Network technologies and trends

May 21 2015   6:28PM GMT

Beware of Trojanized version of PuTTY

Yasir Irfan Yasir Irfan Profile: Yasir Irfan


It all started in late 2013 and early2014, a compromised FTP client dubbed “StealZilla,” based off the open source FileZilla FTP client was discovered. Now in 2015 new attack is discovered based on the same techniques and the actors as StealZilla” to alter the source code of the widely used open source Telnet/SSH client, PuTTY, and use their network of compromised web servers to serve up similar fake Putty download pages.

Screen Shot 2015-05-21 at 9.24.55 PM

Picture Source: Cisco Blog

This trojanized version of PuTTY harvests credentials and relays the information back to a collection server in the same way too. The operation is very quick and quiet. Login details are sent to attackers using an HTTP GET connection ONLY once.

This is quite dangerous and its recommended not to download PuTTY from un known websites. .o check the versions to make sure its genuine Since PuTTY is an open source client many Networking professionals grab this software to access their critical network appliances.

Few days back Cisco posted a detailed blog with detailed analysis, it worth to read this article.

 Comment on this Post

There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when other members comment.

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

Share this item with your network: