Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Beware of hacked ISOs if you downloaded Linux Mint on February 20th

blog.linuxmint.com

Post reply on HN
Print view View original

21–30 of 62 posts

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#21

Post by btrask »

bcl wrote: post #19
btrask wrote: post #16

I was trying to download Linux securely a month or so ago. It's actually embarrassingly difficult to do. The only two distros that did it right (that I could find) are Debian and Alpine Linux. The rest (including Mint and Ubuntu) had hashes (usually MD5) or GPG keys served over HTTP.

Fedora publishes GPG signed SHA256's of the iso's. eg. https://dl.fedoraproject.org/pub/fedora/linux/releases/23/Wo...

Thanks! Fedora was one I didn't try (to install; I use it all the time). However there's still no way to use RPMFusion: http://rpmfusion.org/keys

Maybe there's something I'm missing?

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#22

Post by chei0aiV »

btrask wrote: post #16

I was trying to download Linux securely a month or so ago. It's actually embarrassingly difficult to do. The only two distros that did it right (that I could find) are Debian and Alpine Linux. The rest (including Mint and Ubuntu) had hashes (usually MD5) or GPG keys served over HTTP.

If you can think of any improvements Debian could make, please do suggest them via bug reports or on the mailing list. If you would like to work on fixing some of our issues, here are the ones we know about:

https://wiki.debian.org/Hardening/RepoAndImages

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#23

Post by anaphor »

btrask wrote: post #21
bcl wrote: post #19

Earlier quoted context omitted.

Fedora publishes GPG signed SHA256's of the iso's. eg. https://dl.fedoraproject.org/pub/fedora/linux/releases/23/Wo...

Thanks! Fedora was one I didn't try (to install; I use it all the time). However there's still no way to use RPMFusion: http://rpmfusion.org/keys Maybe there's something I'm missing?

Arch Linux has PGP signatures and is over https, as well as torrents which should be pretty reliable https://www.archlinux.org/download/

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#24

Post by btrask »

chei0aiV wrote: post #22
btrask wrote: post #16

I was trying to download Linux securely a month or so ago. It's actually embarrassingly difficult to do. The only two distros that did it right (that I could find) are Debian and Alpine Linux. The rest (including Mint and Ubuntu) had hashes (usually MD5) or GPG keys served over HTTP.

If you can think of any improvements Debian could make, please do suggest them via bug reports or on the mailing list. If you would like to work on fixing some of our issues, here are the ones we know about: https://wiki.debian.org/Hardening/RepoAndImages

Debian is already outstanding in this regard (and others)!

One minor suggestion would be to provide ISO hashes over HTTPS. It's just as secure as using GPG with fingerprints sent over HTTPS, and it's a lot easier.

The fingerprints (https://www.debian.org/CD/verify) could also be made more prominent (perhaps put on the main download page).

Thanks again!

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#25

Post by awda »

btrask wrote: post #21
bcl wrote: post #19

Earlier quoted context omitted.

Fedora publishes GPG signed SHA256's of the iso's. eg. https://dl.fedoraproject.org/pub/fedora/linux/releases/23/Wo...

Thanks! Fedora was one I didn't try (to install; I use it all the time). However there's still no way to use RPMFusion: http://rpmfusion.org/keys Maybe there's something I'm missing?

RPMFusion isn't considered part of Fedora. Yes, it would be nice if RPMFusion served hashes securely.

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#27

Post by miscellaneous »

btrask wrote: post #16

I was trying to download Linux securely a month or so ago. It's actually embarrassingly difficult to do. The only two distros that did it right (that I could find) are Debian and Alpine Linux. The rest (including Mint and Ubuntu) had hashes (usually MD5) or GPG keys served over HTTP.

I noticed last year that ubuntu.com - despite being the source from which most people download Ubuntu .isos - has no HTTPS capability and doesn't offer any checksums or gpg signatures on their download page. I believe you can find gpg signatures if you scratch around on their ftp server, but it is ridiculous to assume users will do this (especially when Ubuntu is trying to be a user-friendly distro).

Anyway, as a result I ended up emailing their webmaster asking why Ubuntu.com has no SSL cert. and I haven't heard anything back yet. I think it is pretty poor that a company like Canonical can have such a flagrant disregard for basic security practices, especially when it likes to market Ubuntu as a 'secure' OS.

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#28

Post by _jomo »

ryanlol wrote: post #11
mcpherrinm wrote: post #8

I am pretty sad they're posting MD5 sums of the correct images: It's pretty trivial to collide MD5 -- and when you've got an active attacker, this is something you should worry about. SHA1/2 at least, but preferably a gpg signature would be much better.

>It's pretty trivial to collide MD5 ... collisions=/=second-preimage attacks >SHA1/2 at least, but preferably a gpg signature would be much better. SHA1/2 isn't any better, you're never going to get hit by file corruption that magically also is a md5 collision.

How do you get hit by file corruption when downloading via TCP in 2016? I don't recall this ever happening to me.

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#29

Post by Dylan16807 »

mcpherrinm wrote: post #8

I am pretty sad they're posting MD5 sums of the correct images: It's pretty trivial to collide MD5 -- and when you've got an active attacker, this is something you should worry about. SHA1/2 at least, but preferably a gpg signature would be much better.

When talking about specific files the attacker used in the past, MD5 is good enough to show it's not those.

Re: Beware of hacked ISOs if you downloaded Linux Mint on February 20th

#30

Post by kbaker »

chei0aiV wrote: post #22
btrask wrote: post #16

I was trying to download Linux securely a month or so ago. It's actually embarrassingly difficult to do. The only two distros that did it right (that I could find) are Debian and Alpine Linux. The rest (including Mint and Ubuntu) had hashes (usually MD5) or GPG keys served over HTTP.

If you can think of any improvements Debian could make, please do suggest them via bug reports or on the mailing list. If you would like to work on fixing some of our issues, here are the ones we know about: https://wiki.debian.org/Hardening/RepoAndImages

Maybe in a GPG-signed release email add magnet URLs for the official torrents.

This is kind of in 'No magnet: links for bittorrent downloads on SSL'

Post reply on HN