Slashdot Mirror
Trojanized, Info-Stealing PuTTY Version Lurking Online
One of the best first steps in setting up a Windows machine is to install PuTTY on it, so you have a highly evolved secure shell at your command. An anonymous reader writes, though, with a note of caution if you're installing PuTTY from a source other than the project's own official page. A malicious version with information-stealing abilities has been found in the wild. According to the article:
Compiled from source, this malicious version is apparently capable of stealing the credentials needed to connect to those servers. "Data that is sent through SSH connections may be sensitive and is often considered a gold mine for a malicious actor. Attackers can ultimately use this sensitive information to get the highest level of privileges on a computer or server, (known as 'root' access) which can give them complete control over the targeted system," the researchers explained.
The Symantec report linked above also shows that (at least for this iteration) the malware version is easy to spot, by hitting the "About" information for the app.
Any sort of COM port access.
Any sort of SSH access.
Any sort of SSH tunnelling access.
I work in IT, PuTTY is one of the first things I install in every workplace - not "just because" but I'll be damned if I'm going to SSH into a remote server's management module without it or try to use some junky HTTP/Java monstrosity to achieve what one command can achieve on the CLI.
Hell, I've diagnosed mail servers using it by telnetting to the mail port and issuing commands direct for a setting that some Exchange "experts" denied would ever affect anything - when you can show them the entire mail transaction live rather than some convoluted log that purports to tell you everything that happens on the email sending with a junky bounce error, it kinda hurts.
Sure, a lot of stuff is HTTP-managed nowadays but wait until Chrome removes Java and see if the other browsers follow suit. Because then you'll be back on the CLI quite quickly.
The last Cisco switch I installed came only with some absolutely worthless piece of software that only works if you have version X of IE etc. But SSH was a one-tick enable and I could do everything else from there.
In this particular situation; because at first glance the main download page, site and URL doesn't look "official" at all.
http://www.chiark.greenend.org...
It would be pretty easy to confuse a slightly more modern looking page for the "main download page".
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
That's a good point actually.
greenend.co.uk is the official domain for PuTTY (specifically, www.chiark.greenend.co.uk). Simon Tatham has hosted it there from the start. I'd be more suspicious of putty.org, honestly.
In Soviet Russia, Jesus asks: "What Would You Do?"
CygWin is a damn nightmare, especially if you have other software that uses it.
It suffers from enormous "DLL Hell" problems when it has multiple versions trying to load and if you use programs that use older versions of Cygwin, they don't necessarily run at all in co-existence with programs using newer versions. "Cygwin1.dll" exists is so many different versions that it's almost impossible to manage properly.
I used to develop on Windows with Eclipse and Cygwin. I quickly moved to MinGW because silly things like random games, utilities, etc. that use it would interfere with the version I was developing against.
If all you want is a real terminal on a GUI, Cygwin is total overkill. Not only that, if you use WinSCP as well, it will manage the keys for you properly between both programs so you don't even notice that you're using it.
Use *nix, or use Windows and PuTTY. For sure, as a network admin, I wouldn't let put Cygwin near your computers but I'll happily pre-install PuTTY for you (zero install needed, certainly no pissing about with PATH and multiple versions of the DLL etc.).
That's just because they compiled without specifying the build number.
That's LITERALLY a ten-second fix and recompile to resolve.
Don't identify software / spam / viruses by "it has X feature that's easily copied", whether that's a registry entry, a process name or an arbitrary string.
Publish the damn checksums at a minimum, or GPG signing key ideallly.
...what sibling said. Anything can be trojanized, and it's turtles all the way down if you're proposing that by simply using a different application (or suite/kernel/VM/whatever thereof).
In all seriousness, PuTTY is a quick and dirty way of getting a working SSH shell on a Windows box. For the greybeards (like myself), it's also a quick and kick-ass means of plugging an old laptop into a serial port on the back of a Sun/HPUX/IBM-PPC box.
It's a self-contained executable that you can keep on a geek stick. No dependencies, no lengthy installation bullshit like Cygwin, no muss, no fuss. It just works.
In fact, I still keep a copy on my phone just in case, in spite of the fact that I typically use a MacBook Pro nowadays (OSX has a working *nix shell that I can open Terminal with and SSH from all day long, tab the hell out of, have customized nine ways from Sunday for local Git coloring, pre-hooks, branch awareness, etc). That said, I use PuTTY when I find myself stuck with a 'doze box (usually when having to show a 'doze user something on a *nix box from his machine), or when I find myself in a datacenter with only a shitty old laptop and no other useful means of getting some RS-232 love (because let's face it, HyperTerminal sucks donkey balls).
Quo usque tandem abutere, Nimbus, patientia nostra?
I am always struck by the fact that something in such widespread use as PuTTY is still downloaded from what looks like someone's public home directory.
On the other hand, it is such an anomaly that I instantly recognize the site when I see it as the correct download site.
I agree, except you've over-rated HyperTerminal.
Red to red, black to black. Switch it on, but stand well back.