Threat Level: green Handler on Duty: Johannes Ullrich

SANS ISC: InfoSec Handlers Diary Blog - Is this version of PuTTY legit? InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Is this version of PuTTY legit?

Published: 2010-05-20
Last Updated: 2010-05-20 18:07:56 UTC
by Joel Esler (Version: 2)
6 comment(s)

Write in from Andy (thanks Andy!) asking today if is a legit site to download putty (the popular tool to connect from a Windows box to Unix boxes via Telnet/SSH, etc.).

How did Andy find this site you ask?  Well, if you go to Google and type in "Putty" you'll notice that the above URL is SEO'ed ABOVE the actual website.

So far, when I downloaded both versions (from the above site, and from the md5's match up, so right now, they are legit copies.  I'm not accusing of doing anything inappropriate, don't get that impression.  I'm just using an abundance of caution, heck, they may be a legit mirror.  But as far as I can tell, they aren't on the authorized mirrors list, found here.

So, we prefer that you get your PuTTY downloads from the correct site.  Which, if you click on the download link, it will redirect you to here.

Which is the actual download link.  

Thanks Andy for writing in and staying vigilant about watching those URL's!

UPDATE: A write in reminds us that using gpg to verify the packages is preferred.  I agree.


-- Joel Esler | |


6 comment(s)
Diary Archives