DLL Hack in Notepad++



  • @donho

    Absolutely, sorry if I have confused you.
    That’s exactly what I meant, the only thing you could do is
    to have a secure download with the signed dlls.

    Regarding the plugins, this could be difficult if we consider that
    npp is also used with plugins developed but not used by public.

    At my last job I was asked for writing one for their own purpose.
    So I assume other do this as well.

    Cheers
    Claudia



  • @Claudia-Frank said:

    That’s exactly what I meant, the only thing you could do is
    to have a secure download with the signed dlls.

    Just want to be more clear:

    1. DONE: to have a secure download (https)
    2. DONE: with the signed dlls
    3. TODO: notepad++.exe checks the certificate of scilexer.dll. If the certificate checking failed, then Notepad++ won’t be launched.

    #3 is address to the problem mentioned in the Wikileaks.



  • @donho said:

    checking scilexer.dll before loading is a solution for me. Don’t you agree?

    I don’t see this as a solution because notepad++.exe could just as easily be replaced and/or modified.



  • @dail said:

    I don’t see this as a solution because notepad++.exe could just as easily be replaced and/or modified.

    True.
    But I’m addressing to the problem mentioned in the Wikileaks.



  • @dail

    but at that point, it isn’t in the responsibility of Don anymore, is it?

    Cheers
    Claudia



  • @Claudia-Frank said:

    but at that point, it isn’t in the responsibility of Don anymore, is it?

    Good point :)



  • @donho said:

    @Claudia-Frank said:

    That’s exactly what I meant, the only thing you could do is
    to have a secure download with the signed dlls.

    Just want to be more clear:

    1. DONE: to have a secure download (https)
    2. DONE: with the signed dlls
    3. TODO: notepad++.exe checks the certificate of scilexer.dll. If the certificate checking failed, then Notepad++ won’t be launched.

    #3 is address to the problem mentioned in the Wikileaks.

    Yes, from my point of view that’s the solution for this particular issue.

    Cheers
    Claudia



  • @Claudia-Frank

    but at that point, it isn’t in the responsibility of Don anymore, is it?

    Being signed ensures the right files get installed on the system. After that it is impossible for an exe to validate other files if it can’t validate itself first.



  • @dail

    don’t get this - if the file is signed, can’t npp exe call a function to check scintillas signature again?
    I mean, when a dll get’s signed it provides an unique stamp so before loading the library couldn’t
    you check this stamp?

    Cheers
    Claudia



  • can’t npp exe call a function to check scintillas signature again?

    Yes it can. But if an attacker has access to SciLexer.DLL why wouldn’t they just attack notepad++.exe. There is never a case where notepad++.exe is from a privileged location and loads SciLexer.DLL from a non-privileged location.

    I think we need to take a step back because this discussion doesn’t sound like it is specific to Notepad++ and Scintilla. There are programs every day that have to load DLLs and have to make sure they are valid.



  • Good point but isn’t the beauty of this hack that there is just one function call which needs to be passed through to get
    the same privilege as the main process? If it is running unprivileged good but if user runs it as administrator …

    You are right - loading a dll is a security issue and there is no safe way if MS doesn’t provide a way to run a program
    in an encapsulated and signed environment. Something like CI+ or the HDMI content protection. But for this special issue,
    I don’t see how it could be solved otherwise.

    Maybe a blog worth reading
    https://blogs.technet.microsoft.com/srd/2009/04/14/ms09-014-addressing-the-safari-carpet-bomb-vulnerability/

    and there is one other issue which might be interesting. If the dll gets verified before load, this breaks npp for all
    that use a different scintilla dll at the moment. I’m thinking about @cmeriaux for example.

    Cheers
    Claudia



  • Jfi - need to stay up early - I’m off.

    Cheers
    Claudia



  • just one function call which needs to be passed through to get the same privilege as the main process?

    That would assume you bypassed the Windows OS and got into the process space of Notepad++, which by then you have other issues ;)

    Maybe a blog worth reading…

    Will look at it tomorrow when I have a bit more time.

    The safest solution would just be link the SciLexer statically instead of loading it dynamically but I’m not saying this is the right solution



  • @dail

    The safest solution would just be link the SciLexer statically instead of loading it dynamically but I’m not saying this is the right solution

    Yes, you’re right. it’ll be in the roadmap. In the meantime, I will do the quick fix - checking the scilexer.dll before loading it.



  • This headline is misleading. The DLL exists for CIA assets to use the cover app while it’s executing other code under the hood. From my reading, it’s not meant to be used against the person using notepad++, it’s to let them use notepad++ without raising any red flags while the DLL does data collection in the background. Those apps listed are the cover apps that look normal, the DLL hijack is to make them malicious with the knowledge of the operator.

    ref: https://www.reddit.com/r/sysadmin/comments/5y0iqa/notepad_users_cia_has_had_a_dll_hijack_for_your/

    @dail @Claudia-Frank
    I agree that once users’ PC are compromised, the certificate checking is meaningless.
    However, it makes harder (more job) to hack by checking certificate.
    Just like knowing the lock is useless for people who are willing to go into my house, I still shut the door and lock it every morning when I leave home.

    We are in a f**king corrupted world! Sigh



  • I’m trying to get my head around this. No, not the part about the vulnerability, I understand that; the part I don’t understand is why all of a sudden this is like some big revelation…



  • @Alan-Kilborn
    Don’t know if I understand you correctly. I guess Don and dail are very well aware about
    the issue but when such a hack gets public it needs to be addressed. Don’t know
    if you ever where in the position to explain to your IT Security department that such a hack
    can’t be avoided as long as the operating system doesn’t ensure a safe environment.
    They simply ignore it - as long as you don’t provide “a” solution it is marked a vulnerable and
    you don’t get the permission to use this software anymore.
    Notepad++ is used in companies - at least in the ones that I was working for.

    Cheers
    Claudia



  • @Claudia-Frank

    Ah, okay Claudia, I think you understood my question and I understand your response. Thank you. Over my long period of observation, Windows seems inherently unsecure, probably because it is backing its way into security rather than having it be a major part of the design criterion. Sad.



  • I think there is no sens in checking certificates or staff like that because project is open source and everybody could create their own version of npp.

    P.S. If someone is paranoid then could simply check md5 hash of original files(dlls and so on) :D



  • @young-developer

    Yes, well, in this case you’d have to check the MD5 on the SciLexer.dll that will be loaded, which is perhaps a different one than the one that you think will get loaded. :)


Log in to reply