3

The whole point of WinSCP is to provide a secure channel between a computer and a server. "Secure" means that there is a possibility of an attacker that can view or modify bytes sent both ways. Let's assume I have keys from the server but have no WinSCP installed (or have it but want to update it). In that case I'm going to download WinSCP from winscp.net which is NOT https and thus webpages I get can be changed by an attacker that is capable of modifying bytes sent/recieved. Download webpage provides checksums which can also be modified by an attacker.

Questions are:

  1. How come WinSCP authors did not implement https yet on the website?

  2. What can I do to prevent described attack?

1
  • For #1, we cannot answer for the admins at the WinSCP site.
    – schroeder
    Mar 22, 2015 at 0:40

3 Answers 3

4

I'm the sysadmin responsible for WinSCP.net hosting. We have moved to HTTPS gradually. As first thing we made available page with checksums (probably already at the time you wrote original post). For some time it was possible to access website on both HTTP and HTTPS and now we serve all pages over HTTPS. We still recommend to check checksum after downloading the files as the files are served from a CDN in certain regions.

2

I agree that it would be nice to have this site available by https so that the transport from the site to the user is protected. But I think one should put this risk into relation to the risk which remain even if the site has https:

  • How did you know that you must visit winscp.net and not another site like winscp.org (ads), winscp.com, download-winscp.net or whatever sites might exist. You probably used a search engine but how did you know you can trust the results? If you ever searched for downloads of firefox and used the first hits (or ads) you probably got some kind of "enhanced" version.
  • How do you know that the site is not compromised? It would not be the first important site (e.g. jquery.com was hacked, yahoo, winzip too. No https protects you against a compromised site.
  • How do you know that you can actually trust the people writing this code? The might have added a backdoor to it.
  • and probably other questions....

So yes, having https would be an improvement. But in my opinion it would be even better if the the checksums (i.e. sha-1, sha-256...) get propagated as wide as possible so that you could get the checksums from a different source (or multiple sources) and then check your download against it. Then you could detect problems even if the site was compromised or if you downloaded the program from another site.

2

What can I do to prevent described attack?

WinSCP installer binaries are signed with Authenticode, so you should be able to right-click-properties the .exe and check the signer.

Of course you would have to know that Martin Prikryl is the legitimate author, and you would have to trust Verisign to have made sure that's who it really is, and you'd have to trust that his machine wasn't compromised. But those are the same problems faced by HTTPS.

But yes, it would be better if the download site were HTTPS. Unfortunately software distribution without signing seems to be the norm (in the Windows world at least). There are worse cases (eg PuTTY downloads which are neither signed nor distributed by HTTPS).

I haven't seen a MitM proxy that automatically trojans HTTP-downloaded EXEs yet, but it would seem to be a straightforward attack.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .