Beware of hacked ISOs if you downloaded Linux Mint on February 20th
blog.linuxmint.com
Beware of hacked ISOs if you downloaded Linux Mint on February 20th
1–10 of 62 posts
Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th
#2What other ways are there to download, apart from http and torrents?
Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th
#3Does anyone know the start date ? I had a friend install it for their laptop two weeks ago
Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th
#4Does anyone know the start date ? I had a friend install it for their laptop two weeks ago
>We were exposed to an intrusion today.
> [...]
>Finally, the situation both happened and was solved today, so it should only impact people who downloaded this edition on February 20th.
Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th
#5Looks like something is going on again. Their website is down currently. [21-Feb 02:55 UTC]
Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th
#6Well that is scary. I personally don't check ISO checksums and signatures very often. Probably the only time I do is when I sometimes get install errors and wonder if I got all the bits and if anything got corrupted.
Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th
#7Well that is scary. I personally don't check ISO checksums and signatures very often. Probably the only time I do is when I sometimes get install errors and wonder if I got all the bits and if anything got corrupted.
> don't check ISO checksums
I've grown obsessive about it. When you're conscious about that it's amazing (to put mildly) how many prominent projects don't bother with any authentication.
Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th
#8I am pretty sad they're posting MD5 sums of the correct images: It's pretty trivial to collide MD5 -- and when you've got an active attacker, this is something you should worry about.
SHA1/2 at least, but preferably a gpg signature would be much better.
Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th
#9Well that is scary. I personally don't check ISO checksums and signatures very often. Probably the only time I do is when I sometimes get install errors and wonder if I got all the bits and if anything got corrupted.
If they managed to hack the site to point to the new iso, they probably also changed any checksums. Signatures help, if you have a way to verify that you are using the right key.
Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th
#10I'll just leave this here
forums.linuxmint.com pwd
/root/hacked_distros/mint/var/www/forums.linuxmint.com
forums.linuxmint.com cat config.php
But what would I know.