Slashdot Mirror
Trojanized, Info-Stealing PuTTY Version Lurking Online
One of the best first steps in setting up a Windows machine is to install PuTTY on it, so you have a highly evolved secure shell at your command. An anonymous reader writes, though, with a note of caution if you're installing PuTTY from a source other than the project's own official page. A malicious version with information-stealing abilities has been found in the wild. According to the article:
Compiled from source, this malicious version is apparently capable of stealing the credentials needed to connect to those servers. "Data that is sent through SSH connections may be sensitive and is often considered a gold mine for a malicious actor. Attackers can ultimately use this sensitive information to get the highest level of privileges on a computer or server, (known as 'root' access) which can give them complete control over the targeted system," the researchers explained.
The Symantec report linked above also shows that (at least for this iteration) the malware version is easy to spot, by hitting the "About" information for the app.
And if not, why should I care?
I stayed through the beta bullshit. I stayed through Bennett. Autoplaying audio advertisement, and what the fuck ever you're letting through that's running my machine to a crawl with javascript: these are the final straw. Fuck you, I'm done.
Malicious! Software! Exists! Online! Everyone! Panic!
Really slashdot?
To connect to a Linux machine remotely?
20 years using Windows machines, never used it
Any sort of COM port access.
Any sort of SSH access.
Any sort of SSH tunnelling access.
I work in IT, PuTTY is one of the first things I install in every workplace - not "just because" but I'll be damned if I'm going to SSH into a remote server's management module without it or try to use some junky HTTP/Java monstrosity to achieve what one command can achieve on the CLI.
Hell, I've diagnosed mail servers using it by telnetting to the mail port and issuing commands direct for a setting that some Exchange "experts" denied would ever affect anything - when you can show them the entire mail transaction live rather than some convoluted log that purports to tell you everything that happens on the email sending with a junky bounce error, it kinda hurts.
Sure, a lot of stuff is HTTP-managed nowadays but wait until Chrome removes Java and see if the other browsers follow suit. Because then you'll be back on the CLI quite quickly.
The last Cisco switch I installed came only with some absolutely worthless piece of software that only works if you have version X of IE etc. But SSH was a one-tick enable and I could do everything else from there.
"This is the malicious version! If you want the secure one, please delete me and go elsewhere!"
Is there a way to read the about page without installing?
The article came quite close to being useful, but then missed by a mile.
Sent from my ASR33 using ASCII
You should basically only be downloading from the official repository.
Anything else is just insanity.
Handy Url Included:
http://putty.cc?version=latest
I never did like that you had to download putty from a "random" domain. The putty.org website takes you to some greenend.org.uk domain. If you google for putty, it takes you directly to the greenend.org.uk domain. The official binary really should be hosted on the putty.org domain, or at the least have the actual download link on the official domain, using that greenend.org.uk domain as a CDN for the binary.
To make SSH console connections to other machines, genius. Why wouldn't that be useful?
The infected client contains "Unidentified build, Nov 29 2013 21:41:02" on the about PuTTY page while the official has "Release 0.63". Cisco has a good article here: http://blogs.cisco.com/securit... by Robert Semans, Brandon Enright, James Sheppard, and Matt Healy.
I don’t generally use Windows, but when I do the first thing I install is Cygwin so I can use openssh there instead of putty.
The best first step is to install Steam, because Windows is only used for gaming.
How does it feel to be on the other side of a generalization, timothy?
Get free satoshi (Bitcoin) and Dogecoins
I've never really be that fond of putty, although I see where it is useful. Cygwin offers so much more having use of the shell on windows and ssh if you need to get into a system. Cygwin/X is even better when I need to get a gui. Add windowspager and Windows becomes a great presentation layer!
Thank you Cygwin people!
My ism, it's full of beliefs.
Or Firefox. However, that did not prevent me from using Chrome (or any webkit engine) to connect to it, and having no issues with the interface. That page is really more of an alert telling you that the browser you are using is not QA'ed.
Regardless, real Cisco people use PuTTY over the console port to enable SSH. :P
Someone's always gonna ruin it.
PuTTY also runs in linux, if you are doing a simple SSH access you can do it in any terminal easily, but PuTTY also does a lot of stuff that you need to be a command-line specialist to be able to do by hand. Plus it saves your configurations for later uses.
Personally I always do tunneling through PuTTY
CygWin is a damn nightmare, especially if you have other software that uses it.
It suffers from enormous "DLL Hell" problems when it has multiple versions trying to load and if you use programs that use older versions of Cygwin, they don't necessarily run at all in co-existence with programs using newer versions. "Cygwin1.dll" exists is so many different versions that it's almost impossible to manage properly.
I used to develop on Windows with Eclipse and Cygwin. I quickly moved to MinGW because silly things like random games, utilities, etc. that use it would interfere with the version I was developing against.
If all you want is a real terminal on a GUI, Cygwin is total overkill. Not only that, if you use WinSCP as well, it will manage the keys for you properly between both programs so you don't even notice that you're using it.
Use *nix, or use Windows and PuTTY. For sure, as a network admin, I wouldn't let put Cygwin near your computers but I'll happily pre-install PuTTY for you (zero install needed, certainly no pissing about with PATH and multiple versions of the DLL etc.).
That's not from the main putty page but is linked to from the main page.
If I were setting up a Windows machine, it would probably be for my gamer brother. Why would he need an SSH client?
Sure, in 2015, it wouldn't be so hard for Microsoft to include an SSH client with their OS? I can't think of any other OS that doesn't come with one pre-installed.
I don't care if it's 90,000 hectares. That lake was not my doing.
If you haven't found MobaXterm yet, do yourself a favor.
Putty runs circles around the cmd.exe terminal you'd have to suffer with, going that route.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
The last Cisco switch I installed came only with some absolutely worthless piece of software that only works if you have version X of IE etc. But SSH was a one-tick enable and I could do everything else from there.
Chuckle. If one is using a GUI to configure Cisco gear, one should probably not be using Cisco gear.* :D
*Unless you're trying to learn it, then the GUI will help get you started.
Linux saves your configurations too, with the magic of CTRL+R ;)
I bricked my WRT1900AC and used Putty to do a serial connection to reflash the firmware. I also use it hundreds of times a day for SSH and occasionally for telnet. Absolutely indispensable tool.
Your opinion is subjective hell. Cygwin works very well. If course, you can install unneeded packages but just because you can doesn't mean you should. Want say tunneling to a Windows service? Try doing that with putty and winscp. If you use Windows only as a client, sure putty will do but not if you want it to be a proper server.
I used to develop on Windows with Eclipse and Cygwin. I quickly moved to MinGW because silly things like random games, utilities, etc. that use it would interfere with the version I was developing against.
Which C runtime library do you use with MinGW? I'm told third-party applications shouldn't use MSVCRT.dll anymore.
obvious shady shit like this malicious version of PuTTY
The problem here is that it isn't "obvious shady shit" as you claim. The official PuTTY download page doesn't look very "official". This makes it easier to fool people into downloading the trojaned version instead of the official version.
I don't work as a sysadmin or anything, but I even have it on my phone.
Occasionally I get a rogue process on my server and I can go in and sort it even if the console goes all Helen Keller.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
That's like saying you've been playing with Lego for 20 years, and you can't see why anyone would ever need a spanner.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
I tried that and got "Firefox can't find the server at www.putty.cc." The fact that putty.cc doesn't exist is the real problem.
Cygwin works well until you get other programs that use it. You either have to install them within your Cygwin install folder (and hope they are able to cope with Cygwin updates you make, e.g. to Cygwin 2) or suffer DLL hell. Look at the Cygwin FAQ for ".DLL" - if you're not familiar with those errors already, you haven't used Cygwin very much. Now consider across a bunch of workstations on a network.
"Want say tunneling to a Windows service? If you use Windows only as a client...."
Don't. Use a proper tool. PuTTY is a client, not a server. This is like saying that ssh-client is no good at being sshd,.. of course not. But that's not what we're talking about.
And the fact is that for every SSH server set up (properly), you probably have 10-100 clients joining to it or you wouldn't bother setting it up. And one of the main points of things like SSH servers is cross-compile farms and remote access. And almost all the universities that offer such services recommend PuTTY if you're on Windows (because they've dealt with the Cygwin issues, I assure you, and decided it's not worth the hassle).
Opinion, of course. So's yours. Just because it's contrary doesn't make it more or less valid.
However, PuTTY is widely used and recommended for everything from talking to your Arduino's over a serial port to logging into your University server... go take a look. Cygwin - if and when it comes up - is not mentioned in nearly as many places for such simple actions.
Cygwin is, in fact, overkill for the majority of users who just want to use SSH, telnet or serial services from Windows. If they wanted Linux, generally they end up installing it in preference to Cygwin.
People still use telet for Windows? Just asking. I haven't heard of Telnet since the late 1990s.
Cygwin is basically such a mess that you might as well just install Linux and it will probably work better for any given use-case.
Stop trying to do real work on Windows you tool. Then again most people who 'work in IT' are desktop support which is H1B work in the making.
Bingo. HP's OAs on their blade enclosures are a lot less painful if you use SSH. Same with IBM HMCs. In fact, administrating network devices require SSH for all but basic stuff.
Yes, there are commercial SSH clients, but the price is insane per seat, and they provide almost nothing more than PuTTY does. Might as well send a donation to the PuTTY authors and use that.
I only install KiTTY now for some time.
http://www.9bis.net/kitty/
"KiTTY is a fork from version 0.64 of PuTTY, the best telnet / SSH client in the world"
I think it's more truly PuTTY evolved... the differences/improvements are listed.
With that said, I do routinely install PuTTY - I've gotten tired of the old arguments:
(ME): "What ports should I use on the jump server, and is Netcat installed there?"
(COWORKER): "Just click on PuTTY and go to the Tunnels part . . ."
(ME): "Can't you just tell me what ports to use?"
(COWORKER): "The only way I know how is in PuTTY."
Anybody but me ever felt the urge to punch the monkey?
There's always Cmder too ===> http://gooseberrycreative.com/cmder/
640k ought to be enough for anyone.
Great comparison! An SSH client is to Windows as a wrench is to Lego.
You forget Cisco has mistakenly released some gear with only HTTP/HTTPS access such as those terrible CE-500 switches.
Get rid of the middle man!
google Chrome-> appstore -> SecureShell
The check sums are already published, anyone that wants to check can check.
To the other half, I can modify any Windows binary to have malware and keep the version the same. Check sums can fix that almost all of the time. The build information is as reliable as the binary's name, in that it has very little use.
People pushing this gunk are not going after knowledgeable users that check sources (obviously), they are going after the low hanging fruit which could be "got" any number of ways. The latest craze of pushing STEM and IT Security has created a huge set of wanna-bes who know enough to be dangerous while thinking they are intelligent.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
I use Putty plenty, but I haven't had a time yet where I have needed to use it on a new system and needed root access on the system I am logging in to. If I'm using it on a new box, I am logging in with my usual non-root account on my remote system. How exactly would they use that to gain root access?
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Anyone know if there's a trojanized version of PuTTY-CAC?
For the rest of you, that's for use with "smart cards" (i.e., US fed gov PIV, or US DoD CAC id cards), and it's a fork of PuTTY.
And what about pageant?
mark
2015-05-19 Malware pretending to be PuTTY
A Symantec blog post warns that a trojaned copy of PuTTY has been detected in the wild. Fortunately, it's easily recognisable by its version identification ("Unidentified build, Nov 29 2013 21:41:02"). If you've encountered this version, we suggest you treat any machine that's run the malicious version as potentially compromised, change any passwords that might have been stolen, and resecure the accounts they protect.
It is nice to know that the trojanized version retains the copyright notice and disclaimer of warranty as required by the PuTTY FOSS license. Good to see people properly using Open Source!
I use ZOC terminal. Its commercial and worth it to me. Anyone else have a favorite SSH client?
No, it's like saying is a very specific tool that is used by people that know where to download it from, and not random from sources on the internet
Um... Duplo
When our name is on the back of your car, we're behind you all the way!
I have used Cygwin daily at work and at home for ten years and have almost never seen the issues you are talking about. I'm sure they are real and affect people who do things differently than me. I don't typically download third party applications that depend on the Cygwin DLL. I use the complete official Cygwin package repository or (very rarely) compile from source. I use Eclipse, Java, ant, Cygwin, and am about as happy as I can be with my environment (I'd be happier writing Perl, but that's another story). I use Cygwin openssh every day and it works great.
Secession is the right of all sentient beings.
You guys are still using PuTTY? I switched to MobaXterm years ago.
But any adult OS has a terminal emulator built in.
And they all suck hairy donkey balls.. You know you have been using PuTTY too long when..
You LOL at all the post about www.chiark.greenend.org because you know how to blindly download the last version from the.earth.li.
The first thing you do on a brand new Mac is downloading VirtualBox and a warezed TinyXP just to run PuTTY.
You do the same on any fresh unixbox just to ssh into the host because you can't stand the behaviour of the native terminal emulator.
Can give a 20 minute speech on how PuTTY-on-Ubuntu/Mac/whatyouhave is Not The Same Thing
You pranked friends with a trojaned version in the previous century.
Connection->ssh->tunnels, works like a charm.
Anyone have a hash for the bad file? I didn't see one in the article
Cygwin with openssh works fine. Putty is OK. But for things you use regulary, scripts and SSH are nicer.
Ditto here. I suspect they are, as you suggest, downloading 3rd party applications that depend on the Cygwin DLL. I use the setup.exe provided and have never had a problem.
Putty runs circles around the cmd.exe terminal you'd have to suffer with, going that route.
Cygwin has changed a lot since you last looked at it. Cygwin's default terminal is now mintty.exe, which is a project based off of Putty's terminal.
Secession is the right of all sentient beings.
I'm very much with you on that. It makes my life bearable given that I can't put Linux on my work lappy due to the whole full disk encryption thing they have going here (financial industry so it makes some sense). My job would be far slower using standalone tools like PuTTY. It's OK for simple SSH access and it has some lovely features for doing things like tunneling (which I use it for sometimes) but for managing a good sized environment where I'm moving stuff around and want to script things it's not really useful. I second the above complaint about the way it does key management too, not a fan of that. Another minor gripe I have is purely aesthetic. I grew up on yellow/amber phosphorus WYSE serial terminals (attached to RS6000's mostly) so I like a nice pale amber as my terminal's primary color, I also like full screen multiple tabbed terminals and though MtPuTTY is out there it's a little clunky IMO. In summary I use Cygwin with mate-terminal as my primary way of connecting to my guests (Linux on z running under z/VM) and it's the optimum way for me. Others might think differently but that's the beauty of open source!
When was this? My latest installation is only around 3 months old.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
mintty has been around for 3+ years, maybe longer. For a default cygwin install on a fresh machine, the "Cygwin" icon that gets installed launches mintty.
Secession is the right of all sentient beings.
Apparently mintty has been the default since 2011: http://en.wikipedia.org/wiki/Mintty
Secession is the right of all sentient beings.
I used to do that, but now I install git, it contains a full feature command-line environment (bash, ssh, vim, less, cat ...). It's not clear to me whether it uses mingw alone or cygwin as well, but it's much simpler to install than cygwin and much faster as well.
~/.ssh/config is quite straightforward. And it will also be there for the next use.
There are no "command-line" specialists. Just read the man page, it's all there, even examples.
you forgot an 'l' (L) in the link.
Real link:http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
For fuck slashdot, that you are now reduced to trolling Open Source on your own forum.
Doesn't sound like cygwin has changed much in the last 10 years. Thanks for the trip down memory lane--I think. :)
Il n'y a pas de Planet B.
No in fact it's not. It's a very common tool for everything from IRC:ing to managing home network equipment. It's faster and simpler than any other tool for remote control.
Arguments like your is quite common but you are making the classic mistake of projecting your own prejudice about SSH on others that you think would be like you and therefore make the same choices you do.
I don't know if you use SSH or not because it goes both ways. Some doesn't use it because they consider it for a special brand of nerds and therefore thinks that everyone else that's not that demographics doesn't use it. Others belong to that demographic and think that the uninformed masses doesn't use it. Both have failed to see the numerous use cases that makes it a popular tool among people who doesn't really know how it works beyond for example running IRC on an "IRC Shell". Or to run BBS Door gamed like Legion of The Red Dragon. Or the generic MUD. The list of use case that's entirely outside your frame of mind are extensive so I just give you a few examples.
Cygwin is a great tool if you are a paying customer. If you use the free version and your use case doesn't match those of paying customers then good luck.
As the paying customers are few Red Hat doesn't put much resources into it.
I traded cygwin for VirtualBox and Fedora quite some time ago. It's easier to install and maintain and it got a lot more software. That's where RH puts most of the resources that used to belong to the cygwin project.