Trojanized versions of PuTTY utility being used to spread backdoor
'Researchers believe hackers with connections to the North Korean government have been pushing a Trojanized version of the PuTTY networking utility in an attempt to backdoor the network of organizations they want to spy on. Researchers from security firm Mandiant said on Thursday that at least one customer it serves had an employee who installed the fake network utility by accident. The incident caused the employer to become infected with a backdoor tracked by researchers as Airdry.v2. The file was transmitted by a group Mandiant tracks as UNC4034.' -- source: https://arstechnica.com/information-technology/2022/09/trojanized-versions-o... Cheers, Peter -- Peter Reutemann Dept. of Computer Science University of Waikato, NZ +64 (7) 858-5174 (office) +64 (7) 577-5304 (home office) https://www.cs.waikato.ac.nz/~fracpete/ http://www.data-mining.co.nz/
On Fri, 16 Sep 2022 15:57:14 +1200, Peter Reutemann quoted:
'Researchers believe hackers with connections to the North Korean government have been pushing a Trojanized version of the PuTTY networking utility ...'
If you are going to download things from alternative sources, at least learn how to check hash digests from the original source to verify authenticity.
On Fri, 16 Sep 2022 15:57:14 +1200, Peter Reutemann wrote:
-- source: https://arstechnica.com/information-technology/2022/09/trojanized-versions-o...
What do you know: Secure versions of [PuTTY] are signed by the official developer. The version sent in the WhatsApp message was not signed. Which would indicate that significant numbers of downloaders are not bothering to check signatures on the download. Does Microsoft make it easy to do this? Somehow I think not ...
participants (2)
-
Lawrence D'Oliveiro -
Peter Reutemann