Was my MacBook hacked if I have PuTTY host keys in my home directory?

Question

.putty/randomseed and .putty/sshhostkeys were found in my home directory of my MacBook Pro this morning.

I'm running OS X Snow Leopard. I've never installed PuTTY on my machine.

Does this mean my machine has been compromised, and by a Windows computer?

Answer 1

According to this page, it's a sign of a Windows trojan only (?).

On Unix, PuTTY actually stores its data under ~/.putty, so that's normal too. So, no harm done – but just to be safe, and if you don't actually use PuTTY, delete the whole directory.

As always, make sure you don't have any Sharing options enabled under System Preferences that you don't want. You can also check open internet connections with sudo lsof -i for anything suspicious.

Answer 2

Noticed the same thing today, found ~/.putty/sshhostkeys containing keys for some DB servers I use frequently. I was pretty concerned.. turns out that it was created after using a SQL GUI client. It had a feature to connect to your DB via SSH Tunnel. instead of using ~/.ssh directory it creates a .putty directory and stores its host keys there.

Answering a really old question, but I noticed this today as well. As this was 4th Google hit for ".putty osx" and the accepted answer not being very helpful

Answer 3

I can even clarify this furthers.

This directory is created by Filezilla for OS X. You can safely delete it and start Filezilla again.

You will then see Filezilla complaining about a syntax error, and every host you try to connect from your address book will throw an "Unknown Hostkey" info.