Intruder combat training 1 hacked iso#
Intruder combat training 1 hacked Offline#

Another thing which is going to help is to buy more servers and separate services even more. We were alerted very fast and we were able to be alerted because people could find contradicting MD5s (and that’s mostly because the MD5s aren’t just in one place, but in many). 🙂 I’m sure whatever you guys end up doing will be great!Īlso, do you think you could make an announcement on the forums/link this one there?Įdit by Clem: What really helps here is duplication and the community. Just an idea but thought you might be interested. I mean, even I could easily create a gpg key that claims to be from Clement Lefebvre, but it would be much harder for me or an actual attacker to then sign that key with the keys of several other members of the community. That way more trust could be put in the Mint key. To combat this, some of us in the community and on the forums who use gpg (I know of several besides myself) could sign the Mint gpg key with our own keys.

Intruder combat training 1 hacked iso#

iso md5sums were changed, the isos would still have incorrect gpg signatures.Īssuming you did start signing the releases and posting a link on the Linux Mint main page to the public Mint gpg key, an attacker could still replace the isos with malicious ones and replace the key link with one that links to his own.

That way if the server was hacked, the isos were replaced, and the publicly listed. 😀 Thankfully I haven’t downloaded anything within the last few days.Ĭonsidering that this might happen again, have you guys considered some sort of way (besides md5sums) that we can verify the ISOs come from you? Maybe something like GPG? I guess being targeted is the price you have to pay for making the most popular Linux distro. Thanks for being straightforward and quick to let us know. If you’ve been affected by this, please do let us know. If more efforts are made to attack our project and if the goal is to hurt us, we’ll get in touch with authorities and security firms to confront the people behind this. What we don’t know is the motivation behind this attack. We don’t know their roles in this, but if we ask for an investigation, this is where it will start. The hacked ISOs are hosted on 5.104.175.212 and the backdoor connects to .īoth lead to Sofia, Bulgaria, and the name of 3 people over there. We took the server down while we’re fixing the issue. Change your passwords for sensitive websites (for your email in particular).Reinstall the OS or format the partition.If you burnt it to USB, format the stick. Once in the live session, if there is a file in /var/lib/man.cy, then this is an infected ISO.ĭelete the ISO.

Intruder combat training 1 hacked Offline#

If you still have the burnt DVD or USB stick, boot a computer or a virtual machine offline (turn off your router if in doubt) with it and let it load the live session.

If you still have the ISO file, check its MD5 signature with the command “md5sum yourfile.iso” (where yourfile.iso is the name of the ISO). If you downloaded via torrents or via a direct HTTP link, this doesn’t affect you either.įinally, the situation happened today, so it should only impact people who downloaded this edition on February 20th. If you downloaded another release or another edition, this does not affect you. Hackers made a modified Linux Mint ISO, with a backdoor in it, and managed to hack our website to point to it.Īs far as we know, the only compromised edition was Linux Mint 17.3 Cinnamon edition. It was brief and it shouldn’t impact many people, but if it impacts you, it’s very important you read the information below.