3 ms·
Isn't this like some kind of canary, to warn people that putty might be backdoored?
by jokoon 5y ago
Isn't this like some kind of canary, to warn people that putty might be backdoored?
- hsbauauvhabzb 5y agoIf you have citations on that I’d be curious, but unencrypted http in a vulnerability which mean nodes in the middle can automate injecting malware into binaries, meaning it’s be a weird place to draw a line in the sand as a canary
- londons_explore 5y agoIt's a dangerous thing to do as an adversary. Many organisations will automatically hash and collect all binaries before they execute on any of their machines. Finding a putty.exe that is different to every other putty.exe in the network sure sounds like a red flag worthy of someone uploading to virustotal and then project zero getting their hands on it....
- l0b0 5y agoI don't think GP was talking about replacing all downloads with malware, just key ones, like individual targets.
- jokoon 5y agoIt was just a weird idea I had. Not a canary, but a way to say "we cannot guarantee that exe is not compromised because of things we can't talk about, so there is no need to provide https to secure it, so here is just http".
- l0b0 5y agoYou wouldn't even need to serve actual malware, just give people an old version of PuTTY with either a known vulnerability or insecure defaults.