Comments on: Beware of hacked ISOs if you downloaded Linux Mint on February 20th!

By: ranjan

ranjan — Sat, 12 Mar 2016 07:45:23 +0000

also
anymore information as whn needed pls mail, will take week or so to reply as i travel 2 areas without net xcess

By: ranjan

ranjan — Sat, 12 Mar 2016 07:42:30 +0000

i have been on linux since 2001 with caldera open linux to redhat and had finally settelled with pear, after it got discontinued moved to LM13 and is still my OS, as a promotee of UNix/LINUX i regularly help install mint of those willing to try mint as dual boot with windows
after seeing this beware notice, i checked from those on whom 17.2/17.3 was installed in cinn/mate/xfce/kde
a peculiar problem has been reported where in var/log files are generated using 5-6 gib space eating partition as full, while on my linuxmint13/ a 13 gib partition is nowhere near full space over years of use, i have suggested to mark auto delete old log after 7 days
this is being sent 2 u 4 whatever worth it maybe and if u cud suggest remedy, mds cannot be checked as the user stays away from me and is not tech savy
i also understand the frustation that u and your team faces with these pranksters probably jealous of linux and mint
wishing u the best

By: kevin xxx

kevin xxx — Thu, 10 Mar 2016 17:01:42 +0000

hi Clem, I believe I was hacked Prior to being admitted to hospital on the 9th February 2016. I had burnt a DVD containing Linux Mint 17.3 cinnamon 32 bit and found i could not access the Linux Mint website or Forum.
I eventually gave up and discarded the LM 32bit cinnamon disk, but not before I encountered a highly suspicious message from an eastern european country.
Since coming home from hospital I have changed the passwords on my router, wiped the hard drive and reinstalled LM 17.3 Cinn 64 bit. I am in the process of changing all my passwords for sensitive sites.
I read on one of the Linux websites that the hacker stated he had gained access to Linux Mint at the end of January. That would tally with my experience.
I am convalescing presently, so cannot enter in discussion about the above. I hope you find it useful.
kind regards, Kevin xxx

Edit by Clem: Hi Kevin, I removed your last name from the comment. Although we weren’t able to confirm it formally, we believe the hacker said the truth when claiming the first intrusion was on the 28th of January. That would mean encrypted passwords from the forums could have been cracked as early as that date. If your forum password was the same as on other websites, then by all means take this very seriously, especially if it was simple. Now, regarding the ISO, we believe the exposure from our website towards the fake ISO only lasted hours. It could have been the 19th of February, the 20th, the 21st even maybe, depending on your timezone, and the impact of that ISO running on a computer is that it had a backdoor in it, from which the hacker could have run local commands. That backdoor connected to a remote IRC server and people did report it messed their connection a little bit (we don’t know whether that was a side effect of the backdoor being used to flood another target, or some programming or manipulation error from the hackers). In terms of intrusions, we could confirm two of them on Feb 18th and Feb 20th and they confirm other claims from the hacker, so that leads us to believe he was telling the truth about Jan 28th.

By: steve

steve — Thu, 10 Mar 2016 08:05:17 +0000

If you are looking for a professional hacker with proof of skills. Contact at HacktivistAstra007@gmail.com. I executes jobs such as Change of Grades, Yahoo Passwords, Clearing of Criminal Background, Fake IDs, Bank Transfers, Mobile Phone Hacks, Facebook Passwords, Instagram Passwords, Website Hacks, clear Credit Card Debt, CC for sale, Credit Score Matters, Socks, Rdp, Viruses, Build/hack apps etc. You can also get your deceased love ones medical records, if you are unsure about their death. Trial will convince you.A trail will convince you! Integrity and efficient service delivery is my core value.

Edit by Clem: I sure hope you’re using your services to make people happier and without harming anyone. For the record, the attack performed on us recently cost us a huge amount of development time, harmed our project and its reputation, gave the opportunity to some people who disliked us to publicly criticize us and exposed some of our users, either via the fake ISO they downloaded or via a weak forum password which was leaked. Customer satisfaction is key when you’re talented, but choose your customers wisely if your talent can be used to hurt.

By: Joe H (JoeFootball)

Joe H (JoeFootball) — Wed, 09 Mar 2016 20:08:39 +0000

@779 corkscrew: If you still have the ISO file, and it matches one of the hashes that Clem posted, then it’s very likely good.

Please note that unless you downloaded the ISO for Linux Mint Cinnamon desktop, for the 64-bit architecture, on February 20th, via one of the counterfeit IPs before the website was taken down, then it’s quite unlikely your ISO was affected.

By: Waarheid

Waarheid — Wed, 09 Mar 2016 18:54:14 +0000

Hello Clem,

Well done – discovering and them managing your business continuity was a major and well orchestrated effort on your part.

May I ask a question about a very trivial thing? The desktop backgrounds in Rosa – there is one I really love – Expo.

Where was the picture taken?

Best to all –

Waarheid

Edit by Clem: In Malcesine, Lake Garda, Italy.

By: Wzrd1

Wzrd1 — Wed, 09 Mar 2016 18:42:15 +0000

Good old WordPress, great platform, infamous for security bugs.
That said, it seems that webshells are all the rage these days. From Chinese organizations using them, now everyone is using them.
As for the attacks being from Bulgaria, there is a criminal organization that works out of there. Can’t discuss it further though, a big fat NDA is in the way of that.

By: corkscrew

corkscrew — Wed, 09 Mar 2016 01:29:43 +0000

Hi
I am a bit confused with your description on the md5 signatures you have listed above.
If the check sum of my iso matches one of the signatures in your list is my ISO ok or not?

By: Christos

Christos — Mon, 07 Mar 2016 16:55:33 +0000

Hello all,

I am one of the many people who opted out of anything Windows when XP became obsolete. Most of the newly minted (forgive the pun) Linux users come from where I came from.

I tried Ubuntu but I quickly changed to Mint and I am satisfied ever since.

I started using computers in the MS-DOS days, so, typing commands in a terminal is familiar. It was like owning cars: knowing how to drive wasn’t enough: you occasionally had to lift the hood and take care of things.

But many, many years later, no driver is required to open the hood of their cars and no computer-user is inclined to – god forbid – type in a… command? * are you serious * ?

This is – in my opinion – where Apple won the game: “forget about what’s under the hood; you concentrate on driving”. (Every Mac user I know – and they are many – falls under this category.)

As I said, I am happy with the Linux Mint universe and I am spreading the word. BUT: for the system, and the community, to make a difference, “things Linux Mint” have to:

1. keep users AWAY from the terminal

2. keep the repositories fresh and relevant: I am tempted to install software from places other than the repositories because i am promised the “latest version”. And this where problems begin: why the latest version isn’t in the repository? Am I missing out? What about that software that I can’t find in the repository? WHAT THE HELL IS A REPOSITORY? 🙂

You get the drift.
I hope I helped.

Christos

By: Joe H (JoeFootball)

Joe H (JoeFootball) — Mon, 07 Mar 2016 14:59:30 +0000

@775 Ben: If it’s not the correct hash, then I advise you not to use that ISO. It’s likely just a corrupted download, but regardless, make sure you’re getting the torrent file from the official source. https://www.linuxmint.com/edition.php?id=204