Quite long ago, I read a fairly similar article (without this ridiculous commentary, of course). It went something like this:
- a friend asks author to try and hack him
- author tries a bunch of things in vain, finally decides to use a rogue wireless AP and does a MITM
- identifies that notepad++ has automatic updates turned on and that it's over HTTP
- creates a custom executable and writes a script (or something) to serve this payload when notepad++ tries to download a EXE
- fakes an update (by returning true when notepad++ queries an HTTP endpoint for the latest version on startup)
I'd be really thankful if someone could link me to this post. My usually powerful google-fu has let me down this time (I tried all _sorts_ of things). Notepad++ and MITM are the only things I strongly remember.
While that uses a similar exploit, it's not the one alas! The article I'm referring to used a rogue AP where the author essentially created a pineapple-like device (or something; I'm probably misremembering this part).
Thanks anyway! :)
Edit: this was also more of a story than a how-to like guide.
- a friend asks author to try and hack him
- author tries a bunch of things in vain, finally decides to use a rogue wireless AP and does a MITM
- identifies that notepad++ has automatic updates turned on and that it's over HTTP
- creates a custom executable and writes a script (or something) to serve this payload when notepad++ tries to download a EXE
- fakes an update (by returning true when notepad++ queries an HTTP endpoint for the latest version on startup)
I'd be really thankful if someone could link me to this post. My usually powerful google-fu has let me down this time (I tried all _sorts_ of things). Notepad++ and MITM are the only things I strongly remember.