Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Beware of hacked ISOs if you downloaded Linux Mint on February 20th

blog.linuxmint.com

Post reply on HN
Print view View original

11–20 of 62 posts

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#11

Post by ryanlol »

mcpherrinm wrote: post #8

I am pretty sad they're posting MD5 sums of the correct images: It's pretty trivial to collide MD5 -- and when you've got an active attacker, this is something you should worry about. SHA1/2 at least, but preferably a gpg signature would be much better.

>It's pretty trivial to collide MD5

... collisions=/=second-preimage attacks

>SHA1/2 at least, but preferably a gpg signature would be much better.

SHA1/2 isn't any better, you're never going to get hit by file corruption that magically also is a md5 collision.

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#12

Post by cmurf »

mcpherrinm wrote: post #8

I am pretty sad they're posting MD5 sums of the correct images: It's pretty trivial to collide MD5 -- and when you've got an active attacker, this is something you should worry about. SHA1/2 at least, but preferably a gpg signature would be much better.

In the comments section...

"You can find them at http://ftp.heanet.ie/pub/linuxmint.com/stable/17.3/ also along with signed sha256sums."

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#14

Post by cmurf »

ryanlol wrote: post #10

I'll just leave this here forums.linuxmint.com pwd /root/hacked_distros/mint/var/www/forums.linuxmint.com forums.linuxmint.com cat config.php Perhaps the insanely secure db credentials had something to do with the breach? But what would I know.

Might not hurt to post this in the comments section of the Mint blog.

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#15

Post by bogus- »

anishathalye wrote: post #13

It's somewhat disappointing that this blog article is served over HTTP, and it's impossible to access it via HTTPS. How do we know that these new MD5s are to be trusted?

Linux Mint doesn't seem to prioritize security in general. No TLS for ISOs, no easily spottable signatures for ISOs, marking security updates untrusted by default...

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#16

Post by btrask »

I was trying to download Linux securely a month or so ago. It's actually embarrassingly difficult to do. The only two distros that did it right (that I could find) are Debian and Alpine Linux. The rest (including Mint and Ubuntu) had hashes (usually MD5) or GPG keys served over HTTP.

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#17

Post by KMag »

ryanlol wrote: post #11
mcpherrinm wrote: post #8

I am pretty sad they're posting MD5 sums of the correct images: It's pretty trivial to collide MD5 -- and when you've got an active attacker, this is something you should worry about. SHA1/2 at least, but preferably a gpg signature would be much better.

>It's pretty trivial to collide MD5 ... collisions=/=second-preimage attacks >SHA1/2 at least, but preferably a gpg signature would be much better. SHA1/2 isn't any better, you're never going to get hit by file corruption that magically also is a md5 collision.

I think I understand you, but I think you could be a bit more explicit in your assertion.

I think you're saying MD5 is still a decent checksum for non-cryptographic purposes. Without a cryptographic signature or other authenticated integrity-checked distribution channel, there's very little advantage of using a cryptographic checksum.

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#18

Post by orionblastar »

cmurf wrote: post #14
ryanlol wrote: post #10

I'll just leave this here forums.linuxmint.com pwd /root/hacked_distros/mint/var/www/forums.linuxmint.com forums.linuxmint.com cat config.php Perhaps the insanely secure db credentials had something to do with the breach? But what would I know.

Might not hurt to post this in the comments section of the Mint blog.

If they used the same password on the forums and blog then they still have a problem. They need to be notified of this and change the password to a more secure one.

The config.php file should not be readable by an anonymous user, that is a security risk.

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#19

Post by bcl »

btrask wrote: post #16

I was trying to download Linux securely a month or so ago. It's actually embarrassingly difficult to do. The only two distros that did it right (that I could find) are Debian and Alpine Linux. The rest (including Mint and Ubuntu) had hashes (usually MD5) or GPG keys served over HTTP.

Fedora publishes GPG signed SHA256's of the iso's. eg. https://dl.fedoraproject.org/pub/fedora/linux/releases/23/Wo...

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#20

Post by ryanlol »

orionblastar wrote: post #18
cmurf wrote: post #14

Earlier quoted context omitted.

Might not hurt to post this in the comments section of the Mint blog.

If they used the same password on the forums and blog then they still have a problem. They need to be notified of this and change the password to a more secure one. The config.php file should not be readable by an anonymous user, that is a security risk.

>The config.php file should not be readable by an anonymous user, that is a security risk.

Yes usually unauthorized people having access to your server results in various security risks.

Post reply on HN