The Linux Mint team revealed today that their website was hacked and that the Linux Mint ISO images distributed from the official website on February 20, 2016 are insecure.
According to a blog post, the breach occurred on February 20th and was discovered shortly after. The official Linux Mint is down at the time of writing.
This means that attackers only had a limited time frame in which they would be able to distribute counterfeit ISO images.
The attackers managed to compromise the website and take control of the download links, which means that one of the company's servers offered dangerous Linux Mint ISO images.
The research team, after checking the dangerous distributions, found that the compromised version contains a backdoor that connects to a website hosted in Bulgaria.
They also discovered that only Linux Mint 17.3 Cinnamon downloads appear to have been affected by the hack.
What is interesting here is that torrent links were not affected, only direct links to the Linux Mint website are vulnerable.
The reason is simple; popular torrents are distributed by various seeders around the world in continuous circulation, making it impossible for hackers to manipulate the data, i.e. replace it with a hacked image.
If you downloaded Linux Mint on February 20th from the official website using direct links, or even earlier than February 20th and want to make sure it is clean, then you have the following options.
If you still have the ISO image available, you can check its signature to make sure it is valid. If you are running Linux, use the command md5sum nameofiso.iso, for example md5sum linuxmint-17.3-cinnamon-64bit.iso
Windows users can use a program like RekSFV or File Verifier to check the image they have in their hands.
The ISO image is clean if the signature matches one of the following:
6e7f7e03500747c6c3bfece2c9c8394f linuxmint-17.3-cinnamon-32bit.iso e71a2aad8b58605e906dbea444dc4983 linuxmint-17.3-cinnamon-64bit.iso 30fef1aa1134c5f3778c77c4417f7238 linuxmint-17.3-cinnamon-nocodecs-32bit.iso 3406350a87c201cdca0927b1bc7c2ccd linuxmint-17.3-cinnamon-nocodecs-64bit.iso df38af96e99726bb0a1ef3e5cd47563d linuxmint-17.3-cinnamon-oem-64bit.iso
You can also check your network traffic if you no longer have access to the ISO image because you may have deleted it. The dangerous version of Linux Mint 17.3 links to the page absentvodka.com (this may change, so check for any links that don't match your traffic).
Obviously, if you downloaded the ISO image just yesterday, you can download a legitimate ISO again from the official site using the torrent links, delete the old installation, format it, and install the new one.
This ensures that your system is clean and free of backdoor access.
The two main torrent files that you may be interested in are the following:
