Hacking status of Linux Mint mirror downloads

Questions about the project and the distribution - obviously no support questions here please
SLLA
Level 1
Level 1
Posts: 2
Joined: Mon Aug 21, 2017 7:47 am

Hacking status of Linux Mint mirror downloads

Postby SLLA » Mon Aug 21, 2017 8:32 am

I am seeking confirmation from the official Linux Mint Team that there is no outstanding unfixed hacking of the University of Canterbury (NZ) mirror download site for downloading the ISO for Linux Mint 18.2 Cinnamon 64 bit onto a Linux system. I created a link to the site on 18th August and actually downloaded it on 20th August. I am intending to run it from a USB stick to try it out. I have been informed of the incident on 20th February last year but have not been able to locate an official Linux Mint notification that the problem was fixed, and I am also not sure how to keep track of whether there have been any other hacking incidents affecting Linux Mint since then.
My sincere apologies if this has all been answered/covered elsewhere by your Team. I am a newbie.

User avatar
xenopeek
Level 24
Level 24
Posts: 21381
Joined: Wed Jul 06, 2011 3:58 am
Location: The Netherlands

Re: Hacking status of Linux Mint mirror downloads

Postby xenopeek » Mon Aug 21, 2017 9:11 am

Please read the following article for more information: http://blog.linuxmint.com/?p=3007. As detailed there, the attacker shortly changed some download links on the Linux Mint website to point to their own server, on which they had placed a compromised ISO file. The mirrors themselves and the ISO files on them were not affected.

You can verify your ISO with these steps https://linuxmint.com/verify.php. We recommend you at least confirm the SHA256 checksum of your ISO file matches before you use it. That also confirms you downloaded the file completely and without errors. You can optionally also check the signature on the SHA256 checksum file to confirm that file originates from Linux Mint.

To keep up to date with Linux Mint news you can follow the blog http://blog.linuxmint.com/.
Image

SLLA
Level 1
Level 1
Posts: 2
Joined: Mon Aug 21, 2017 7:47 am

Re: Hacking status of Linux Mint mirror downloads

Postby SLLA » Wed Sep 20, 2017 5:54 am

Thank you for your help Xenopeek. I have been trying to follow the instructions in the link you gave me for verifying a Linux Mint ISO at https://linuxmint.com/verify.php and have hit a problem: The terminal response to the given commands to find out the ISO's SHA256 sum is 'no such file or directory'. I have tried this both by opening a terminal within the created ISO folder/directory containing the ISO file and the two other files, and also by opening a terminal one level higher in the folder/directory nesting/pathway with the ISO folder selected. Same result in both cases.
The system I am using to do this verification is Ubuntu 16.04.1 64 bit. I am a novice with Linux and using terminals so may well have missed something vital that is assumed. I am intending to run the Linux Mint 18.2 from a USB stick. Can you advise me further??

User avatar
Pjotr
Level 18
Level 18
Posts: 8850
Joined: Mon Mar 07, 2011 10:18 am
Location: The Netherlands (Holland)
Contact:

Re: Hacking status of Linux Mint mirror downloads

Postby Pjotr » Wed Sep 20, 2017 6:09 am

Tip: 10 things to do after installing Linux Mint 18.2 Sonya
Keep your Linux Mint healthy: Avoid these 10 fatal mistakes
Twitter: twitter.com/easylinuxtips
All in all, horse sense simply makes sense.


Return to “Non-technical Questions”