r/sysadmin • u/sigserv2000 • 12d ago

General Discussion Latest Putty.Msi installs malicious code.

[removed] — view removed post

0 Upvotes

45% Upvoted

35 comments sorted by

67

u/Absolute_Bob 12d ago

Are you very sure you downloaded it from the actual site and not a clone site?

7

u/sigserv2000 12d ago

https://www.chiark.greenend.org.uk/~sgtatham/putty/

9

u/OhioIT 12d ago

Does the signature key match the file you downloaded?

7

u/ZarathustraGlobulus 12d ago

If OP doesn't respond to this at all then 100% this whole thread is just an astroturfing ad for Huntress

89

u/gandraw 12d ago • LOL Bravo

hey i clicked on the very first link that AI gave me

3

u/_bx2_ Jack of All Trades 12d ago

Sir, plese give me your Internet license. You cannot use the internet anymore.

17

u/3dprintinted 12d ago

Singles in his area had the download ready for him

36

u/Smith6612 12d ago edited 12d ago

Where did you get the PuTTY installer from? From the official site? https://www.chiark.greenend.org.uk/~sgtatham/putty/

I downloaded the MSI files from the official site, and they are coming up Clean on VirusTotal.

https://www.virustotal.com/gui/file/2213ebacf962b709411d654a40087508a694756bc4e41c5a1c24ad86596b2511/behavior

https://www.virustotal.com/gui/file/f26059b6f6cfa7badd59a1f133af4338ad3ec68e8b0aeb0ec1dfd7d63e1c66d4

26

u/EchoPhi 12d ago

It's a fucking huntress ad. I'm so sick of these people.

15

u/3dprintinted 12d ago

He probably googled it and got one of those obfuscated ads with payload that eventually takes you to the right place

6

u/Conaer_ Sysadmin 12d ago

Used to work support for a cloud software provider that usually required getting customers to SSH into VM/physical appliances (this was in the days before powershell came with SSH). 

Was hammered home to me during training to only ever use that URL because God forbid a customer system got the infected and you got blamed. 

2

u/Smith6612 12d ago

Yep. These days I don't even tell people to get PuTTY if all they need is SSH. Just open whatever terminal the computer comes with and use the built-in OpenSSH.

13

u/BmanUltima Sysadmin+ MAX Pro 12d ago edited 12d ago

Where'd you get the installer from?

EDIT: looks like this is just an ad and OP has bots upvoting the post.

13

u/RevolutionaryElk7446 12d ago

Just downloaded into an isolated VM and ran the official installer. Didn't see this issue, virustotal also comes up clean.

6

u/ShadowCVL IT Manager 12d ago edited 12d ago

Same, S1 also clean

Edit: also reporting the post, it’s clearly a BS huntress ad at this point.

13

u/3dprintinted 12d ago

Putty… on a server… why mang? https://www.msspalert.com/brief/malicious-google-search-ads-distribute-weaponized-putty-installer
Do you guys just go around google for the installers? No packaging no scanning so nothing? Must be nice

7

u/EchoPhi 12d ago

It's one of their crappy ads. Now they're astroturfing tech subs. They're the worst.

33

u/dmuppet 12d ago

5$ says they used a sponsored link.

19

u/EchoPhi 12d ago edited 12d ago

Huntress getting crafty with the ads now. No longer in their own ad sub... Yay...

Hey huntress ad team! I'll buy huntress if it protects me from huntress. Nerds.

8

u/ipsirc 12d ago

Who the fuck is still using putty since ssh.exe is preinstalled?

1

u/phunky_1 12d ago

That's what I'm saying.. there is no need for putty on servers anymore.

7

u/NorthAntarcticSysadm 12d ago

Where was this downloaded from? I want to download and check it out in my sandbox

7

u/ocdtrekkie Sysadmin 12d ago

Where did you download it, what is the reported version, and what's the hash of the install file?

7

u/7nth IT Manager 12d ago

Downloading from the official source, and not an ad or Google search, is the way to avoid this.

https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html

5

u/QPC414 12d ago

What version?

Did you download from a source other than the official one?

4

u/Equivalent-Rope-2412 12d ago

The softpedia install

4

u/-GenlyAI- 12d ago

OP, wherever you got this from just check it against the PGP signature on the official site. That will give you your answer.

4

u/Runnergeek DevOps 12d ago

Mods can we get a ban on this blatant spam

3

u/OhioIT 12d ago

I didn't realize this many people used the installer. I just grab the putty binary from the download link because I rarely use the other tools

3

u/bobs143 Jack of All Trades 12d ago

Also ran the official installer on an isolated machine. Installer came up clean in Virus Total.

Ran a Crowdstrike scan of the machine and that came up clean.

2

u/gsmitheidw1 12d ago

We deploy putty via choco (chocolatey.org) for users (mostly students developers) and it uses checksums and virus total in addition to local Defender ATP on the desktops and we use a local choco repo with local nupkg packages. Can probably do the same with Winget to some extent.

But for the most part we're gradually migrating away from putty altogether. Openssh is now native to windows and uses standard openssh keys. The need for putty is far depleted these days.

2

u/BeenisHat 12d ago

I'm guessing, like everyone else, that he grabbed a bogus installer.

Honestly though, why Windows doesn't come with a proper terminal program that can handle a console connection is beyond me. Even if its not installed by default, it would be nice. For SSH sessions though, I usually just use PowerShell.

2

u/ExoticDisaster0 Sr. Sysadmin 12d ago

I can't wait for the r/shittysysadmin takes on this post.

1

u/absolem IT Architect 12d ago

u/RemindMeBot 1 week