Linux Mint Website Hacked /ISO's compromised

[Night Hawk]

I think you missed the point being made as a general statement that applies mostly to novice users taking a look a monthly flavor but nowhere near serious about running any distro full time! The kid's toy factor is seen mainly with LM not the regular ubuntu or Debian distros themselves.

The statement made earlier about the three simply not working together to keep everyone updated and a bit more secure with the Linux Mint distributions being the more recent new kid on the block in the Linux collection of flavors is a potential risk factor for those Windows users who decide to try one of those releases out. I just happen to be in full agreement with the statements made by both Barman58 at the top of the thread as well as the observation which holds true by Kari from having tried working with ubuntu, Debian releases of Knoppix live, and several others looked at trying to figure out how to even get things done!

Barman58 expressing the awkwardness of trying to get things made usable so others could also run with Linux present could be easily identified with there. The toying around part is the too often common place event for those who simply want toy around with dual boots and multiple boots of the other guy's OSs there without any serious Linux adaptation being seen. You will also hear people they will be switching to Linux IF? and that's also proves to be a big IF? something they don't like is seen with Windows? Yet the same people are running 10 on their machines! hhhmmmmm....

And don't ask me to name any! That's their business and preferences just like anyone else has a right to their own! I also think by now most are familiar with the term UNIX Platform since not only Linux was derived from that but take a good look at the fruit company offerings as well as what Google has been working with as far as their Google OSs Firefox OS. Have the Nightly beta on one of the 10 VMs to see what is about.

A lot of that of course results in seeing OSs for hand held type devices where the OS is embedded like you new smart watch as an example! One example of that is one friend now retiring had been asking about getting a laptop for himself which would be a first for him and for the time being clicking the like button and sharing things via Facebook on his touchscreen compact phone! Likely a Samsung or LG there.

Another friend would pay a visit to a local dictionary publisher and be stunned by the row of switches on a panel where the op there can switch back and forth between any number of OSs! He has to be able to reference from all of them as part of the job! That includes all Linux distributions as well as some you might not have even heard of! Most of those that have been around for decades at this time are not the main concern however since they have been seeing continued support and gradual progression over the years while the smaller desktop mainly some only live only distros have been advised for things like live data recovery making them an asset on any machine and OS platform the distro being used has support for like NTFS as well as Fat volumes and the UNIX based stuff on the others.

Well the breach seen at the Linux Mint forums as well as main download servers won't be adding up to so much the distro will no longer be safe to try out the fact that this type of breach could be a staging ground for something else on a much larger scale is what actually has some concern here! You'll see reports about cyber threats and now you are looking at a potential for a big one!

 

[lehnerus2000]

Learn Once, Use Everywhere

Presumably "dual booters" already have have stacks of Windows software, so why should they spend any time messing around with free alternatives?

I have MS Office installed in W7, so why should I bother to start Linux Mint to use Libre Office?

I have Photoshop and GIMP, but I almost never use Photoshop.
The GUI is awful and I don't need to use Photoshop's photo tools (in general Photoshop has better tools).
Obviously I can't use it when I'm running Linux Mint.

Most of my software is Open Source and those programs work (almost) exactly the same in Windows and Linux Distros (learn once, use everywhere).

 

[whs]

If you have a computer with Windows pre-installed, then there is little incentive to use Linux. But if you have to go out and buy a Windows OS, then Linux may be an attractive option. It is also useful as a live CD or stick to overcome some of the Windows data management problems. And for Internet work it is supposed to be safer - smaller chance to catch malware.

 

[michael diemer]

This hacking of Mint affected a very small number of people. Only those who downloaded the latest version of Cinnamon that day, and only from the Mint website. In fact, the OS itself was not hacked. It was the website that was hacked. A hard drive reformat an re-installation is needed, but that's the worst of it. Linux continues to be far safer than Windows. It's a numbers game. If anything, MS should be hoping lots more people run Linux, to spread the risk around a bit more.

 

[Golden]

This hacking of Mint affected a very small number of people. Only those who downloaded the latest version of Cinnamon that day, and only from the Mint website. In fact, the OS itself was not hacked. It was the website that was hacked. A hard drive reformat an re-installation is needed, but that's the worst of it. Linux continues to be far safer than Windows. It's a numbers game. If anything, MS should be hoping lots more people run Linux, to spread the risk around a bit more.

:sarc:
The ISO was compromised/hacked, as well as the site....read the advisory again.

 

[Night Hawk]

The hack was to upload ISOs already botted to form a botnet. Don't forget it wasn't just the polluted uploads but the 71,000 LM accounts on the forums there that had been part of the exploit. What that means is email addresses for 71,000 who could suddenly be enticed by a bogus forum message to try out a new release and WHAMO! We got ya! coaxing the membership into using the laced iso images.

While the number of people who downloaded that night would have been small you can see how many many more could have been conned into downloading the bugged iso. That could be done by someone being on the forum itself and talking about how one variation was a champ and post a link to the bogey server they set up or have people linked into the botnet to use as internet sharing medium to spread the bots much further then simply off of a single bug site.

 

[whs]

That sounds awful. Nothing is sacred any more. People who do that should be locked up for 25 years with useful work for 12 hours each day including Sundays and holidays.

 

[Night Hawk]

Well this particular incident may not sound like a lot if it was some type of test run for something else on a larger scale the lack of having any effective security measures in place is something that should be considered a large wake up call!

The fact that it was discovered at least for the time being kept any number of people from the bugged up downloads limiting it to that one day alone while the other part of the vast number of accounts is the real concern as to how all that data could be exploited! If you look at the laced iso image as simply being a diversion from the actual intended goal besides the supposed botnet the report suggests then the account information with personal email addresses typically used to log into sites is a nice prize for someone wanting to either spread malwares or find some way to scam potential victims in some manner.

There's way to know what the possible long range objective would be been without the authorities having had preknowledge and setting a sting op in order to trace everything the hacker or hackers were upto. The exploit of that particular distro's home site doesn't mean other distros are not so likely to see or have already seen in some cases similar pollutants added in. The standard ISO format is used for all distros as well as Windows downloads as well remember! You can be sure that with this news the other Linux sites will be boosting their security levels up!

 

[lehnerus2000]

You can be sure that with this news the other Linux sites will be boosting their security levels up!

They could start by getting rid of WordPress (I read that WordPress was somehow involved).

WP seems to be almost as great a security hazard as Flash or Java.

 

[michael diemer]

That sounds awful. Nothing is sacred any more. People who do that should be locked up for 25 years with useful work for 12 hours each day including Sundays and holidays.

Agreed. In Northern Alaska.

 

[Night Hawk]

I generally try to avoid anything to do with Word Press, Linkedin, and others since you are leaving things wide open at times. Flash can be a real pain lately as I have been seeing with the latest FF versions as well as with the FF variants like Waterfox and Cyberfox. You get this allow or deny square prompt stuk in the middle of a video clip and are not able to click either option to close that out. It simply freezes on the spot until you close the browser window or move off of the page.

 

[mjf]

I generally try to avoid anything to do with Word Press, Linkedin, and others since you are leaving things wide open at times.

What's your issue with Linkedin. I know there is at least one but it is for professional networking and has ~400 million members. Things like Facebook and Twitter are more about social non Prof networking. I think Facebook is crossing the boundary into business exposure.

 

[Night Hawk]

I generally try to avoid anything to do with Word Press, Linkedin, and others since you are leaving things wide open at times.

What's your issue with Linkedin. I know there is at least one but it is for professional networking and has ~400 million members. Things like Facebook and Twitter are more about social non Prof networking. I think Facebook is crossing the boundary into business exposure.

With Linkedin you have the 400million emails along with the 400million members asking if you know this person but try and follow someone you do know and get nowhere with it. That wasn't so much a security type problem but became more of an annoyance after a period of time.

Facebook has been more about something else lately! Just remember that when clicking the Like button which now sees a few new smiley faceD --) options as well as the "love" option added the familiar like.FB has more or less turned into a vendors paradise.

The new "Page You May Be Interested in" props up with a list of places you never even heard of before and find yourself automatically following them? FB automatically saw to that based on your "likes"! keeping track of every thing you click on. The "People You May Know" now is not only seen in the column on the right side there but right smack in the middle of your time line showing how that one is being changed around quite a bit.

As far as Twitter everything you say there goes all over everywhere and you may end up with seeing a rather lengthy list of people following you when you subscribe to the news feeds of places like ZDNet, PC World, ComputerWorld, etc. The worst however is to be aware of potential scams on FB! Some had been floated there in the last couple of years. The updated and more full featured av softwares are now seeing social network scan options on the better programs.

 

[Barman58]

I totally gave up with LinkedIn a while ago, closed my account ETC , but I still get their spam to this day, Getting an inbox full of rubbish from people you do not know and if you did you'd avoid them - It's a good idea but so badly run it's unusable for me.

as for F***book what a commercial for stupidity that is, I do have an account as some of my family and friends use it, but I rarely open it, I've disabled the thing on my phones and tablets due to the fact it was constantly updating almost everyday - and it loads a messenger app that's three times the size of the app I already use to send messages and a has less than a tenth of the usability

 

[Night Hawk]

You hit that one right on the head there! Royal pita would be another name for the cluttered inbox! You would think by now who ever is running Linkedin would realize a million email for people you wouldn't know or have any interest in would totally useless and nothing but a total annoyance.

On the FB side of the equation I have regular contacts and have to put up with the crapola! Once is a former program developer who been active here for a time but moved on to starting up a family business with a few FB pages of his own. Then I have a few blog writer as well as other contacts and friends being blotted out often by a bunch of garbage on the time liine there.

The Chat option will have all your contacts lined up and show a greet dot when one in on. But that will popup simply clicking on the corner. Unless you click or tap on the blue banner at the top the popup list of contacts will stay open. For the main time line feed one trick to keep that from getting overly saturated is to simply unfollow anything and everyone you don't polluting the main news feed there. Who cares if someone changes their profile pic or liked something. Clutterville!

 

[ThrashZone]

I generally try to avoid anything to do with Word Press, Linkedin, and others since you are leaving things wide open at times.

What's your issue with Linkedin. I know there is at least one but it is for professional networking and has ~400 million members. Things like Facebook and Twitter are more about social non Prof networking. I think Facebook is crossing the boundary into business exposure.

Yea I believe everyone is a sucker once
I'd bet 300 million of those members never returned 2 days after creating the spam magnet account

 

[Night Hawk]

I generally try to avoid anything to do with Word Press, Linkedin, and others since you are leaving things wide open at times.

What's your issue with Linkedin. I know there is at least one but it is for professional networking and has ~400 million members. Things like Facebook and Twitter are more about social non Prof networking. I think Facebook is crossing the boundary into business exposure.

Yea I believe everyone is a sucker once
I'd bet 300 million of those members never returned 2 days after creating the spam magnet account

Try more like 399.999999 million! fed up with it after the first few days! All I kept getting in was the lame brain spam junk mailing and not even actual updates from the contacts I do have. That was dumped for good after seeing enough of that!

Twitter was another one there where I had numerous followers after clicking the follow us on Tweedlee dummer on several new sites and simply never being on it! Having that or an FB account is a requirement on another site however and I still have to keep FB anyways despite the new aggravations being seen there.

 

[z3r010]

I must have my linkedin set up different to you guys because I don't get any of the stuff you describe.

 

[whs]

I must have my linkedin set up different to you guys because I don't get any of the stuff you describe.

Neither do I. My system was always kept clean.

 

[Night Hawk]

It have something to do with the level of activity as well as how you have things configured. Here despite having it I am not running a business or other type of situation where I would generally see any activity on with it. Someone at the opposite end of the state even had an opening for a IT tech he was trying to fill that wasn't going to happen while he had suggested that at the time.

The emails that started coming in too often were much like Facebook's "People you may know" after typically seen in the right column there however after adding any new friends in or simply being in any social groups. Not being in the profession where I have the need for being promoted that actually served no purpose here anyways! While you wouldn't be apt to see any security risk as far as your system being exposed your personal information is out there on the web however being another concern entirely.