The recent compromise of built-in updates infrastructure for Notepad++ strongly highlights that even the most popular software can be compromised and go unnoticed for months. We have learned three lessons here:
1) Shared hosting solutions provide their own set of security risks since the hosting space is shared across multiple unknown entities on the same server. While shared hosting might be fine for personal use or a small project depending on one's threat model, in most cases, it should be avoided by enterprises, instead, a VPS or dedicated server with its own IP address should be used. This way, your business has its own IP address and can manage everything with full control over what happens on the server.
2) Cheap shared hosting solutions are cheap for a reason as they don't always employ the best talent. What failed this time was that after the initial compromise was noticed and the exploit stopped working when the servers were patched and rebooted, the state actor still retained persistent access via a backdoor because the hosting provider hadn't rotated secret keys on the server, which the state actor used to regain access. This process failure is equivalent to changing a compromised account password but leaving MFA/2FA backup seeds and active sessions intact, if you don't rotate those seeds and clear active sessions after an account is compromised, an attacker can still access your account even after the password is changed.
3) This hack shows that verification of the integrity of downloaded updates via hashes and cryptographic signing using certificates should always be performed. Windows Update does this, many networking devices, like routers and switches, do this as well, and other software solutions implement it too. This would add another layer of protection for Notepad++ users as the update mechanism would detect a mismatch in the tampered update files and reject executing them.
#Notepad++ #Hosting #Processes #VulnerabilityManagement #Threats #Risks
Entrepreneurial web application craftsman
Frontend Dogma
N-gated Hacker News
TrustedAlpaca
sayzard