Linux Mint servers hacked

[Teunis]

Yesterday there was a hack of the Mint servers replacing the link to their latest Cinnamon iso to one infected with the Tsunami IRC bot.

http://news.softpedia.com/news/linux...s-500719.shtml

[jlittle]

Am I naïve to think that those of us that check the md5sum of isos would have been warned of this?

Regards, John Little

[GreyGeek]

The LinuxMint 17.3 Cinnamon ISO download file was discovered to be hacked yesterday. The break-in is discussed in the link below. Clem is being very candid. The bad guys from Sofia, Bulgaria, used WordPress to break in twice. After the first break-in was discovered Clem thought he had closed the hole yesterday but at 2.29AM last night he was informed by a user that the 64 bit Cinnamon ISO was still compromised, meaning the bad guys had broken in again. Following that news he took LinuxMint.com off line. As of 5:38PM CST it is still off line. When sleuthing the break in back to its source Clem discovered that the three guys involved had a 32 bit version of Cinnamon ready to upload but didn't get to do it. He's informed the authorities.

The LinuxMint forum is, IMO, very clutzy to use, unlike the vBulletin forum software used by KubuntuForums.net. Here we click the link to subscribed threads to see a date sorted list of subscribed threads that we can respond to. Then we can click Today's Posts to see the new posts. Then we can mark the forums read, ready to start over the next time we login. Our forum is, IMO, much cleaner and easier to use than the one based on WordPress.

Anyway, here is the link where Clem discusses the break in with users:

http://blog.linuxmint.com/?p=2994

EDIT: There are over 4,000 known WordPress vulnerabilities:
https://wpvulndb.com/

EDIT:EDIT: The softpedia article demonstrates that the bad guys were real amateurs. So, apparently it does not take a genius coder to break into a WordPress site.

[claydoh]

No, especially if there are lax directory permissions, as Clem did mention. I'd suspect an iffy plugin or theme, but this was supposedly a fresh, hours-new install with no addons other then the theme. And yes, wordpress has vulnerabilities, like any php based stuff does. But the 4000 bugs is akin to listing all vulnerabilities in , say ubuntu plus all of those in all software available in the repos, for a number of releases.

[jpenguin]

I was wondering why their site is down

Sent from my Samsung Galaxy S5 using Tapatalk

[Danum]

No, especially if there are lax directory permissions, as Clem did mention. I'd suspect an iffy plugin or theme, but this was supposedly a fresh, hours-new install with no addons other then the theme. And yes, wordpress has vulnerabilities, like any php based stuff does. But the 4000 bugs is akin to listing all vulnerabilities in , say ubuntu plus all of those in all software available in the repos, for a number of releases.

As per usual lets blame some one else for our stupidity, "upMint"
https://news.ycombinator.com/item?id=11143162

[GreyGeek]

As per usual lets blame some one else for our stupidity, "upMint"
https://news.ycombinator.com/item?id=11143162

Interesting link. Someone named "ryanlol" commented:

ryanlol 1 day ago I think calling softpedia "press" is an insult to every real journalist.The fact that they're calling the bot "tsunami" just proves their incompetence. The bot isn't called tsunami, it's called kaiten and it's been open source for more than a decade. https://packetstormsecurity.com/file.../kaiten.c.html They also managed to confuse FTP and HTTP >the hackers have only altered the man.cy [https://gist.github.com/Oweoqi/31239851e5b84dbba894] file, where they've added a new function called tsunami. Doesn't look like they just added a new function called tsunami to me. >Selling the forum's database for a meager $85 is a sign of their lack of vision. The group seems to have mishandled the entire hack, opting to distribute a silly IRC DDoS bot instead of more dangerous and lucrative malware like Bitcoin miners or banking trojans. Stupid speculation by writer. Linux Mint remains compromised despite the current events, it's rather unlikely that kaiten is used as a DDoS bot instead of just a stager to execute shell commands on the affected computers. The presence of DoS commands is meaningless, the only reason kaiten is still used today is because it runs everywhere so it seems fair to assume that that'd be why the attacker opted to just use it instead of writing their own. (No real benefit to that here) Also, bitcoin mining stopped being lucrative ages ago. edit: >One person seems to have bought the hackers' files and dumped the forum's config file on Hacker News discussions thread. I neither bought nor sold the data ... ryanlol 1 day ago But that wasn't the point, the point was to expose the level of stupidity at play here.I strongly believe the users deserve to know just how incompetent these guys are, because next time it won't be some idiot swapping the iso links. It'll be someone slightly more competent that pushes a backdoored commit or gets into the apt repos, and then _every_ _single_ user will be affected... Also, at the time of the posting the site was down. And it remains so.

[GreyGeek]

Interesting post on the LinuxMint Blog this evening:
http://blog.linuxmint.com/?p=3001#comments

Yro Says:
February 22nd, 2016 at 11:36 pmHi all, Clem. Please allow this comment.


We are targeting the attackers. They are (atleast) 4 people from 2 countries. As a preliminary statement, they all have some talking with Cannonical and an group from IRC called skmething like “DmgUx” (something related to that).
Our preliminary investigations point us to the idea that they are doing somekind of “job” for other linux competitors and all is pointing that there are some others attacks coming next on other distros out there.


Atleast there are 3 distros/partners to consider getting attacked this month: BlueSystems, Suse and SteamOS (but this one I higly doubt they will do something) … I dont know if its for sure, but its for considerations..
The point of linuxmint attack is for bad marketing porpouse. With LinuxMint getting hacked Mint will loose members, customers and, maybe, partners. Thats the case here and the only objective of this attack. No matter what people claim on internet, thats the fact.


The guys on facebook (someone posted a picture) is just an a$$hole trying to get some attention and he is not related to this attack (not directly). The interview on ZDNET is fake (atleast not the real deal with one of the real attackers).
Its time for Linux to concentrate efforts on isolating himself from others distros and backers as Canonical, and invest in infraestructure to release a new website with more security and reliability. WordPress is a mess and a great meal for attackers. Consider pure HTML5, pure own development in PHP or keep getting in trouble for the near future.


My understanding is that this attack will not make mint reputation fades away nor make it a bad deal for new users. But its an allert for others too.


Its not that Linux is open that it has no attention from others. And the big problem lies on the neighbors as derivatives, competitors on this little market that desktop with Linux is and the own team working with bad intentions, as it is on LinuxMint (my guess). There is one guy sending some data from linux to others(again, only assumption based on some datas collected here and there). Keep one eye on it, just in case..
Im working (every now and then) on a team of good people who likes to solve puzzles and make chaos on the bad people heads…

[claydoh]

Yeah, it took 60 comments to get to the conspiracy stuff, LOL!

As usual, the comment has zero percent useful info and zero sourcing. Even us casual conspiracy theorists need some tidbit to go on "I read it on the internet" is not quote enough.


Let's face it, people from script kiddies to pros constantly probe the entire web for vulnerabilities and holes. This just reminds us of this fact.
People can argue about what software was used, and how crappy it may or may not be, but it all boils down to expertise and time when you have your own servers.

[claydoh]

Aaaaand time for popcorn......https://lwn.net/Articles/676664/

Though lwn is full of anti-user, anti-popular sentiment

[GreyGeek]

Aaaaand time for popcorn......https://lwn.net/Articles/676664/

Though lwn is full of anti-user, anti-popular sentiment

Full of it indeed. I read the entire thread following the article and it was nothing more or less than a battle of egos and disinformation. Packages with security or other problems are in category five, highlighted in red. The user is free to choose to install them or not.

Debian doesn't install Adobe and libdss because of licensing issues? CDROM drives aren't even included on new laptops, and even though my five year old laptop has a DVD/CDROM drive it has been almost that long since I watched a movie with it. DVR's, USB's and such have kicked the plastic discs to the curb. I've watched more movies on this iPhone 6+ in the last year than I ever watched in total on my CD-ROM drive.

What I read in that article was professional jealousy being expressed. Mint is probably more popular than Debian and Ubuntu combined, and once you install it you'll know why. The licensing issue is bogus anyway. EVERY distro I've used or tried in the last ten years, including Debian, Fedora, openSUSE, Arch, Kaos, and others include the ability to easily add repositories that contain "non-free" apps, proprietary codecs, etc.

The last time I checked the Ubuntu forum had about 350 posts per day, causing any question you'd post pass quickly out of the response window. Kubuntu averages 50-75 new posts per day, which gives noobs a better chance of getting a solution to their question. I've noticed that the LinuxMint forum averages around 700 new questions per day, +- 50. The OS detail page on DistroWatch shows "Ubuntu" as the Linux distribution with the largest percentage of a named distro, but Mint is probably accounting for mor than half of that 3%. The unknown Linux distribution accounts for 41% of Linux visitors to DistroWatch.

It's all a bunch of hot air. All the major distros have had their sites and/or repositories hacked or compromised and there are ocassional announcements of a CVE that affects a version of one of their distro components. The Mint site hack and distro is no different. The hacker's claim is that "hundreds" of downloads on Feb 20th are pwnd and now part of their botnet. Total nonsense, of course. If "hundreds" were pwnd then thousands must have been downloaded on that single day, from that single Bulgarian website. And the majority are unaware? Ludicrous. Considering that few distro users download and install but then never visit the distro website again, I suspect that by now the only box containing a copy of the hacked ISOCis the Bulgarian server.

As usual, the weakest security component is the user, not the distro or an app. I used Windows for 25 years and never got a single announced infection ( there were many vectors MS kept secret that may have been on my machine, which is why I never did financial stuff on Windows). I have never gotten an infection on any of my Linux installs, either, since 1998. I try to be a careful user on either platform. Don't use flash or Java and don't visit pron sites or download or view pron and you'll avoid 99.99% of all malware.

[claydoh]

The lwn writer does highlight some of the reasons I do not care for Mint in general, though the points imo are not overly serious for the intent and intended user base.

[GreyGeek]

Having experienced Mint KDE 17.3 for nearly two months I find his criticisms off target or flat wrong. Security updates, for example. Synaptic has a level 5 kernel-dev package security update this afternoon. So far, from the KDE desktop I cannot tell the difference between my Kubuntu experience and my Mint experience.

[GreyGeek]

The LinixMint forum is back on line. They have dropped WordPress and procured the services of sucuri.net. I don't know what level of service they purchased but Clem has off loaded the management of their servers and forum. The new forum software, phpBB, is much better than WordPress but, IMO, not as good as what KubuntuForums.net uses, vBulletin.

[claydoh]

They are still using Wordpress as the blogging software, the actual site software looks to be the same, and phpbb is the same. They just have added a security company to assist. Hopefully they are getting good advice and assistance on configuring their servers better.