Wait, was Linux Mint really hacked?

Plokite_Wolf

http://thehackernews.com/2016/02/linux-mint-hack.html

According to this, if you got an ISO of Linux Mint 17.3 from the official website on February 20th, you got an infected version with the Tsunami backdoor. The website is indeed down at the moment.

What would anyone have to gain by hacking a free and volunteer-powered initiative, other than getting bragging rights among equally moronic hackers?

dude

What wouldn't they have to gain?

Include a rootkit, get unrestrained access to affected user's systems. They could even install keyloggers, who knows?

wpblogheader

Yikes, happy I'm putting Slackware on my LapTop. I've found Ubuntu and it's forks to be a bit too bloated/limited for me. I guarantee this wouldn't happen with a clean, non bloated distro.

It's terrible people would want to crack a FOSS project, what a shame.

garirry

wpblogheader wrote:

Yikes, happy I'm putting Slackware on my LapTop. I've found Ubuntu and it's forks to be a bit too bloated/limited for me. I guarantee this wouldn't happen with a clean, non bloated distro.

It's terrible people would want to crack a FOSS project, what a shame.

Um, what? The hack happened in the website, not the OS itself. You can place malware on any operating system in existence as long as it isn't something ultra-simple like a watch interface.

It is a bit sad, but hey, hackers are always around, you can't have good without bad. However, I have to say that for being able to cause the hack twice in a row, that is pretty impressive. The Mint team better be careful.

wpblogheader

garirry wrote:

You can place malware on any operating system in existence as long as it isn't something ultra-simple like a watch interface.

Actually...

dude

Smartwatches run iOS and Android. I don't think they count as "ultra-simple"

garirry

wpblogheader wrote:

garirry wrote:

You can place malware on any operating system in existence as long as it isn't something ultra-simple like a watch interface.

Actually...

I SAID A WATCH INTERFACE, NOT A SMARTWATCH, I'M TALKING ABOUT REGULAR DIGITAL ONES.

dosbox

It was the website that was hacked and apparently the site uses Wordpress.

Doqtor Kirby

^This.

What happened was the hackers compiled their own custom A̶r̶c̶h Mint ISO with the backdoor, subsequently hacking the website and providing the custom ISO for download. It's actually pretty simple in concept, but is very substantial in its reach.

calvinb

Note their forums were compromised - apparently for a month before this, as skiddie forums were peddling the DB.

Remember, this is also the same distro that holds back security updates.

Doqtor Kirby

ampharos wrote:

Remember, this is also the same distro that holds back security updates.

And this my friends is why you don't use a bad distro.

Also noticed I said Arch, not Mint. I knew what I was talking about!

wpblogheader

garirry wrote:

REGULAR DIGITAL ONES.

AFAIK they don't even run an operating system, at least one with large similarity to a desktop or even embedded OS.

garirry

wpblogheader wrote:

garirry wrote:

REGULAR DIGITAL ONES.

AFAIK they don't even run an operating system, at least one with large similarity to a desktop or even embedded OS.

That's not at all what I was saying, I'm saying that anything can get hacked as long as it is something so simple there is nothing to hack or the system is way too simple for a security breach to be present. And I don't care if they are considered an operating system or not.

wpblogheader

Ah, ok. I thought you were talking about things with operating systems, not all electronic devices.

yourepicfailure

Anything can be hacked if it is electronic, so get out of that little euphoria of electronic safety.

Perfect example is right in FCC reg: "This device must not create any harmful interference; and this device must accept any interference, including that which may create undesired operation".
So your electronic devices must be "hackable" in a way to be legally sold in the United States. Have a nice day.

garirry

yourepicfailure wrote:

Anything can be hacked if it is electronic, so get out of that little euphoria of electronic safety.

Perfect example is right in FCC reg: "This device must not create any harmful interference; and this device must accept any interference, including that which may create undesired operation".
So your electronic devices must be "hackable" in a way to be legally sold in the United States. Have a nice day.

By "accept any interference", they mean that it should be able to be able to accept any interference without exploding or breaking, even if that interference could, let's say, cause error messages or the device might get confused or something. All it means is that it should remain safe, regardless of what interference it gets. It's not that it has to be hackable in order to be sold.

yourepicfailure

By interference, it means that if your device is say a ham radio, and it comes in contact with a local TV station(this might be a problem 8 years ago when there was still analog broadcasting) it will have to accept that analog signal. However the must not interfere with that signal. This only really applies to consumer-end devices.
I used this to describe how consumer wireless devices can be "hacked" by the right interference.
Whether or not the device breaks under the interference is up to the design. I've had countless analog electronic devices fail various degrees under numerous forms of interference. It all depends on what's inside.

Now for the real "any electronic device", remember back in 93* testing a specific electromagnetic unit that could stop a simple lightbulb from lighting to complex electronics from functioning. Hell to a lesser degree, people are extracting and/or modifying electronic signals from cable wire and other devices these days, without contact with the electronics.
What is it, preaking or something? Can't remember.


These simple "OS" hacks and issues are nothing compared to the true hardware vulnerabilities and "hackabilities" that lie in system hardware.

EDIT:
* Not actually in '93, used a figure of speech. I mean fairly recently as in 2009.

wpblogheader

yourepicfailure wrote:

These simple "OS" hacks and issues are nothing compared to the true hardware vulnerabilities and "hackabilities" that lie in system hardware.

Speaking of which...

Honestly, I think there need to be harsher punishments on these "hackers". I'm talking life imprisonment. Also, why the heck is bloatware even allowed? One time in ye olden days of 2010 I received a cheap-ass Samsung netbook that took 5 min to boot to a usable state because of the bloat. IMHO bloatware is a form of malware. Oh well, migrating to Linux anyway.

BOD

Life imprisonment?

Fucking murderers don't even get that nowadays. The hell does some skiddie deserve such a stupid punishment.

garirry

wpblogheader wrote:

yourepicfailure wrote:

These simple "OS" hacks and issues are nothing compared to the true hardware vulnerabilities and "hackabilities" that lie in system hardware.

Speaking of which...

Honestly, I think there need to be harsher punishments on these "hackers". I'm talking life imprisonment. Also, why the heck is bloatware even allowed? One time in ye olden days of 2010 I received a cheap-ass Samsung netbook that took 5 min to boot to a usable state because of the bloat. IMHO bloatware is a form of malware. Oh well, migrating to Linux anyway.

Life imprisonment? That's the stupidest punishment ever. If you're going to prevent someone from living for the rest of their life, why not just execute them? And this kind of punishment is way too much for just some nerdy hacker. My guess is either fining or some form of confiscation (eg. prevent someone from accessing the Internet temporarily).

As for bloatware, I agree there should be some kind of law restricting that kind of stuff. I especially don't like when they bundle Norton crap that goes "YOUR COMPUTER IS IN DANGER!!!" the moment you boot it for the first time. I'm surprised that isn't considered as scareware...

wpblogheader

garirry wrote:

My guess is either fining or some form of confiscation (eg. prevent someone from accessing the Internet temporarily).

Hmm... preventing (personal) access to the internet would be very good idea. Plus, they'd learn a thing or two about real life while waiting

garirry wrote:

As for bloatware, I agree there should be some kind of law restricting that kind of stuff. I especially don't like when they bundle Norton crap that goes "YOUR COMPUTER IS IN DANGER!!!" the moment you boot it for the first time. I'm surprised that isn't considered as scareware...

It's not just the scareware. There's SuperFish, McAfee, useless utilities, (back in the day) Windows 7 Starter, etc. IMHO there should be a law against 3rd party junk bundled in, as long as it's separate from a "store". Also, spying on users without *very obviously* notifying them should be illegal (but that'll never happen).

garirry

wpblogheader wrote:

It's not just the scareware. There's SuperFish, McAfee, useless utilities, (back in the day) Windows 7 Starter, etc. IMHO there should be a law against 3rd party junk bundled in, as long as it's separate from a "store". Also, spying on users without *very obviously* notifying them should be illegal (but that'll never happen).

Well, just putting useless crap is better than scareware, which is just inhuman and I'm pretty sure illegal to some extent. I doubt that "spying" will be illegal any time soon, because it's not really spying. You technically agreed to be spied on by signing the terms and conditions of use, it's just that it's so long that nobody reads this (on the other hand, I think that this may become controlled eventually, we can't go around reading book-long terms and companies can't go around abusing people's ignoring of said terms).