Trojanized, Info-Stealing PuTTY Version Lurking Online

One of the best first steps in setting up a Windows machine is to install PuTTY on it, so you have a highly evolved secure shell at your command. An anonymous reader writes, though, with a note of caution if you're installing PuTTY from a source other than the project's own official page. A malicious version with information-stealing abilities has been found in the wild. According to the article: Compiled from source, this malicious version is apparently capable of stealing the credentials needed to connect to those servers. "Data that is sent through SSH connections may be sensitive and is often considered a gold mine for a malicious actor. Attackers can ultimately use this sensitive information to get the highest level of privileges on a computer or server, (known as 'root' access) which can give them complete control over the targeted system," the researchers explained. The Symantec report linked above also shows that (at least for this iteration) the malware version is easy to spot, by hitting the "About" information for the app.

Comments

Is it on the main download page?

[danbob999]

And if not, why should I care?

Re:Is it on the main download page?

[mwvdlee]

In this particular situation; because at first glance the main download page, site and URL doesn't look "official" at all.
http://www.chiark.greenend.org...
It would be pretty easy to confuse a slightly more modern looking page for the "main download page".

Re:Is it on the main download page?

[jones_supa]

That's a good point actually.

Re:Is it on the main download page?

[danbob999]

I agree however http://www.putty.org/ links to this page and is the first result on google. The second result is this page. As long as scammers can't get their trojanized putty on google's first page I don't think there is much of a risk.

Re:Is it on the main download page?

[operagost]

So if someone wants to install a single GUI tool instead of a app compatibility layer and a command line tool, they're an idiot?

What if they installed one of those Heartbleed-vulnerable versions of openssl? Are they smart?

Re:Is it on the main download page?

[bluefoxlucid]

No, because putty is ballsacks that can't be properly scripted, uses weird key files that need special conversion (it doesn't use an openssh key, but a putty identity key that you can convert to openssh using another program), and handles all kinds of terminal interactions in such a wrong way that you may as well be using Microsoft Word with a VB script to send commands across ssh. Start in a real terminal, where 27 sessions is C-a " instead of "oh fuck which alt-tab icon is it?!"

Re:Is it on the main download page?

[ahodgson]

Because SSH is mostly used to talk to Linux servers. Since when has Microsoft ever done anything to make Windows easier to use with other systems?

Re:Is it on the main download page?

[Coren22]

Windows has that, it is called the Microsoft Store.

Re:Is it on the main download page?

[Ben Hutchings]

I know that's the official site, but:

• I'm supposed to download binaries that don't have Authenticode signatures, from a web server that doesn't support TLS.
• And then I have to download (and somehow verify) a copy of PGP or GnuPG, in order to verify the signatures they do provide. (I also have to know and remember the fingerprint of the genuine PGP signing key.)
• Finally, I have to trust that no-one has cracked a 1024-bit PGP key.

I can only assume that almost all downloads from the official site are vulnerable to MITM'ing. And, as PuTTY is such a popular tool, it is surely a prime target for that.

Putty domain

[watermark]

I never did like that you had to download putty from a "random" domain. The putty.org website takes you to some greenend.org.uk domain. If you google for putty, it takes you directly to the greenend.org.uk domain. The official binary really should be hosted on the putty.org domain, or at the least have the actual download link on the official domain, using that greenend.org.uk domain as a CDN for the binary.

Re:Putty domain

[red_dragon]

greenend.co.uk is the official domain for PuTTY (specifically, www.chiark.greenend.co.uk). Simon Tatham has hosted it there from the start. I'd be more suspicious of putty.org, honestly.

Re:Putty domain

[Anonymous Coward]

Yes, but a newcomer would find www.chiark.greenend.co.uk more suspicious than putty.org.

Best first steps

[ArcadeMan]

One of the best first steps in setting up a Windows machine is to install PuTTY on it.

The best first step is to install Steam, because Windows is only used for gaming.

How does it feel to be on the other side of a generalization, timothy?

Re:Best first steps

[Sarten-X]

I just rebuilt my Windows desktop at home.

The first thing I did was to install Google Chrome, because I'd rather not tolerate IE while fetching other stuff. Next was Steam, mostly so I could get it downloading a game immediately. Once my game was underway, I downloaded PuTTY, followed by a few other utilities.

From my perspective, you're all very close, but wrong nonetheless.

Re:Dear DICE

[aaaaaaargh!]

/. works fine for me (except that, yes, it sucks more and more and seems to have become a generic news aggregator).

Anyway, why don't you just use an ad-blocker like uBlock or Adblock Edge?

Re:WTF

[camperdave]

Don't you think that a person who is making a malicious version of Putty is also capable of putting MD5 checksums of the malicious code on their download site? Checking MD5 sums against those published by the author is useless. You need to check against publicly verified, independently published checksums.