Kevin Beaumont

There is more detail linked below: https://www.heise.de/en/news/Notepad-updater-installed-malware-1110972… https://doublepulsar.com/small-numbers-of-notepad-users-reporting-secu… The TLDR is that until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which was available in the Github source code. The author enabled this by not following best practices. The "good news" is that the attacks were very targeted and seemed to involve hands on keyboard attacks against folks in Asia. Blaming the hosting company is kind of shady, as the author should own at least some level of the blame for this.

The original article (linked in the op here) is worth reading if you want more details. https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-o…

I can totally believe random microblogging takes are stupid, but that doesn't seem worth arguing about. Microblogging is just capturing initial reactions. > "That could make it trivial for an attacker" (emphasis mine) It _is_ trivial, right? The attack _is_ trivial. It's the solution that isn't. OP isn't claiming that. Seems reasonable to me. I went back and reread https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-o… which is the first link in OP. Again, it doesn't have much to say about encryption at all except to point out that hey, the protections Microsoft is claiming are underwhelming. Without those protections the cost/benefit balance is way out of whack.

Or cost of outsourcing / not having IT competence in your organization? There were indications that Jaguar used the same outsourced IT org as another large company who has struggled to recover from a wide ranging hacking incident. https://doublepulsar.com/the-elephant-in-the-biz-outsourcing-of-critic… I've had contact with several companies where once outsourced IT competency and security continuity is just out the window ... Sometimes not even the outsourcing company's "fault" as humans / organizations love to think "oh I don't have to think about that now that I outsourced it" and folks who do worry about the detail then leave (they can't use their skills) and now you got folks in charge who don't even understand what they're agreeing to with their outsourcing company. Other times, it is the outsourcing groups fault ...

This is missing the point, and I'd strongly recommend reading Kevin Beaumont's findings presented as a Q&A style post about Recall [0]. This kind of poorly controlled local access makes it significantly more dangerous to use a Windows PC, because it significantly increases the harm/value of info stealing malware and will increase the degree of interest in penetrating windows systems. The fact that it's enabled by default is horrific, especially when you consider that the people most vulnerable are also the least likely to understand or disable the feature. Before, info stealers would look for specific words/phrases in documents because anything more would be bandwidth/compute prohibitive. Now, such stealers just need to pull the Recall DB, and all of the juiciest information is served up on a platter. To prove his point, Kevin deployed a piece of common info stealing malware and it was able to exfiltrate the Recall data before Windows Defender could remediate the issue. This would still be a dangerous architecture even if Windows had a reputation for being impenetrable. Given the reality, this architecture is incomprehensibly bad. - [0] https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-o…

Yes, it's true that SMS-based authentication has its flaws, but it's far from useless/harmful in many contexts. The same strawman arguments used here would also find TOTP "wholly ineffective" which is an absurd conclusion. A main goal of security engineering is to increase the difficulty level for attackers. SMS authentication has demonstrated its ability to do this in a highly accessible, albeit imperfect, manner. I feel that the author severely underestimates the practical difficulties of widely deploying "Unique Passwords and U2F". I strongly disagree with the conclusion that "SMS-2FA is not only worthless, but harmful" and highly recommend consulting a security professional before entertaining any of the arguments or following any of the suggestions in this article. I don't like leaving negative comments, but this is at best borderline misinformation that has the potential to create severe consequences. Some more context, if you want to consider a more balanced perspective: https://doublepulsar.com/infosecs-fantastic-fear-of-everything-why-the…

Probably should just link to the security researcher's post, since it's far more informative: https://doublepulsar.com/adform-compromised-to-serve-crypto-stealer-vi…

I found the underlying medium article [1] more helpful. You can check to see if a site has been reported compromised here [2]. [1] https://doublepulsar.com/fortibleed-75k-fortinet-firewalls-have-admin-… [2] https://www.hudsonrock.com/fortinet

Its not just one issue they mishandled. It is a pattern. I think this makes sense if you believe long-term security requires leadership change at MSRC. https://doublepulsar.com/microsofts-stance-on-zero-day-exploits-is-a-d…

Interestingly that seems to be in response to [1], which might indeed be the trigger for this. [1] https://doublepulsar.com/microsoft-vibing-capturing-screenshots-and-vo…

The system card unfortunately only refers to this [0] blog post and doesn't go into any more detail. In the blog post Anthropic researchers claim: "So far, we've found and validated more than 500 high-severity vulnerabilities". The three examples given include two Buffer Overflows which could very well be cherrypicked. It's hard to evaluate if these vulns are actually "hard to find". I'd be interested to see the full list of CVEs and CVSS ratings to actually get an idea how good these findings are. Given the bogus claims [1] around GenAI and security, we should be very skeptical around these news. [0] https://red.anthropic.com/2026/zero-days/ [1] https://doublepulsar.com/cyberslop-meet-the-new-threat-actor-mit-and-s…

Good write ups: https://doublepulsar.com/merry-christmas-day-have-a-mongodb-security-i… https://blog.ecapuano.com/p/hunting-mongobleed-cve-2025-14847

> Anyone who can intercept and manipulate this traffic can therefore change the download URL. Until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which is available in the Github source code. This made it possible to create manipulated updates and push them onto victims. Since v8.8.7, however, Notepad++ relies on a legitimate GlobalSign certificate, and installing its own Notepad++ root certificate is no longer necessary. I came across some more technical information here: https://doublepulsar.com/small-numbers-of-notepad-users-reporting-secu…

Well M&S got knocked down by amateurism of TCS - https://www.consultancy.uk/news/40295/ms-hackers-may-have-gained-acces… Guess who was taking care for JLR's IT system? That's right, TCS. https://doublepulsar.com/the-elephant-in-the-biz-outsourcing-of-critic…

That quote is interesting because all of the period reporting I’ve seen says that the attackers did NOT successfully get an HTTPS certificate and the only people affected were those who ignored their browsers’ warnings. https://doublepulsar.com/hijack-of-amazons-internet-domain-service-use… https://blog.cloudflare.com/bgp-leaks-and-crypto-currencies/

Some excerpts from https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-o… ---------- Q. So how does it work? A. Every few seconds, screenshots are taken. These are automatically OCR’d by Azure AI, running on your device, and written into an SQLite database in the user’s folder. This database file has a record of everything you’ve ever viewed on your PC in plain text. OCR is a process of looking an image, and extracting the letters. Q. How do you obtain the database files? A. They’re just files in AppData, in the new CoreAIPlatform folder. Q. But it’s highly encrypted and nobody can access them, right?! A. Here’s a few second video of two Microsoft engineers accessing the folder: https://cyberplace.social/@GossiTheDog/112535509953161486 ----------

[dupe] Actual article: https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-o… More discussion: https://news.ycombinator.com/item?id=40540703

Microsoft does not make it easy to give them the benefit of the doubt. See, for example, the Recall debacle. https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-o…

With any available information stealing malware: https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-o…

IMO the link should point at the original source: https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-o… The blog post is insanely reductive and clickbaitish

Neither these two paragraphs or the source they’re paraphrasing (https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-o… indicate anything matching the headline at all. The source article is a QA with himself. There’s 1 tweet references, that shows a screenshot of a truncated SQLite db that shows a log of the applications opened via the user UI shell: https://x.com/gossithedog/status/1796218726808748367?s=46&t=J18Cxv… Whoopty doo. There are many, many sources throughout Windows that can give you a list of recently opened applications (that have existed for 10-25 years)

On 2024-02-29, a PR was sent to stop linking liblzma into libsystemd [0]. Kevin Beaumont speculated [1] that "Jia Tan" saw this and immediately realized it would have neutered the backdoor and thus began to rush to avoid losing the very significant amount of work that went into this exploit; I think he's right. That rush caused the crashing seen in 5.6.0 and the lack of polish which could have eliminated or reduced the performance regressions which were the entire reason this was caught in the first place; they simply didn't have the time because the window had started to close and they didn't want all their work to be for nothing. [0]: https://github.com/systemd/systemd/pull/31550 [1]: https://doublepulsar.com/inside-the-failed-attempt-to-backdoor-ssh-glo…

That's probably because of this (as mentioned in the timeline): >2024-02-29: On GitHub, @teknoraver https://github.com/systemd/systemd/pull/31550 to stop linking liblzma into libsystemd. It appears that this would have defeated the attack. https://doublepulsar.com/inside-the-failed-attempt-to-backdoor-ssh-glo… that knowing this was on the way may have accelerated the attacker’s schedule. It is unclear whether any earlier discussions exist that would have tipped them off.

Additional information about the Kaseya angle: https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-rans…

.do is struts, well known for a myriad of security holes. https://webmasters.stackexchange.com/questions/9907/in-a-uri-what-does… https://doublepulsar.com/apache-struts-and-the-three-leading-us-credit…

Relevant https://twitter.com/cynicalsecurity/status/973591954096381952?s=19 https://doublepulsar.com/on-amd-flaws-from-cts-labs-f167ea00e4e8

Well, it appears some OS makers are between a rock and a hard place, which means they're actively blocking off updates. https://doublepulsar.com/important-information-about-microsoft-meltdow…

There's a lot of confusing information out there as you have found out. This link helps clarify the steps needed. https://doublepulsar.com/important-information-about-microsoft-meltdow… Pay specific attention to the dataflow. Registry keys have to be set in a certain order in order for a) the patch to download and install and b) actually enable. If there is not a BIOS fix (I'm in the same boat as you), the other hope is that the OS or virtualization provider includes CPU microcode in their update to address this. At this time, I do not believe Microsoft has included microcode in their current update. However, they do have the capability so that's something you can ask them about doing so at some point.

> The security concerns apply regardless of Recall existing. Not quite. Because there is a world of difference between an attacker being able to grab information that is being entered or temporarily present, or permanently present and encrypted, and an attacker being able to, within seconds, grab everything the user ever did, watched, saw, entered, etc. on his machine in one fell swoop: https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-o… Quote from the Q&A Section of the post: "Q. But if a hacker gains access to run code on your PC, it’s already game over! A. If you run something like an info stealer, at present they will automatically scrape things like credential stores. At scale, hackers scrape rather than touch every victim (because there are so many) and resell them in online marketplaces. Recall enables threat actors to automate scraping everything you’ve ever looked at within seconds. During testing this with an off the shelf infostealer, I used Microsoft Defender for Endpoint — which detected the off the shelve infostealer — but by the time the automated remediation kicked in (which took over ten minutes) my Recall data was already long gone." End Quote. And this is THE core problem with such a system, that just hoovers up everything, everywhere, all at once: It creates a single point of failure so critical, it will instantly become the prime target of every attack, because no…