Slashdot Mirror
Trojanized, Info-Stealing PuTTY Version Lurking Online
One of the best first steps in setting up a Windows machine is to install PuTTY on it, so you have a highly evolved secure shell at your command. An anonymous reader writes, though, with a note of caution if you're installing PuTTY from a source other than the project's own official page. A malicious version with information-stealing abilities has been found in the wild. According to the article:
Compiled from source, this malicious version is apparently capable of stealing the credentials needed to connect to those servers. "Data that is sent through SSH connections may be sensitive and is often considered a gold mine for a malicious actor. Attackers can ultimately use this sensitive information to get the highest level of privileges on a computer or server, (known as 'root' access) which can give them complete control over the targeted system," the researchers explained.
The Symantec report linked above also shows that (at least for this iteration) the malware version is easy to spot, by hitting the "About" information for the app.
And if not, why should I care?
I stayed through the beta bullshit. I stayed through Bennett. Autoplaying audio advertisement, and what the fuck ever you're letting through that's running my machine to a crawl with javascript: these are the final straw. Fuck you, I'm done.
One of the best first steps in setting up a Windows machine is to install PuTTY on it, so you have a highly evolved secure shell at your command.
I know what PuTTY is. I even used it once, back in college.
That was pretty much the last time I used Windows, but if I were to set up a Windows machine now, I wouldn't even think to install PuTTY. Why would you?
Malicious! Software! Exists! Online! Everyone! Panic!
Really slashdot?
"This is the malicious version! If you want the secure one, please delete me and go elsewhere!"
Is there a way to read the about page without installing?
The article came quite close to being useful, but then missed by a mile.
Sent from my ASR33 using ASCII
You should basically only be downloading from the official repository.
Anything else is just insanity.
Handy Url Included:
http://putty.cc?version=latest
I never did like that you had to download putty from a "random" domain. The putty.org website takes you to some greenend.org.uk domain. If you google for putty, it takes you directly to the greenend.org.uk domain. The official binary really should be hosted on the putty.org domain, or at the least have the actual download link on the official domain, using that greenend.org.uk domain as a CDN for the binary.
The infected client contains "Unidentified build, Nov 29 2013 21:41:02" on the about PuTTY page while the official has "Release 0.63". Cisco has a good article here: http://blogs.cisco.com/securit... by Robert Semans, Brandon Enright, James Sheppard, and Matt Healy.
The best first step is to install Steam, because Windows is only used for gaming.
How does it feel to be on the other side of a generalization, timothy?
Get free satoshi (Bitcoin) and Dogecoins
I've never really be that fond of putty, although I see where it is useful. Cygwin offers so much more having use of the shell on windows and ssh if you need to get into a system. Cygwin/X is even better when I need to get a gui. Add windowspager and Windows becomes a great presentation layer!
Thank you Cygwin people!
My ism, it's full of beliefs.
Someone's always gonna ruin it.
That's not from the main putty page but is linked to from the main page.
Sure, in 2015, it wouldn't be so hard for Microsoft to include an SSH client with their OS? I can't think of any other OS that doesn't come with one pre-installed.
I don't care if it's 90,000 hectares. That lake was not my doing.
If you haven't found MobaXterm yet, do yourself a favor.
I bricked my WRT1900AC and used Putty to do a serial connection to reflash the firmware. I also use it hundreds of times a day for SSH and occasionally for telnet. Absolutely indispensable tool.
I used to develop on Windows with Eclipse and Cygwin. I quickly moved to MinGW because silly things like random games, utilities, etc. that use it would interfere with the version I was developing against.
Which C runtime library do you use with MinGW? I'm told third-party applications shouldn't use MSVCRT.dll anymore.
obvious shady shit like this malicious version of PuTTY
The problem here is that it isn't "obvious shady shit" as you claim. The official PuTTY download page doesn't look very "official". This makes it easier to fool people into downloading the trojaned version instead of the official version.
I tried that and got "Firefox can't find the server at www.putty.cc." The fact that putty.cc doesn't exist is the real problem.
People still use telet for Windows? Just asking. I haven't heard of Telnet since the late 1990s.
I only install KiTTY now for some time.
http://www.9bis.net/kitty/
"KiTTY is a fork from version 0.64 of PuTTY, the best telnet / SSH client in the world"
I think it's more truly PuTTY evolved... the differences/improvements are listed.
With that said, I do routinely install PuTTY - I've gotten tired of the old arguments:
(ME): "What ports should I use on the jump server, and is Netcat installed there?"
(COWORKER): "Just click on PuTTY and go to the Tunnels part . . ."
(ME): "Can't you just tell me what ports to use?"
(COWORKER): "The only way I know how is in PuTTY."
Anybody but me ever felt the urge to punch the monkey?
Get rid of the middle man!
google Chrome-> appstore -> SecureShell
The check sums are already published, anyone that wants to check can check.
To the other half, I can modify any Windows binary to have malware and keep the version the same. Check sums can fix that almost all of the time. The build information is as reliable as the binary's name, in that it has very little use.
People pushing this gunk are not going after knowledgeable users that check sources (obviously), they are going after the low hanging fruit which could be "got" any number of ways. The latest craze of pushing STEM and IT Security has created a huge set of wanna-bes who know enough to be dangerous while thinking they are intelligent.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
I use Putty plenty, but I haven't had a time yet where I have needed to use it on a new system and needed root access on the system I am logging in to. If I'm using it on a new box, I am logging in with my usual non-root account on my remote system. How exactly would they use that to gain root access?
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
Anyone know if there's a trojanized version of PuTTY-CAC?
For the rest of you, that's for use with "smart cards" (i.e., US fed gov PIV, or US DoD CAC id cards), and it's a fork of PuTTY.
And what about pageant?
mark
2015-05-19 Malware pretending to be PuTTY
A Symantec blog post warns that a trojaned copy of PuTTY has been detected in the wild. Fortunately, it's easily recognisable by its version identification ("Unidentified build, Nov 29 2013 21:41:02"). If you've encountered this version, we suggest you treat any machine that's run the malicious version as potentially compromised, change any passwords that might have been stolen, and resecure the accounts they protect.
It is nice to know that the trojanized version retains the copyright notice and disclaimer of warranty as required by the PuTTY FOSS license. Good to see people properly using Open Source!
I use ZOC terminal. Its commercial and worth it to me. Anyone else have a favorite SSH client?
You guys are still using PuTTY? I switched to MobaXterm years ago.
Anyone have a hash for the bad file? I didn't see one in the article
you forgot an 'l' (L) in the link.
Real link:http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html
For fuck slashdot, that you are now reduced to trolling Open Source on your own forum.