7 ms·

PuTTY 0.64 released, fixing a security hole

61 points by xrstf 12y ago

nothrabannosir 12y ago
Another security hole of PuTTY is downloads being served over non-SSL. I should know better and check the sigs using PGP and checksums, but on Windows this is such a drag that I just end up whispering hallelujah praise the Lord, and hoping for the best. I know it's my fault, but I'd still like SSL :(
- shawabawa3 12y ago
  > I should know better and check the sigs using PGP and checksums Kind of pointless. If the download has been compromised so have the checksums
  - nothrabannosir 12y ago
    Not if they have been signed with PGP.
    - chaz72 12y ago
      I have to ask: how are the PGP keys verified?
      - dredmorbius 12y ago
        Through the Web of Trust: https://en.wikipedia.org/wiki/Web_of_trust https://en.wikipedia.org/wiki/Web_of_trust http://www.pgpi.org/doc/pgpintro/ http://www.pgpi.org/doc/pgpintro/ http://www.rubin.ch/pgp/weboftrust.en.html http://www.rubin.ch/pgp/weboftrust.en.html Essentially: with cryptography, you aren't concerned about the transport, you're concerned about the crypto. Signatures of the source or binaries will tell you if they've been changed. Signatures on keys will tell you who trusts those keys. If someone you trust trusts a key, then you have a transitive trust of a key. This does mean, though, trusting people not to sign bogus keys. In TLS/SSL, you have a hierarchical trust. Your session (and its contents) are encrypted and authenticated by the host key, which is signed by the CA's key. The theory is that we can trust CAs. Practice shows otherwise. It's not cryptographically viable to fake a signature (of a key or data), though if someone manages to lose control of their private key, that's possible. PGP/GPG doesn't handle expired keys well. But the upshot is that HTTP transport of PuTTY is fine from an integrity standpoint, so long as you verify the binary and signatures. And if you don't mind others being able to see what you're fetching as you're fetching it (the only real benefit to HTTPS in this case). Even an MITM rewrite of data isn't a critical issue since you can catch that in PGP validation.
        chaz72 12y ago
        That's very thorough, thank you! I understand all those things in general, but I don't know the specific mechanism by which my local PGP install recognizes who else trusts this PGP key. I grant you that if the key is protected from MITM then all is well. I just still don't know this part: What mechanism do I use, I who have no prior encounter with that key and no existing PGP setup or connection to any web, to validate that key? I'm sure this is just a lack of familiarity with PGPs web of trust implementation, but lacking this info, I too just opted to trust the plain HTTP download (until I switched to Cygwin/OpenSSH to make it a moot point anyway).
        chaz72 12y ago
        Never mind, I see a higher ranked comment got an answer to this. I see the concept of keys signing keys and gpg --list-sigs. (Still no idea who might be at the end of that chain that I could actually verify though.)
        dredmorbius 12y ago
        Generally, you'd need to have a match (or chain) between keys you do trust and those signing a given key. In general, I fetch signatures of keys and may add some of these as partially trusted if they're very well known keys. A bit of bash scripting that helps with this: gpg --list-sigs <key ID> | grep 'not found' | cut -c 13-22 | sort -u | xargs --max-args 10 gpg --recv-keys xargs speeds the process by requesting multiple keys at a time. I think keeping that below 20 keys helps keep the keyservers happy. Sort + uniq eliminates duplicate requests of the same key. You cannot run parallel processes as your local gpg instance cannot do concurrent updates to the keyring.
        chaz72 12y ago
        For those already using PGP, that sounds great. For me, who is not using PGP, my set of trusted keys is currently empty. So it is unverified. Which, arguably, might be safer than being overly trusting of my "trusted CAs", which is verified by a flawed system. I guess I'm still not thrilled wih my options overall, but thank you for your time explaining how to use PGP.
- xrstf 12y ago
  > but on Windows this is such a drag that Get the keybase.io client, it sets up your GPG pretty nicely. I was able to confirm the downloads on Windows using the standard ``gpg --verify putty.DSA.asc`` and it just worked(tm) in a cmd.exe window. Using the keybase client does not, however, as the signing key for the putty binaries is not on keybase. Not saying anything about how much sense it makes to verify the downloads, just saying that it does work well on Windows, without any cygwin, mingw or whatever.
  - nothrabannosir 12y ago
    Thank you for the howto, I'll give this a try next time. Looks much more approachable than I feared.
josteink 12y ago
I used to be a huge PuTTY (or derative) user, but recently, I've switched to just using the normal OpenSSH command-line client within Cygwin and ConEmu. While PuTTY is nice, it lacks some features, like proxycommands and stuff which are standard in ~/.ssh/config. Things which can be taken along in a simple & portable fashion. No disrespect to PuTTY, but I just found myself not really needing it anymore.
- icc97 12y ago
  You can get SSH natively in the DOS command prompt by installing http://www.mls-software.com/opensshd.html http://www.mls-software.com/opensshd.html I found it very useful for connecting to vagrant boxes.
  - gnoway 12y ago
    This bundles a version of cygwin.
    - skrowl 12y ago
      Are there native builds that don't use cygwin?
      - gnoway 12y ago
        The OpenSSH included with msysgit uses msys I think, but otherwise I don't think there's a native OpenSSH for Windows.
    - icc97 12y ago
      Indeed - I like being able to use SSH directly in the DOS prompt though.
- deleted 12y ago
  [deleted]
- el_duderino 12y ago
  I prefer XShell5. http://www.netsarang.com/products/xsh_overview.html http://www.netsarang.com/products/xsh_overview.html
leni536 12y ago
Kind of off topic: Is there a secure way to download PuTTY? They are hosting on a http page. Though they provide RSA and DSA signatures how would I verify the signatures themselves? I'm kind of new to walking through trust paths. I don't even have any entry point too since nobody I know use public key encryption (I trust the Debian keys already though since I use their distro, maybe I can use that for a starting point?). My best bet would be to download the signatures and keys from different mirrors and sources to limit the possibility of a successful targeted MITM attack.
- easytiger 12y ago
  How does that make it more secure? HTTPS doesn't do anything to stop an attacker accessing the host and changing the contents. If you are concerned by MITMA then download from multiple nations and compare or download the source and build it yourself
  - nodata 12y ago
    Downloading a file from multiple nations and comparing is more work that downloading it over HTTPS.
  - leni536 12y ago
    An attacker can't change the content without breaking the signatures and keys. If you can verify the keys from independent sources you can feel safe (this is where I don't have practice). If an attacker somehow can steal the private keys it's bad, but compromising the web page doesn't mean that they have access to the private keys used for the signatures. I don't know about common security practices for managing https keys but I would think that a compromised https server would mean a compromised ssl private key too in most cases. Also https only verifies that page you see is the one intended to be hosted by the URL's owner. Even if the website had a valid cert signed by a trustworthy CA it wouldn't mean more. From that URL I couldn't tell if it's still a trustworthy site from I can download PuTTY. I don't know the state of PGP though. I'm looking at http://keyserver.ubuntu.com/ http://keyserver.ubuntu.com/ right now and all I see are plain signatures of keys without any comment on the "type of trust" between the two parties (I'm really new to this). But it seems probable that if somebody signed the PuTTY master keys then it meant that "I trust that this key belongs to the PuTTY team who create the trustworthy PuTTY software" since I wouldn't sign faulty software even if I knew that it came from a valid source. It would be nice if people would sign certificates with comments like this. edit: Sorry, seems like I misunderstood your comment. For my defense you misunderstood mine too. I don't say HTTPS is more secure. I just don't have any practice in verifying keys using gnupg. edit2: download the source and build it yourself I usually don't audit the source code I build from a random project. A compromised source code for me is as dangerous as a compromised binary (for me at least).
nodata 12y ago
It would have been better if the 0.64 release had been pulled, the fixed 0.64 release should have been named 0.65.
pbowyer 12y ago
Do you know a SSH client that can share configs cross-platform? So I can define my connections once, and use on Windows/OSX/*nix?
- iso8859-1 12y ago
  OpenSSH does this, no? Just use it in Cygwin.
tapirl 12y ago
The official git client for windows support ssl, openssl, scp, ... , much more powerful than putty.
- falcolas 12y ago
  Do you have a workaround for having to run them in a `cmd` or `powershell` window? Those are worse than the old terminals in many cases.
  - josteink 12y ago
    ConEmu, MinTTY or similar terminals.

61 points by xrstf 12y ago

Another security hole of PuTTY is downloads being served over non-SSL. I should know better and check the sigs using PGP and checksums, but on Windows this is such a drag that I just end up whispering hallelujah praise the Lord, and hoping for the best. I know it's my fault, but I'd still like SSL :(

shawabawa3 12y ago
> I should know better and check the sigs using PGP and checksums Kind of pointless. If the download has been compromised so have the checksums
- nothrabannosir 12y ago
  Not if they have been signed with PGP.
  - chaz72 12y ago
    I have to ask: how are the PGP keys verified?
    - dredmorbius 12y ago
      Through the Web of Trust: https://en.wikipedia.org/wiki/Web_of_trust https://en.wikipedia.org/wiki/Web_of_trust http://www.pgpi.org/doc/pgpintro/ http://www.pgpi.org/doc/pgpintro/ http://www.rubin.ch/pgp/weboftrust.en.html http://www.rubin.ch/pgp/weboftrust.en.html Essentially: with cryptography, you aren't concerned about the transport, you're concerned about the crypto. Signatures of the source or binaries will tell you if they've been changed. Signatures on keys will tell you who trusts those keys. If someone you trust trusts a key, then you have a transitive trust of a key. This does mean, though, trusting people not to sign bogus keys. In TLS/SSL, you have a hierarchical trust. Your session (and its contents) are encrypted and authenticated by the host key, which is signed by the CA's key. The theory is that we can trust CAs. Practice shows otherwise. It's not cryptographically viable to fake a signature (of a key or data), though if someone manages to lose control of their private key, that's possible. PGP/GPG doesn't handle expired keys well. But the upshot is that HTTP transport of PuTTY is fine from an integrity standpoint, so long as you verify the binary and signatures. And if you don't mind others being able to see what you're fetching as you're fetching it (the only real benefit to HTTPS in this case). Even an MITM rewrite of data isn't a critical issue since you can catch that in PGP validation.
      - chaz72 12y ago
        That's very thorough, thank you! I understand all those things in general, but I don't know the specific mechanism by which my local PGP install recognizes who else trusts this PGP key. I grant you that if the key is protected from MITM then all is well. I just still don't know this part: What mechanism do I use, I who have no prior encounter with that key and no existing PGP setup or connection to any web, to validate that key? I'm sure this is just a lack of familiarity with PGPs web of trust implementation, but lacking this info, I too just opted to trust the plain HTTP download (until I switched to Cygwin/OpenSSH to make it a moot point anyway).
        chaz72 12y ago
        Never mind, I see a higher ranked comment got an answer to this. I see the concept of keys signing keys and gpg --list-sigs. (Still no idea who might be at the end of that chain that I could actually verify though.)
        dredmorbius 12y ago
        Generally, you'd need to have a match (or chain) between keys you do trust and those signing a given key. In general, I fetch signatures of keys and may add some of these as partially trusted if they're very well known keys. A bit of bash scripting that helps with this: gpg --list-sigs <key ID> | grep 'not found' | cut -c 13-22 | sort -u | xargs --max-args 10 gpg --recv-keys xargs speeds the process by requesting multiple keys at a time. I think keeping that below 20 keys helps keep the keyservers happy. Sort + uniq eliminates duplicate requests of the same key. You cannot run parallel processes as your local gpg instance cannot do concurrent updates to the keyring.
        chaz72 12y ago
        For those already using PGP, that sounds great. For me, who is not using PGP, my set of trusted keys is currently empty. So it is unverified. Which, arguably, might be safer than being overly trusting of my "trusted CAs", which is verified by a flawed system. I guess I'm still not thrilled wih my options overall, but thank you for your time explaining how to use PGP.
xrstf 12y ago
> but on Windows this is such a drag that Get the keybase.io client, it sets up your GPG pretty nicely. I was able to confirm the downloads on Windows using the standard ``gpg --verify putty.DSA.asc`` and it just worked(tm) in a cmd.exe window. Using the keybase client does not, however, as the signing key for the putty binaries is not on keybase. Not saying anything about how much sense it makes to verify the downloads, just saying that it does work well on Windows, without any cygwin, mingw or whatever.
- nothrabannosir 12y ago
  Thank you for the howto, I'll give this a try next time. Looks much more approachable than I feared.

josteink 12y ago

I used to be a huge PuTTY (or derative) user, but recently, I've switched to just using the normal OpenSSH command-line client within Cygwin and ConEmu. While PuTTY is nice, it lacks some features, like proxycommands and stuff which are standard in ~/.ssh/config. Things which can be taken along in a simple & portable fashion. No disrespect to PuTTY, but I just found myself not really needing it anymore.

icc97 12y ago
You can get SSH natively in the DOS command prompt by installing http://www.mls-software.com/opensshd.html http://www.mls-software.com/opensshd.html I found it very useful for connecting to vagrant boxes.
- gnoway 12y ago
  This bundles a version of cygwin.
  - skrowl 12y ago
    Are there native builds that don't use cygwin?
    - gnoway 12y ago
      The OpenSSH included with msysgit uses msys I think, but otherwise I don't think there's a native OpenSSH for Windows.
  - icc97 12y ago
    Indeed - I like being able to use SSH directly in the DOS prompt though.
deleted 12y ago
[deleted]
el_duderino 12y ago
I prefer XShell5. http://www.netsarang.com/products/xsh_overview.html http://www.netsarang.com/products/xsh_overview.html

leni536 12y ago

Kind of off topic: Is there a secure way to download PuTTY? They are hosting on a http page. Though they provide RSA and DSA signatures how would I verify the signatures themselves? I'm kind of new to walking through trust paths. I don't even have any entry point too since nobody I know use public key encryption (I trust the Debian keys already though since I use their distro, maybe I can use that for a starting point?). My best bet would be to download the signatures and keys from different mirrors and sources to limit the possibility of a successful targeted MITM attack.

easytiger 12y ago
How does that make it more secure? HTTPS doesn't do anything to stop an attacker accessing the host and changing the contents. If you are concerned by MITMA then download from multiple nations and compare or download the source and build it yourself
- nodata 12y ago
  Downloading a file from multiple nations and comparing is more work that downloading it over HTTPS.
- leni536 12y ago
  An attacker can't change the content without breaking the signatures and keys. If you can verify the keys from independent sources you can feel safe (this is where I don't have practice). If an attacker somehow can steal the private keys it's bad, but compromising the web page doesn't mean that they have access to the private keys used for the signatures. I don't know about common security practices for managing https keys but I would think that a compromised https server would mean a compromised ssl private key too in most cases. Also https only verifies that page you see is the one intended to be hosted by the URL's owner. Even if the website had a valid cert signed by a trustworthy CA it wouldn't mean more. From that URL I couldn't tell if it's still a trustworthy site from I can download PuTTY. I don't know the state of PGP though. I'm looking at http://keyserver.ubuntu.com/ http://keyserver.ubuntu.com/ right now and all I see are plain signatures of keys without any comment on the "type of trust" between the two parties (I'm really new to this). But it seems probable that if somebody signed the PuTTY master keys then it meant that "I trust that this key belongs to the PuTTY team who create the trustworthy PuTTY software" since I wouldn't sign faulty software even if I knew that it came from a valid source. It would be nice if people would sign certificates with comments like this. edit: Sorry, seems like I misunderstood your comment. For my defense you misunderstood mine too. I don't say HTTPS is more secure. I just don't have any practice in verifying keys using gnupg. edit2: download the source and build it yourself I usually don't audit the source code I build from a random project. A compromised source code for me is as dangerous as a compromised binary (for me at least).

nodata 12y ago

It would have been better if the 0.64 release had been pulled, the fixed 0.64 release should have been named 0.65.

pbowyer 12y ago

Do you know a SSH client that can share configs cross-platform? So I can define my connections once, and use on Windows/OSX/*nix?

iso8859-1 12y ago
OpenSSH does this, no? Just use it in Cygwin.

tapirl 12y ago

The official git client for windows support ssl, openssl, scp, ... , much more powerful than putty.

falcolas 12y ago
Do you have a workaround for having to run them in a `cmd` or `powershell` window? Those are worse than the old terminals in many cases.
- josteink 12y ago
  ConEmu, MinTTY or similar terminals.