Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code.

If you needed to download Putty for a high security Windows installation, where would you get the Binaries from? Would you compile from source?

share|improve this question
Whats wrong with putty.org? – Rell3oT Nov 15 '12 at 17:25
@Rell3oT: It's just a linking-page for several projects, you cannot download anything from there. – Manuel Faux Nov 15 '12 at 17:42
Well yes but it is the official site (after you click on the putty link) which goes to the link posted by you. I'm just curious why using the official site isn't obvious to do... – Rell3oT Nov 15 '12 at 17:47
1  
@Rell3oT: putty.org doesn't look like an official site at all - it is run by Bitvise, who sell a rival SSH client. Seems like domain squatting to me... – bobince Nov 16 '12 at 10:48
1  
@bobince - You are 100% right that is exactly what is happening. Of course it also links to the official site. – Ramhound Nov 16 '12 at 14:00
show 1 more comment

3 Answers

up vote 10 down vote accepted

The official site is www.chiark.greenend.org.uk/~sgtatham/putty, you can find the download in the download section. If you want to play it safe, you can verify the signature of the download.

In my opinion compiling it from source is as safe as downloading the binary and checking the signature (make sure to also verify the key itself with at least one trusted signer). Unless you review the source code (including all needed libraries) there is no point in spending the added effort of compiling it yourself since both parts, the source code and the binaries, are signed with the same key.

The only advantage you gain by compiling it yourself is the opportunity to review the code so as to mitigate the risk that the authors of PuTTY could have add some backdoors or malware to it. But again, you would have to thoroughly review the code and all needed libraries to actually gain that benefit.

share|improve this answer
4  
Relevant: security.stackexchange.com/questions/1687/… Note that file hashing in these cases is not generally intended to provide any security benefit - it's to ensure the integrity of the transmission. Unless the site displaying the hash is transferred over an authenticated connection, it's possible for a hacker to compromise the site and replace both file & hash with their own malicious copy. At that point, hash validation is useless for security. – Iszi Nov 15 '12 at 20:55
Yeah, it's a shame Tatham doesn't have an HTTPS server... man-in-the-middling chiark would seem to be a likely-fruitful attack. – bobince Nov 16 '12 at 10:51
up vote 2 down vote

I believe this is the official source of PuTTY. It is the source that I have always seen recommended. And to my knowledge there is no reason to not just run the executable binary files found here.

share|improve this answer
up vote -6 down vote

If you are ever in doubt about any download and are not set up to verify the download and test the install, a reasonably safe alternative is to get the program from CNET. The site says it has been scanned to ensure it is virus and spyware free. Putty is available at http://download.cnet.com/PuTTY/3000-7240_4-10808581.html.

share|improve this answer
7  
CNET got a lot of bad press a while back for bundling toolbars, spyware and other junk with legitimate programs like nmap. – Polynomial Nov 15 '12 at 20:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.