Stories
Slash Boxes
Comments

SoylentNews is people

Mint Cinnamon ISOs Hacked

posted by cmn32480 on Sunday February 21 2016, @03:16PM   Printer-friendly
from the ruh-roh dept.

Appalbarry writes:

If you downloaded Mint Cinnamon today (for versions of "today" that include February 20th, 2016) you should immediately check the MD5 checksum. Blog Entry here.

From Clem:

We were exposed to an intrusion today. It was brief and it shouldn't impact many people, but if it impacts you, it's very important you read the information below.

Hackers made a modified Linux Mint ISO, with a backdoor in it, and managed to hack our website to point to it.

As far as we know, the only compromised edition was Linux Mint 17.3 Cinnamon edition.

If you downloaded another release or another edition, this does not affect you. If you downloaded via torrents or via a direct HTTP link, this doesn't affect you either.

Finally, the situation happened today, so it should only impact people who downloaded this edition on February 20th.

Apparently the hacked ISOs are hosted on 5.104.175.212 and the backdoor connects to absentvodka.com. Both lead to Sofia, Bulgaria, and the name of 3 people over there.

The comment thread suggests that the ISOs are showing up in other places, and that the Mint site may still not be entirely secure.

Original Submission

 
This discussion has been archived. No new comments can be posted.
Mint Cinnamon ISOs Hacked | Log In/Create an Account | Top | 54 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 0) by Anonymous Coward on Sunday February 21 2016, @06:45PM

    by Anonymous Coward on Sunday February 21 2016, @06:45PM (#307815)

    Thanks, that was an interesting read.
    It seems key signing parties really are worth the effort.

  • (Score: 2) by Pino P on Monday February 22 2016, @09:20PM

    by Pino P (4721) on Monday February 22 2016, @09:20PM (#308362) Journal

    It seems key signing parties really are worth the effort.

    With respect to the OpenPGP web of trust and key signing parties, I've always wondered about two things. The first is where users of OpenPGP applications are supposed to find the money for air travel in order to get their keys signed by people living in faraway cities. The second is how the trust implied by the binary relation "Alice signed Bob's key" can be transitive. Just because I can vouch for the identity of somebody I have met at a key signing party doesn't mean I can vouch for that person's ability to vouch for other people's identities. This is why X.509 certificates (RFC 5280 [ietf.org]) have the cA bit in the basic constraints to warn people relying on the certificate that its subject is not itself a certificate authority.