The 'is my Mint safe?' thread (after Feb 20th 2016 hacks)

[Jedinovice]

People are still confused about Mint and how safe it is. The blog is still being loaded with questions like 'Is Mint Safe? Do I need to do anything? Is it time to jump to Fedora' or whatever. If the crackers intention was to sow confusion, fear and doubt they have achieved their objective.

To try and clear things up I figured a Q&A guide as to the status of Mint Linux was needed and the posters asking "Is my version of Mint safe" can come here and air their fears. (They will come here. A lot of Mint users, even when they read the status, still need assurance and want to confirm that THEIR SPECIFIC install is safe - even if it is 32 bit XFCE 17.2! Let's be patient and deal with these folks gently. I will then keep linking to this post from the blog. Generally speaking, when people are nervous, there is no such thing as over explaining.)

So here is the status on Mint. Long post but I give am anticipating the FAQs that have appeared in the blog! IF YOU ARE WORRIED ABOUT YOUR MINT INSTALLATION - READ ON!

AM I SAFE?

*Almost* certainly.

99.8% of users of Mint were never in danger and are unaffected. The odds are that your installation is safe and you are fine as I will explain.

WHAT ACTUALLY HAPPENED? (AND DOES IT PUT ME AT RISK?)

On the 20th February 2016 a cracker/hacker managed to gain access to the Mint website. They then changed the link to the 64bit Cinnamon edition of Mint and made it point to an altered ('fake') version of Mint located in Bulgaria which had some nasty malware included.
If a user downloaded SPECIFICALLY the 64 bit edition of Cinnamon on EXACTLY the 20th February and installed Mint then they need to download the ISO image again - the link has been corrected - and re-install, formatting their hard drive.

Note the following:

If you are running any other version of Mint - MATE, KDE, XFCE, any 32 bit edition - you are completely safe and secure.
If you installed any version prior to the 20th February 2016 then you are perfectly safe.
If you are running any version of Mint 17.0 (Qiana) 17.1 or 17.2 you are fine.
If you are running any version of Mint 13 you are fine.
If you downloaded SPECIFICALLY the 64 bit edition of Cinnamon 17.3 on EXACTLY the 20th February then you need to run a check on the ISO image you installed from (details given further down)

This hack really only affects a very small number of people.

I DID NOT DOWNLOAD ANY VERSION OF MINT ON THE 20th. AM I SAFE?

Yes. The attack lasted no more than one day.

I DO NOT RUN MINT CINNAMON. AM I SAFE?

Yes. The hacker only targeted Mint Cinnamon edition.

I AM RUNNING MINT CINNAMON BUT VERSION 13, 17.0, 17.1, 17.2 AND NOT 17.3. AM I SAFE?

Yes. The hacker only targeted Mint 17.3.

I AM RUNNING MINT CINNAMON 17.3 32 BIT. AM I SAFE?

Yes. The hacker only targeted the 64 bit edition of Mint Cinnamon 17.3

I DID DOWNLOAD THE 64 EDITION OF MINT CINNAMON ON THE 20th February 2016. AM I SAFE?

Er, possibly not. You need to carry out the following check - but only if you did a direct download from the Mint Link and not a mirror or a torrent.

The check (as described on the blog)

How to check if your ISO is compromised?
If you still have the ISO file, check its MD5 signature with the command “md5sum yourfile.iso” (where yourfile.iso is the name of the ISO).
The valid signatures are below:
6e7f7e03500747c6c3bfece2c9c8394f linuxmint-17.3-cinnamon-32bit.iso
e71a2aad8b58605e906dbea444dc4983 linuxmint-17.3-cinnamon-64bit.iso
30fef1aa1134c5f3778c77c4417f7238 linuxmint-17.3-cinnamon-nocodecs-32bit.iso
3406350a87c201cdca0927b1bc7c2ccd linuxmint-17.3-cinnamon-nocodecs-64bit.iso
df38af96e99726bb0a1ef3e5cd47563d linuxmint-17.3-cinnamon-oem-64bit.iso
If you still have the burnt DVD or USB stick, boot a computer or a virtual machine offline (turn off your router if in doubt) with it and let it load the live session.
Once in the live session, if there is a file in /var/lib/man.cy, then this is an infected ISO. You need to reformat you hard drive and re-install Mint in this case.

[Note: A kind poster has given a detailed guide on how to check your ISO image further down this page.]

I DOWNLOADED MINT VIA A TORRENT. IS IT SAFE?

Yes. The faked version of Mint was not available via torrent at any time.

I DOWNLOADED MINT VIA A MIRROR. IS IT SAFE?

Yes. The faked version was only available from the hacked Mint website via one hacked link.

The whole attack was actually very isolated - but very high profile!

I HAVE RUN UPGRADES SINCE THE 20th FEBRUARY. AM I SAFE?

Yes. The ONLY thing altered by the hacker was the link to the Cinnamon edition of Mint.
Updates have always been perfectly safe and remain so.

I HAVE INSTALLED SOFTWARE FROM THE REPOS ON/AFTER THE 20th FEBRUARY. AM I SAFE?

Yes. The repos were not affected, All updates, all software is safe.

I HAVE PPAS FOR SOME SOFTWARE. HAVE THEY BEEN 'INFECTED?'

There never was an infection! This was not a virus or malware attack. It was a website attack!
PPAS are fine. Nothing has changed.

IS MINT LINUX SAFE?

Yes. Mint Linux remains as safe as it ever was. No viruses were sent to Linux.
There is no need to buy virus checking software or jump to another distro or run to Windows.
It was not Mint that was attacked, it was the WEBSITE! Yes, a messed up version of Mint was created and some users, a very small number, downloaded and installed it. But the hacker had to create his own 'version' of Mint, change the website link and have people install the entire operating system to install the malware.
He/they did not 'seed' software, create a virus or penetrate the security of Mint.
Mint remains as stable and safe as it ever was. (And that's why I am still using it.)

SO I AM SAFE?

Yes, unless you are one of the very few who just happened to download the fake version of Mint on the 20th then you need to check your ISO for the malware and re-install using the real Mint available from the usual place.
But if you did not download SPECIFICALLY the 64 bit Cinnamon edition of 17.3 on EXACTLY the 20th you have absolutely nothing to worry about.

If you are one of the unfortunate few to have installed using the fake Mint rendering then you need to format your hard drive - a pain, I know, and re-install using genuine Mint. But Mint remains as stable and secure as it always was and will be fine after a re-install using the real version of Mint.

NOTHING HAS CHANGED!

HAS THE MINT TEAM TAKEN ACTION SINCE THE HACK?

Absolutely. Exact details have yet to be forthcoming from Clem and co. as they have been busy trying to put things right. He has promised a full report in time but there are many factors in play - including legal and investigative, so Clem is not yet in a position to give all the technical details.

However, we do know that the hack was discovered on the same day it occurred. Clem immediately shut down the Mint website to prevent further download of the faked rendering of Mint.
The link to Mint was corrected and security checks run including obtaining 'traces' of the attack and information that may help lead to the prosecution of the attackers.
Clem has stated that the following have since taken place to make the Mint website more secure, and I quote:

– We’ve hardened things
– We’re now behind a global firewall
– We’re now using new servers
– We’re now using https (which is forced for community and forums)

Clem has promised more information later when everything is bedded down and, doubtless, when legal authorities have been consulted. This is a serious crime that requires investigation and, I would imagine, blurting out everything that has happened and is happening, could compromise an investigation. (That is surmise on my part but highly likely given the circumstances.)

Please understand that this was a website attack and NOT a malware attack on Linux. No trojans, viruses or whatnot were released 'into the ether' to infect Mint installations.

This attack is being confused the more common virus, malware attacks one can pick up from general software installs or web browsing. This attack was nothing like that! The hacker attacked the website and replaced one download link, for a grand total of one day, for one very specific version of Mint for his own fake/doctored version of Mint that included malware.

That link has gone - done, vanished. Real Mint remains as secure as ever and nothing else is infected. You cannot pick up this malware any other way than by installing Mint from the doctored ISO image.

A LOT OF PEOPLE ONLINE ARE CLAIMING THAT MINT IS INSECURE AND NOT A FIT AND PROPER DISTRO FOR USE. IS THIS TRUE (BE HONEST!)

No - and that's being honest. Mint is one of the most popular Linux distros around and with good reason - and possibly the reason for the attack. If Linux was a 'broken' Linux distribution, insecure and prone to viruses and malware, not only would it be less popular, people on these forums would know about it. Mint has been extremely robust and remains so.
Again, the attack was on the website and not a general security breach for Mint itself.
There has been a huge amount of misunderstanding of the nature of the attack and lot of fear, rumor and hearsay. The fact is the Mint remains as solid as ever.

Hopefully this makes things clear. Nothing has changed in regards to the general operation of Mint and claims this proves Mint Linux is insecure, prone to infections, etc, etc are completely false.

[openmind]

If a user downloaded SPECIFICALLY the 64 bit edition of Cinnamon on EXACTLY the 20th February
......
If you are running .....any 32 bit edition - you are completely safe and secure.
....
If you downloaded SPECIFICALLY the 64 bit edition of Cinnamon 17.3

....

I AM RUNNING MINT CINNAMON 17.3 32 BIT. AM I SAFE?

Yes. The hacker only targeted the 64 bit edition of Mint Cinnamon 17.3

.

Please be careful with information about this very sensitive topic.

https://i.imgur.com/jDl5zbU.png

[Farjohn]

Thank you, Jedi. You've performed a valuable service here. (And note your promotion;-)

[Icarus149]

Don't get me wrong, I really appreciate this ... but I wish this kinda statement comes from an "official" mint representative. I think you wrote this post from the best of your knowledge, but do you take the responsibility for that?

I wish the mint representatives also comment on what is currently written on the Debian-Forums regarding this issue and the security concept of Mint in general. This really unsettles me at the moment and I'm seriously considering to dump Mint and move to a different distro...

[killer de bug]

I wish the mint representatives also comment on what is currently written on the Debian-Forums regarding this issue and the security concept of Mint in general. This really unsettles me at the moment and I'm seriously considering to dump Mint and move to a different distro...

This has been addressed several times in the past years. I don't see any reasons to waste more time discussing it again and again.

To keep it short, all security updates available in Debian and Ubuntu are in Linux Mint. As simple as that.
For your information, the guy making these attacks on Debian forums is not even aware that the Mint Update manager has a special menu to install a new kernel. He is sure that you can only do it with the terminal in Linux Mint. Therefore, based on this, you can assess the quality of his judgment.

Anyway, as you know, every time there is an attack somewhere, sharks are immediately coming.

[The-Wizard]

This to me is a ridiculous discussion, ALL operating systems get attacks from time to time, As we all know Microsoft is more than most, we also know no operating system is bullet proof, and anyone aware of business tactics will also know the time to kick your opposition it's when its suffering.
Apart for a comparatively few people who unwittingly downloaded the doctored version of mint on the 20th of February all others are not in danger, This was a server attack, these happen on a daily basis around the world and no one is totally immune, [unless we rummage the world and shoot every hacker] international banks to goggle, from what I understand the management team have been and are working to make this form of intrusion more difficult,
But at the end of the day a user with a clean installation is as safe with debian/ubuntu based distros as they would be with Fidora flux box etc and safer than Microsoft users.

wizard

[Jedinovice]

If a user downloaded SPECIFICALLY the 64 bit edition of Cinnamon on EXACTLY the 20th February
......
If you are running .....any 32 bit edition - you are completely safe and secure.
....
If you downloaded SPECIFICALLY the 64 bit edition of Cinnamon 17.3

....

I AM RUNNING MINT CINNAMON 17.3 32 BIT. AM I SAFE?

Yes. The hacker only targeted the 64 bit edition of Mint Cinnamon 17.3

.

Please be careful with information about this very sensitive topic.

https://i.imgur.com/jDl5zbU.png

The data from Clem on the blog was clear - only the 64 bit edition was modified but that wasn't known at the time of the initial blog post.
To quote Clem:

Edit by Clem: Yes, it was from today. 64-bit definitely, 32-bit didn’t show links but was found on the Bulgarian server, so it looks like they were preparing to compromise this one as well later on.

They were 'cut off at the pass' as it were.

However, I am trying to be accurate and will take corrections. I agree this is a sensitive topic - nor 'arf - and why we need to help as much as we can. Thanks for the heads up.

[Jedinovice]

This to me is a ridiculous discussion, ALL operating systems get attacks from time to time, As we all know Microsoft more than most, we also know no operating system is bullet proof, and anyone aware of business tactics will also know the time to kick your opposition it's when its suffering.
Apart for a comparatively few people who unwittingly downloaded the doctored version of mint on the 20th of February all others are not in danger, This was a server attack, these happen on a daily basis around the world and no one is totally immune, [unless we rummage the world and shoot every hacker] international banks to goggle, from what I understand the management team have been and are working to make this form of intrusion more difficult,
But at the end of the day a user with a clean installation is as safe with debian/ubuntu based distros as they would be with Fidora flux box etc and safer than Microsoft users.

wizard

I suppose its a sort of backhanded compliment.
Windows gets virused and malwared every day and people roll their eyes and carry on.

Mint gets ONE security scare - from a hacked version after a website attack - and everyone gets the vapors!
It shows people are still sensitive to security in Mint - which means it is secure! With Windows... people are desensitized!

[Radish]

Okay Jedinovice - excellent idea for a thread. But one thing missing for newbies: How do you actually do a check on an ISO using md5 or sha256? Here's a short guide on how to do the check:

==================================================
The guide below is my newbie way of trying to explain how to check Linux Mint ISO's using MD5 and SHA256 checksums in a Linux or Microsoft Windows system. What is the difference regarding checking via MD5 or SHA256? SHA256 is a much more secure check than an MD5 check. That said, for most purposes MD5 is okay because it's reasonably secure anyway. But in the longer run I would guess Mint will abandon MD5 sums and transfer to SHA256 (or higher) - extra security at no extra price - go for it.

==================================================


Step 1 - Get a Copy of the Official Checksums File(s)

For checking the MD5 and/or SHA256 of an ISO go here and get a copy of the checksums files for the version of Mint that you want to check: https://ftp.heanet.ie/pub/linuxmint.com/stable/. Tip: just click on the link that is the version number you want to check. (For the purposes of this tutorial I will assume that you want to check an ISO for Mint version 17.3.)

Once you are the correct webpage for the Mint version that you want to check right-click on the link titled md5sum.txt and select "Save Link As..." and save a copy of the text file to your hard-drive. Follow the same procedure for the link titled sha256sum.txt if you want to check the ISO against a SHA256 hash number. If you do this for both files you will now have two text files on your hard-drive titled "md5sum.txt" and "sha256sum.txt" (If your browser doesn't have a right-click and download the text files function then just left-click on the two links and copy and paste the checksums hash information from the webpage into a text editor of your choice - remember to save them as "md5sum.txt" and "sha256sum.txt".)

Now that you have the official checksum numbers on your hard-drive you can check the ISO(s) that you have against those checksums.
==================================================


Step 2a - Checking the ISO Inside a Linux System

(If you want to do the check inside a Microsoft Windows system then skip this step and goto "Step 2b" below.)

Launch a terminal and type the following (note you will have to adjust the command to suit the fullpath and exact filename to the ISO file you want to check):

Code: Select all

md5sum /path/to/the/ISO/linuxmint-17.3-cinnamon-64bit.iso

Once the command completes (it will take some time, be patient) highlight and then copy the long complicated hexadecimal number that the command produces. Be VERY CAREFUL when you do this that you select ALL OF THE NUMBER and ONLY THE NUMBER, no extra spaces at the end. Now open the md5sum.txt that you created earlier in a text editor and do the following;

(1) Use the Search function of the text editor and paste the MD5 number you got for the ISO from the terminal command into the Search Text-box.
(2) Now click on the Search button
(3) If the Search function finds a match then your ISO is fine.
(4) If the Search function does not find a match then your ISO is either hacked or you have a faulty/corrupted downloaded ISO.

You can then follow the same procedure to check the ISO against the SHA256 checksum - though, obviously, you need to make sure that you do the checking against the checksum information in the sha256sum.txt file you might have created earlier. If you want to do that check the command to use in the terminal is:

Code: Select all

sha256sum /path/to/the/ISO/linuxmint-17.3-cinnamon-64bit.iso

Again you will need to provide the correct full path and exact filename for the ISO you are checking.
==================================================


Step 2b - Checking the ISO Inside a Microsoft Windows System

There are many programs available for Windows that will calculate the checksums of files. One that I am familiar with is the free version of MD5 & SHA Checksum Utility. Download a copy of that, it is a portable program so you don't need to install it to the system.

(1) Now launch the "MD5 & SHA Checksum Utility" that you downloaded. In the hash-type selections tick MD5 and/or SHA-256.
(2) Click on the Browse button and in the file selector drill to the ISO file you want to check, click on that ISO and then click the Open button. The program will now generate the checksum(s) for the ISO you selected.
(3) Now open the "md5sum.txt" and/or the "sha256sum.txt" that you created earlier and from one of them copy the hash number for the ISO you want to check into the "Hash:" field of the program dialogue window, then click the Verify button. The program will now tell you if the hash number matches.
(4) If the hash numbers do not match then your ISO is either hacked or you have a faulty/corrupted downloaded ISO.
==================================================


Hope this helps.

[Jedinovice]

Okay Jedinovice - excellent idea for a thread. But one thing missing for newbies: How do you actually do a check on an ISO using md5 or sha256? Here's a short guide on how to do the check:

Hope this helps.

Good point and well done. This is where the thread should be of use.
Thanks.

[killer de bug]

In order to check if an iso has not been compromised, please note this nice tutorial from xenopeek: https://community.linuxmint.com/tutorial/view/2266

[BigEasy]

Interesting logic.

Don't get me wrong, I really appreciate this ... but I wish this kinda statement comes from an "official" mint representative. I think you wrote this post from the best of your knowledge, but do you take the responsibility for that?

You don't want to trust in official writings.

wish the mint representatives also comment on what is currently written on the Debian-Forums regarding this issue and the security concept of Mint in general. This really unsettles me at the moment and I'm seriously considering to dump Mint and move to a different distro...

You want to trust in someone else's writings.

Where is your own knowledge and experience?

[Fred Barclay]

Nice work Jedi and Radish!

[Farjohn]

I'll second what Fred said! And Radish, that was very kind of you and much appreciated. Thanks!

[Acewiza]

is my Mint safe?

True Answer: Probably no more or less so than it ever was. Like all the rest.

This type discussion understandably only illustrates the perspective of relatively un-initiated casual users. Better for all concerned if anybody still uncomfortable with this issue simply switch distros and go bug somebody else.

[BigEasy]

In order to check if an iso has not been compromised, please note this nice tutorial from xenopeek: https://community.linuxmint.com/tutorial/view/2266

Written in tutorial:

This tutorial shows you how to do this from Linux Mint itself. I hope that those using other operating systems can show how to do it from there.

What have to do WIndows users?

[Farjohn]

RE: The post by Radish on checking for the correct MD5 sum

Radish,

I burned the original .iso onto a DVD which I named "Linux Mint 17.3 Cinnamon 64-bit" and installed 17.3 after booting that disk. I subsequently attempted to run the utility md5sum directly on that disk by typing into the terminal the following:

"md5sum media/sig(my username)/Linux Mint 17.3 Cinnamon 64-bit"

The utility sent me the message "No such file or directory"

I then assumed the utility md5sum doesn't like spaces and I'd been careless in naming the disk, so I created a new directory on my hard drive which I named "linuxmint-17.3-cinnamon-64bit.iso" which is literally the name of the file in question and copied the contents of the DVD into that location, verifying that all the files shown on the disk were now on the drive.

I then ran md5sum against the new, correctly named location (full path shown) as follows:

"md5sum /home/sig/documents/Mint-17.3/linuxmint-17.3-cinnamon-64bit.iso"

And was treated to the familiar error message:

"md5sum: /home/sig/documents/Mint-17.3/linuxmint-17.3-cinnamon-64bit.iso: No such file or directory"

I've done this a number of times paying excruciating attention to case and character entry with the same result. At the risk of looking really stupid, which I've probably already accomplished anyway, why am I not getting a checksum back? Maybe md5sum doesn't like caps either?

Your comment would be appreciated. Thanks.

[Skaendo]

RE: The post by Radish on checking for the correct MD5 sum

Radish,

I burned the original .iso onto a DVD which I named "Linux Mint 17.3 Cinnamon 64-bit" and installed 17.3 after booting that disk. I subsequently attempted to run the utility md5sum directly on that disk by typing into the terminal the following:

"md5sum media/sig(my username)/Linux Mint 17.3 Cinnamon 64-bit"

The utility sent me the message "No such file or directory"

I then assumed the utility md5sum doesn't like spaces and I'd been careless in naming the disk, so I created a new directory on my hard drive which I named "linuxmint-17.3-cinnamon-64bit.iso" which is literally the name of the file in question and copied the contents of the DVD into that location, verifying that all the files shown on the disk were now on the drive.

I then ran md5sum against the new, correctly named location (full path shown) as follows:

"md5sum /home/sig/documents/Mint-17.3/linuxmint-17.3-cinnamon-64bit.iso"

And was treated to the familiar error message:

"md5sum: /home/sig/documents/Mint-17.3/linuxmint-17.3-cinnamon-64bit.iso: No such file or directory"

I've done this a number of times paying excruciating attention to case and character entry with the same result. At the risk of looking really stupid, which I've probably already accomplished anyway, why am I not getting a checksum back? Maybe md5sum doesn't like caps either?

Your comment would be appreciated. Thanks.

You cannot hash the burnt disc, or the files copied from it. You have to hash the original .iso file that you downloaded and burnt to the disc.

*You might be able to create a .iso from the disc you burnt and hash that, but it might not give the correct results. I have done this with Windows before, and it did give the correct checksums, but it might work differently through linux.

[Radish]

Okay, Farjohn - this answer is definitely as one newbie to another (if I make mistakes that others spot please do correct me).

1) The md5sum is for checking the ISO file itself. It cannot be used for checking the DVD that you got from burning the ISO image contents onto the DVD. To phrase that slightly differently, assuming you download Mint Cinnamon 64bit from one of the mirrors, then you would use the md5sum command to check the file named "linuxmint-17.3-cinnamon-64bit.iso"

2) You did the right thing in arranging things so that there were no "spaces" in the directory path to the ISO and also no "spaces " in the ISO filename. (If there were spaces in that path and filename then the instructions are a bit more complicated, but in essence you would have to include double-quotes (") at the beginning and end of the path and filename you enter. So lets just avoid going into that.)

3) You say that you entered the following command:

Code: Select all

md5sum /home/sig/documents/Mint-17.3/linuxmint-17.3-cinnamon-64bit.iso

And that you get the error message:

Code: Select all

md5sum: /home/sig/documents/Mint-17.3/linuxmint-17.3-cinnamon-64bit.iso: No such file or directory

However, in entering that path you have probably made a mistake. In a default set-up of Mint there is no "documents" folder, there is though a "Documents" folder - see the "D" needs to be upper-case to match what is actually on the system. Linux does distinguish between use of upper- and lower-case in folder and file names. So "documents" does not equal "Documents". Therefore, try the following command:

Code: Select all

md5sum /home/sig/Documents/Mint-17.3/linuxmint-17.3-cinnamon-64bit.iso

I think you will find success with that.

P.S. Are you sure you have the ISO in the "Documents" folder and not in the "Downloads" folder? (Probably a stupid question on my part.)

[MintBean]

I'll second what was said earlier- valuable contribution to the community, Jedi. Much appreciated.