23

I recently did a Bing search for Putty and can only guess at which distribution is "trusted", contains no malware, or sleuthing code.

If you needed to download Putty for a high security Windows installation, where would you get the Binaries from? Would you compile from source?

Improve this question
7
  • Whats wrong with putty.org?
    – user11869
    Nov 15, 2012 at 17:25
  • 5
    @Rell3oT: putty.org doesn't look like an official site at all - it is run by Bitvise, who sell a rival SSH client. Seems like domain squatting to me...
    – bobince
    Nov 16, 2012 at 10:48
  • 1
    @bobince - You are 100% right that is exactly what is happening. Of course it also links to the official site.
    – Ramhound
    Nov 16, 2012 at 14:00
  • 2
    @Rell3oT hmm... my putty-link in "Putty - About" links to chiark.greenend.org.uk/~sgtatham/putty
    – Bonsi Scott
    Nov 16, 2012 at 22:36
  • 1
    chiark.greenend.org.uk/~sgtatham/putty is the official page of the creator of putty, last updated in September. He provides check-sums and source code for you to compile against as well as a link to git if you'd rather pull and compile over a secure connection
    – Robert Mennell
    Oct 22, 2015 at 3:01

6 Answers 6

Reset to default
22

The official site is www.chiark.greenend.org.uk/~sgtatham/putty, you can find the download in the download section. If you want to play it safe, you can verify the signature of the download.

In my opinion compiling it from source is as safe as downloading the binary and checking the signature (make sure to also verify the key itself with at least one trusted signer). Unless you review the source code (including all needed libraries) there is no point in spending the added effort of compiling it yourself since both parts, the source code and the binaries, are signed with the same key.

The only advantage you gain by compiling it yourself is the opportunity to review the code so as to mitigate the risk that the authors of PuTTY could have add some backdoors or malware to it. But again, you would have to thoroughly review the code and all needed libraries to actually gain that benefit.

Improve this answer
4
  • 9
    Relevant: security.stackexchange.com/questions/1687/… Note that file hashing in these cases is not generally intended to provide any security benefit - it's to ensure the integrity of the transmission. Unless the site displaying the hash is transferred over an authenticated connection, it's possible for a hacker to compromise the site and replace both file & hash with their own malicious copy. At that point, hash validation is useless for security.
    – Iszi
    Nov 15, 2012 at 20:55
  • 2
    Yeah, it's a shame Tatham doesn't have an HTTPS server... man-in-the-middling chiark would seem to be a likely-fruitful attack.
    – bobince
    Nov 16, 2012 at 10:51
  • You could also run a vm and use that as a terminal.
    – munchkin
    May 20, 2015 at 17:59
  • It seems that first you have to prove (or at least make some sort of argument) that "The official site is www.chiark.greenend.org.uk/~sgtatham/putty".
    – H2ONaCl
    Dec 26, 2017 at 4:51
5

As of May 2017 (!), the official PuTTY website is available over HTTPS.

https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html

Combined with the HTTPS download links added a little while earlier, this finally provides the first practical way to download a verified copy of PuTTY.

Welcome to the future.

Improve this answer
4

It's nearly impossible to verify that you get a clean copy of putty. As described in this neat article (not written by me)

https://noncombatant.org/2014/03/03/downloading-software-safely-is-nearly-impossible/

tldr of the article is: Putty binaries, signatures and download sites cannot be trusted because they do not even use SSL/Https. Would be very easy for a man in the middle attack to be able to modify the signatures and the binaries, and give you an evil version of putty.exe and a signature/checksum that corresponds to the intercepted executable.

Improve this answer
4
  • 1
    Except: the.earth.li/~sgtatham/putty/0.65/x86 which is the official download source .... It uses TLS and the files that the author couldn't download, downloaded fine for me.
    – schroeder ♦
    Oct 22, 2015 at 3:06
  • 3
    While this download URL does use TLS, it's not totally obvious to a new user of putty that this URL is the official download location. The identity of that server is not clearly connected to the putty software, so without knowing it has been that way for years, it is hard to trust it.
    – Mnebuerquo
    Aug 22, 2016 at 13:30
  • @schroeder if you bothered to read the article I linked to it states why that url is not a good idea.
    – user158443
    Feb 23, 2017 at 8:53
  • I'm responding to your comment that it does not use TLS: it does. You may have other reasons for not wanting to use it, but that part of your answer is incorrect. (I got the link from the article you cite...)
    – schroeder ♦
    Feb 28, 2017 at 7:39
1

Download same version from top-10 results for "putty homepage" returned by your favorite search engine, and compare them. If they are not all completely the same, abort the installation. Otherwise, install it (from any of downloaded bitwise-identical copies, of course).

If you need more security, interpolate results from different search engines and increase the number of downloads.

Simple, effective, and usually works quite well for such low amount of effort.

To be more sure, download source, have several top-notch security experts, cryptographers and programmers audit it all (including all libraries as well as compilers), and pay the cost -- and probably still be hit by next heartbleed bug.

Improve this answer
1

Another good option is the official winscp website , the connection is secured with TLS.

Improve this answer
-9

If you are ever in doubt about any download and are not set up to verify the download and test the install, a reasonably safe alternative is to get the program from CNET. The site says it has been scanned to ensure it is virus and spyware free. Putty is available at http://download.cnet.com/PuTTY/3000-7240_4-10808581.html.

Improve this answer
2
  • 14
    CNET got a lot of bad press a while back for bundling toolbars, spyware and other junk with legitimate programs like nmap.
    – Polynomial
    Nov 15, 2012 at 20:49
  • 2
    CNET is one of our biggest offenders for drive-by downloads that our AV has to clean up. -1
    – oBreak
    May 20, 2015 at 17:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .