubt that these companies invest the engineering effort to do so.
reply
hsbauauvhabzb
1 hour ago
[-]
If you think large companies are somehow immune to this, you’re gonna have a bad time.
reply
Arainach
1 hour ago
[-]
It's not a matter of "immune" - larger organizations generally have more resources to allocate to things like this. That doesn't mean they get it right 100% of the time, but they are at least able to try, while small teams or volunteer projects often simply don't have the hours to spend on things like this.
reply
its_ubuntu
1 hour ago
[-]
When Microsoft's update servers get compromised and some malware is mass distributed, the entire world will come to know the meaning of pain, MS users or not. CrowdStrike will look like the good ole days.
reply
shaboinkin
21 minutes ago
[-]
Anecdotally, my company has a device driver posted on Windows Update. I inherited the project and was digging through Microsoft’s hardware dashboard trying to find information on the stability of the driver. I ended up finding that our driver was crashing rather frequently. Looking closer, the name of the driver shown was curious as it contained the name of our driver as defined in the inf file, and appended at the end was “(WeTest)”. I looked through all source code looking for a reference to this string with no avail. Eventually I googled “WeTest” and find out WeTest is something owned by Tencent. I double checked all drivers that were ever posted to the server from our account and found no reference to “WeTest” in any of the driver packages uploaded. I emailed our Microsoft contact and got no answers as to where this driver came from and why it was visible from our account. After a few months, this driver finally was removed from our dashboard and our administrator for the account had to submit government documents to Microsoft to show he worked at where he said he did. I won’t give specifics on who’s or what’s, and anyone is more than welcome to dismiss what I’m saying without evidence. But your comment, “when Microsoft’s update servers get compromised..”, made me want to share this experience. Maybe it was some terrible software bug on Microsoft’s end that managed to combine information from two different entities, but we were never given an explanation as to how this happened.
reply
marcosdumay
53 minutes ago
[-]
Hum... We keep pretending the Solar Winds scandal never happened?
reply
calvinmorrison
1 hour ago
[-]
and unlike GPL software, there is typical an army of lawyers, an expressed warranty, legal liability, etc.
reply
SoftTalker
1 hour ago
[-]
Terms of use typically disclaim all liability.
reply
thisislife2
1 hour ago
[-]
Wow. I'd love to know more how the targeted systems were actually compromised.
reply
dgrin91
1 hour ago
[-]
Agreed. Supply chain attacks are scary. I open all sorts of secrets in NPP - did they all get leaked?
reply
digdigdag
1 hour ago
[-]
Depends. Are you a Chinese/Taiwanese national or diplomat who holds a strategic value to the CCP?
reply
N_Lens
1 hour ago
[-]
Probably backdooring end user machines by pushing updates with vulnerabilities for the purpose of spying, data exfiltration & control.
reply
mapontosevenths
1 hour ago
[-]
There is more detail linked below:

https://www.heise.de/en/news/Notepad-updater-installed-malwa...

https://doublepulsar.com/small-numbers-of-notepad-users-repo...

The TLDR is that until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which was available in the Github source code. The author enabled this by not following best practices.

The "good news" is that the attacks were very targeted and seemed to involve hands on keyboard attacks against folks in Asia.

Blaming the hosting company is kind of shady, as the author should own at least some level of the blame for this.

reply
metalcrow
54 minutes ago
[-]
out of curiosity, why is a self signed cert bad for this case? Can't the updater check the validity of the cert just as well regardless? Or did the attackers get access to the signing key as well?
reply
tgsovlerkhgsel
33 minutes ago
[-]
From the Heise article:

> Until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which is available in the Github source code. This made it possible to create manipulated updates and push them onto victims, as binaries signed this way cause a warning „Unknown Publisher“

It also mentions "installing a root certificate". I suspect that it means that users who installed the root cert could check that a downloaded binary was legit but everyone else (i.e. the majority of users) were trained to blindly click through the warning.

reply
kevin_thibedeau
7 minutes ago
[-]
Notepad++ has way too many updates for a text editor. I purposely decline most of the nags to update for precisely this reason. It is too juicy of a target and was bound to get compromised.
reply
idiotsecant
38 minutes ago
[-]
If the attackers did limit themselves to a small number of Asian machines they gave up an absolute goldmine. I would venture to say a lot of technical people use notepad++ at work in jobs that would be very lucrative for an attacker to exploit. I know I definitely had an 'oh shit' moment when I read this and thought about where I have notepad++ installed.
reply
PixyMisa
20 minutes ago
[-]
If the exploit had been widespread, though, it would have been quickly discovered.
reply
hsbauauvhabzb
1 hour ago
[-]
And who was targeted. The current messaging is very vague.
reply
manapause
12 minutes ago
[-]
Not notepad++! (Opens WhatsApp) OpenClawd express my discontent across all my channels and draft an email to send to IT tomorrow morning. Also turn off the lights off and go to bed. (Somewhere in china, all the lights go out)
reply
daemonhunter
54 minutes ago
[-]
So what mitigations should the end user be doing? How do we know if anything compromised?
reply
avereveard
43 minutes ago
[-]
Right the writeup doesn't mention when it started and what versions are affected
reply
hug
41 minutes ago
[-]
> Based on both assessment, I estimate the overall compromise period spanned from June through December 2, 2025, when all attacker access was definitively terminated.

FTA.

reply
kijin
32 minutes ago
[-]
Download the latest version and install that, instead of using the auto update feature of an old version that might not properly check signatures.

As for whether anything else has been compromised, it depends on whether you were targeted. And the payload might have been tailored to each target, so there's no way to know unless you have access to the exact binary. Unfortunately, binaries downloaded through the auto update feature tend not to linger in your Downloads folder.

reply
egl2020
1 hour ago
[-]
This all fascinating, but in the end: I have notepad++; what should I do?
reply
Marsymars
1 hour ago
[-]
You’d be protected from this particular exploit if you used a package manager rather than the updater, though of course you’d still be vulnerable to the installer binary itself getting compromised.
reply
snvzz
1 hour ago
[-]
KDE's own kate is a good alternative, and available for install via chocolatey.
reply
jimbob45
1 hour ago
[-]
Gedit is an underrated alternative imo.
reply
bakugo
55 minutes ago
[-]
I don't know why that comment is being interpreted as a request for alternatives. They are clearly asking if their machine is compromised.
reply
egl2020
23 minutes ago
[-]
yes, that's my question: am I compromised? What should I do?
reply
OsrsNeedsf2P
1 hour ago
[-]
So the hosting provider was hacked? Who was their hosting provider?

This is also why update signatures should be validated against a different server; it would require hackers to control bother servers to go undetected

reply
gruez
1 hour ago
[-]
>This is also why update signatures should be validated against a different server; it would require hackers to control bother servers to go undetected

No, it should be a hardcoded key held by the developer, preferably using a HSM, and maybe with some sort of notification capability in case the key was lost. Adding a second server adds marginal security. For instance if the developer's mail was hacked, an attacker would likely be able to reset passwords for both hosting providers.

reply
cookiengineer
50 minutes ago
[-]
This was the exact same technique that was used in 2021 by Audacity's update mechanism, which also redirected traffic to servers hosted in other Aezala ASNs and planted a dropper for later campaigns.

When I forked Audacity, within less than 48h my life turned to absolute shit. Defamation campaigns, people trying to kill me, people killing my friends, people stalking me with Austrian and Swiss license plates etc. When I investigated it further, it turns out I stumbled upon the FSB/SVR branch of the former Mirai botnet, who used Audacity to spread into larger networks.

If the Notepad++ devs see this, please check your opsec and the opsec of your loved ones.

Stay safe, and don't underestimate the Chinese Ministry of Security! They're operating in the EU, too.

PS: If you need help with this, contact me.

reply
Jordan-117
48 minutes ago
[-]
Have you written about this experience elsewhere? That sounds absolutely nuts.
reply
suprstarrd
42 minutes ago
[-]
I vaguely remember this happening with somebody on an Audacity project, so jumping in! I believe this was on a GitHub issue for that project, but the project has since disabled issues for the repository since they moved source locations. It also definitely hit some press.
reply
cookiengineer
38 minutes ago
[-]
If you are curious, some /pol/ and 4chan archives still have some stuff about the sneedacity incident available. There's still someone (a bot?) trying to recruit them to post shit about me from time to time.
reply
idiotsecant
37 minutes ago
[-]
Someone tried to kill you?! People actually killed your friends? Not sure if schizophrenia or actual story ... I desperately need to hear more of this story.
reply
cookiengineer
26 minutes ago
[-]
> Someone tried to kill you?! People actually killed your friends? Not sure if schizophrenia or actual story ... I desperately need to hear more of this story.

There's no way to prove or disprove it, therefore replying to your comment is pointless. If you think someone stays dead-silent for 5 years and that this is schizophrenic behavior, you are way too easily gullible. Either way, your comment was done with malicious intent.

reply
thomasjudge
10 minutes ago
[-]
Will malware/virus scanners detect any bad software?
reply
tech234a
1 hour ago
[-]
Notably Notepad++ was recently shipping unsigned/self-signed updates, apparently overlapping with the time of this incident, see releases 8.8.2-8.8.6: https://notepad-plus-plus.org/news/
reply
bakugo
1 hour ago
[-]
So they just conveniently decided not to sign their releases right around the time they were supposedly "hacked"?

Something doesn't seem right here.

reply
adzm
50 minutes ago
[-]
Code signing certs are unfortunately expensive
reply
firesteelrain
34 minutes ago
[-]
$700+ at Sectigo for two years

Something of Notepad++ size might think about it now

reply
starkeeper
1 hour ago
[-]
What was the impact of being compromised? Were they able to inject code into releases of Notepad++?
reply
prodigycorp
1 hour ago
[-]
I'm extremely wary about any application pushing politics.

I subscribe to MacPaw, who makes excellent apps like Setapp, Gemini, and CleanMyMac, all of which I use.

At some point, CleanMyMac started putting the Ukranian flag on the app icon and flagging utilities by any Russian developer as untrustworthy (because they are russian), and recommended that I uninstall them.

I am not pro russia/anti-ukraine independence by any means, but CleanMyMac is one of those apps that require elevated system permissions. Seeing them engage in software maccarythism makes me very, very hesitant to provide them.

reply
_alternator_
1 hour ago
[-]
Sorry, what does this have to do with notepad++?
reply
prodigycorp
1 hour ago
[-]
Sorry, I meant to reply to this comment: https://news.ycombinator.com/item?id=46851664

Please refer to it for context.

reply
gradus_ad
56 minutes ago
[-]
You should repost under the intended post
reply
stackghost
1 hour ago
[-]
The notepad++ author has publicly come out in favor of Taiwanese independence.
reply
permo-w
1 hour ago
[-]
Taiwan is already independent. Surely the normal way to refer to it would be as coming out against assimilation with mainland China?
reply
smuhakg
49 minutes ago
[-]
The official position of Taiwan (Republic of China) and the People's Republic of China is that they're rival governments of the same China.

The Taiwanese government has never formally declared itself independent from the mainland. Such a declaration would likely cause the PRC to invade.

https://en.wikipedia.org/wiki/1992_Consensus

reply
sb057
55 minutes ago
[-]
>Taiwan is already independent.

That is a very controversial statement, and one that both Taipei and Beijing disagree with.

reply
Supermancho
46 minutes ago
[-]
Controversy doesn't change the reality. Stating that Taiwan is not independent is political posturing. Look to French Guiana, which is not independent.
reply
stackghost
1 hour ago
[-]
>Surely the normal way to refer to it would be as coming out against assimilation with mainland China?

I suppose, though that's not really how I tend to see it phrased on socials or in the media.

reply
litbear2022
56 minutes ago
[-]
Before Trump set his sights on Greenland, Denmark also considered Kosovo to be independent.
reply
Barrin92
1 hour ago
[-]
if you're going to give in and avoid applications because, like in this case they take a strong stance on Ukraine or Taiwan the hack has literally achieved its purpose. Either silence the author directly or destroy its userbase.

Fuck'em and just donate ten bucks to notepad++ , I'd rather my pc breaks then reward this crap

reply
prodigycorp
1 hour ago
[-]
I think I made it clear that I use (and pay for) their applications. I also think I made a sufficiently nuanced comment that doesn't suggest that I've "given in" to anything.
reply
suprstarrd
1 hour ago
[-]
I can see where they got that idea from. You saying you won't provide permissions at the end ends up sounding a lot more like you won't use the app than I imagine you intended. (Although, subscribing to an app and then not using it would be silly.)
reply
Barrin92
36 minutes ago
[-]
what I took a bit of offense with is the term "software maccarythism". That's a movement now remembered for an over-reaction to often imaginary enemies. Ukraine is right now fighting for its life in a hot war on our continent here in Europe. Taiwan is at the very real risk of being invaded.

American and European infrastructure is subject to cyber attacks that that are effectively hostile military acts already. I don't think a vocal stance on Ukraine and an exclusion of Russian developers deserves the rhetoric of McCarthyism or being 'too political' as is these days a fashionable accusation. This is no red scare, this is speaking up for people bombed on a daily basis.

reply
generalizations
2 minutes ago
[-]
> a movement now remembered for an over-reaction to often imaginary enemies

I'm sure it felt very real at the time.

reply
stavros
1 hour ago
[-]
I support the Ukraine effort as well, but breaking my applications seems like a bridge too far.
reply
throwaway3060
1 hour ago
[-]
I hate to say this, but wariness of software developed within Russia has been around for ages, long before the current war.

Since there are a lot of both Ukrainian and Russian software developers, this is personal for a lot of people in the industry.

reply
getcrunk
1 hour ago
[-]
So they say at the provider level update traffic was redirected . Does this also mean their update endpoints didn’t do encryption?
reply
gruez
34 minutes ago
[-]
It's also possible the update manifest contained an url that the updater blindly trusted, and by modifying that file you could change what got downloaded.
reply
getcrunk
1 hour ago
[-]
Yea, should have finished reading. Remediation was to “ verify both the certificate and the signature of the downloaded installer. “

I mean for such a dev focused and extremely performant app, that’s disappointing.

Glad I’m off windows as of late

reply
kwar13
1 hour ago
[-]
Would've been good if it named the hosting provider. That's the most informative part.
reply
Larrikin
1 hour ago
[-]
Maybe the hosting provider is currently undergoing an audit or implementing the changes?

I expect to know it one day, but it may be too early to provide the name now.

reply
johnsillings
1 hour ago
[-]
why does this read like it was written by a state-sponsored actor
reply
nosrepa
1 hour ago
[-]
How scintilla-ating!
reply
bakugo
1 hour ago
[-]
So uhh... what exactly did the "state-sponsored actors" do?

They go on about how their server was compromised, and how the big bad Chinese were definitely behind it, and then claim the "situation has been fully resolved", but there is zero mention of any investigation into what was actually done by the attackers. Why? If I downloaded an installer during the time they were hacked, do I have malware now?

The utter lack of any such information feels bizarre.

reply
mimasama
1 hour ago
[-]
> Even after losing server access, attackers maintained credentials to internal services until December 2, 2025, which allowed them to continue redirecting Notepad++ update traffic to malicious servers. The attackers specifically targeted Notepad++ domain with the goal of exploiting insufficient update verification controls that existed in older versions of Notepad++.
reply
gradus_ad
54 minutes ago
[-]
The CCP must be destroyed.
reply