Slashdot Mirror
Trojanized, Info-Stealing PuTTY Version Lurking Online
One of the best first steps in setting up a Windows machine is to install PuTTY on it, so you have a highly evolved secure shell at your command. An anonymous reader writes, though, with a note of caution if you're installing PuTTY from a source other than the project's own official page. A malicious version with information-stealing abilities has been found in the wild. According to the article:
Compiled from source, this malicious version is apparently capable of stealing the credentials needed to connect to those servers. "Data that is sent through SSH connections may be sensitive and is often considered a gold mine for a malicious actor. Attackers can ultimately use this sensitive information to get the highest level of privileges on a computer or server, (known as 'root' access) which can give them complete control over the targeted system," the researchers explained.
The Symantec report linked above also shows that (at least for this iteration) the malware version is easy to spot, by hitting the "About" information for the app.
And if not, why should I care?
I stayed through the beta bullshit. I stayed through Bennett. Autoplaying audio advertisement, and what the fuck ever you're letting through that's running my machine to a crawl with javascript: these are the final straw. Fuck you, I'm done.
Any sort of COM port access.
Any sort of SSH access.
Any sort of SSH tunnelling access.
I work in IT, PuTTY is one of the first things I install in every workplace - not "just because" but I'll be damned if I'm going to SSH into a remote server's management module without it or try to use some junky HTTP/Java monstrosity to achieve what one command can achieve on the CLI.
Hell, I've diagnosed mail servers using it by telnetting to the mail port and issuing commands direct for a setting that some Exchange "experts" denied would ever affect anything - when you can show them the entire mail transaction live rather than some convoluted log that purports to tell you everything that happens on the email sending with a junky bounce error, it kinda hurts.
Sure, a lot of stuff is HTTP-managed nowadays but wait until Chrome removes Java and see if the other browsers follow suit. Because then you'll be back on the CLI quite quickly.
The last Cisco switch I installed came only with some absolutely worthless piece of software that only works if you have version X of IE etc. But SSH was a one-tick enable and I could do everything else from there.
"This is the malicious version! If you want the secure one, please delete me and go elsewhere!"
Is there a way to read the about page without installing?
The article came quite close to being useful, but then missed by a mile.
Sent from my ASR33 using ASCII
I never did like that you had to download putty from a "random" domain. The putty.org website takes you to some greenend.org.uk domain. If you google for putty, it takes you directly to the greenend.org.uk domain. The official binary really should be hosted on the putty.org domain, or at the least have the actual download link on the official domain, using that greenend.org.uk domain as a CDN for the binary.
The infected client contains "Unidentified build, Nov 29 2013 21:41:02" on the about PuTTY page while the official has "Release 0.63". Cisco has a good article here: http://blogs.cisco.com/securit... by Robert Semans, Brandon Enright, James Sheppard, and Matt Healy.
The best first step is to install Steam, because Windows is only used for gaming.
How does it feel to be on the other side of a generalization, timothy?
Get free satoshi (Bitcoin) and Dogecoins
I've never really be that fond of putty, although I see where it is useful. Cygwin offers so much more having use of the shell on windows and ssh if you need to get into a system. Cygwin/X is even better when I need to get a gui. Add windowspager and Windows becomes a great presentation layer!
Thank you Cygwin people!
My ism, it's full of beliefs.
PuTTY also runs in linux, if you are doing a simple SSH access you can do it in any terminal easily, but PuTTY also does a lot of stuff that you need to be a command-line specialist to be able to do by hand. Plus it saves your configurations for later uses.
Personally I always do tunneling through PuTTY
CygWin is a damn nightmare, especially if you have other software that uses it.
It suffers from enormous "DLL Hell" problems when it has multiple versions trying to load and if you use programs that use older versions of Cygwin, they don't necessarily run at all in co-existence with programs using newer versions. "Cygwin1.dll" exists is so many different versions that it's almost impossible to manage properly.
I used to develop on Windows with Eclipse and Cygwin. I quickly moved to MinGW because silly things like random games, utilities, etc. that use it would interfere with the version I was developing against.
If all you want is a real terminal on a GUI, Cygwin is total overkill. Not only that, if you use WinSCP as well, it will manage the keys for you properly between both programs so you don't even notice that you're using it.
Use *nix, or use Windows and PuTTY. For sure, as a network admin, I wouldn't let put Cygwin near your computers but I'll happily pre-install PuTTY for you (zero install needed, certainly no pissing about with PATH and multiple versions of the DLL etc.).
Putty runs circles around the cmd.exe terminal you'd have to suffer with, going that route.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
The last Cisco switch I installed came only with some absolutely worthless piece of software that only works if you have version X of IE etc. But SSH was a one-tick enable and I could do everything else from there.
Chuckle. If one is using a GUI to configure Cisco gear, one should probably not be using Cisco gear.* :D
*Unless you're trying to learn it, then the GUI will help get you started.
WTF is that? Because that's not sgtatham's site.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
Cygwin works well until you get other programs that use it. You either have to install them within your Cygwin install folder (and hope they are able to cope with Cygwin updates you make, e.g. to Cygwin 2) or suffer DLL hell. Look at the Cygwin FAQ for ".DLL" - if you're not familiar with those errors already, you haven't used Cygwin very much. Now consider across a bunch of workstations on a network.
"Want say tunneling to a Windows service? If you use Windows only as a client...."
Don't. Use a proper tool. PuTTY is a client, not a server. This is like saying that ssh-client is no good at being sshd,.. of course not. But that's not what we're talking about.
And the fact is that for every SSH server set up (properly), you probably have 10-100 clients joining to it or you wouldn't bother setting it up. And one of the main points of things like SSH servers is cross-compile farms and remote access. And almost all the universities that offer such services recommend PuTTY if you're on Windows (because they've dealt with the Cygwin issues, I assure you, and decided it's not worth the hassle).
Opinion, of course. So's yours. Just because it's contrary doesn't make it more or less valid.
However, PuTTY is widely used and recommended for everything from talking to your Arduino's over a serial port to logging into your University server... go take a look. Cygwin - if and when it comes up - is not mentioned in nearly as many places for such simple actions.
Cygwin is, in fact, overkill for the majority of users who just want to use SSH, telnet or serial services from Windows. If they wanted Linux, generally they end up installing it in preference to Cygwin.
It is nice to know that the trojanized version retains the copyright notice and disclaimer of warranty as required by the PuTTY FOSS license. Good to see people properly using Open Source!
Connection->ssh->tunnels, works like a charm.