MESSAGE
DATE | 2016-02-21 |
FROM | Rick Moen
|
SUBJECT | Re: [Hangout-NYLXS] Linux Mint security breach
|
From hangout-bounces-at-nylxs.com Sun Feb 21 03:08:47 2016 Return-Path: X-Original-To: archive-at-mrbrklyn.com Delivered-To: archive-at-mrbrklyn.com Received: from www.mrbrklyn.com (www.mrbrklyn.com [96.57.23.82]) by mrbrklyn.com (Postfix) with ESMTP id 5A8FF163D99; Sun, 21 Feb 2016 03:07:43 -0500 (EST) X-Original-To: hangout-at-nylxs.com Delivered-To: hangout-at-nylxs.com Received: from linuxmafia.com (linuxmafia.COM [198.144.195.186]) by mrbrklyn.com (Postfix) with ESMTP id BFD061616D6 for ; Sun, 21 Feb 2016 02:19:07 -0500 (EST) Received: from rick by linuxmafia.com with local (Exim 4.72) (envelope-from ) id 1aXOIM-0004IK-M9 for hangout-at-nylxs.com; Sat, 20 Feb 2016 23:19:06 -0800 Date: Sat, 20 Feb 2016 23:19:06 -0800 From: Rick Moen To: hangout-at-nylxs.com Message-ID: <20160221071906.GF24965-at-linuxmafia.com> References: <56C95007.9000204-at-mrbrklyn.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <56C95007.9000204-at-mrbrklyn.com> Organization: If you lived here, you'd be $HOME already. X-Mas: Bah humbug. X-Clacks-Overhead: GNU Terry Pratchett User-Agent: Mutt/1.5.20 (2009-06-14) X-SA-Exim-Connect-IP: X-SA-Exim-Mail-From: rick-at-linuxmafia.com X-SA-Exim-Scanned: No (on linuxmafia.com); SAEximRunCond expanded to false Subject: Re: [Hangout-NYLXS] Linux Mint security breach X-BeenThere: hangout-at-nylxs.com X-Mailman-Version: 2.1.17 Precedence: list Reply-To: NYLXS Discussions List List-Id: NYLXS Discussions List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: hangout-bounces-at-nylxs.com Sender: "hangout"
Quoting Ruben Safir (ruben-at-mrbrklyn.com):
> http://news.softpedia.com/news/linux-mint-website-hacked-users-pointed-to-download-isos-with-backdoors-in-them-500707.shtml
news.softpedia.com has a history of really terrible coverage that doesn't even aspire to address basics -- presumably because it is pitched at ignorant readers.
1. Story doesn't mention whether Linux Mint normally supplies checksums (e.g., sha1sums) with the images and whether it has a public gpg key to sign downloads.
(In fact, this intrusion was so sloppy that intruders didn't even bother to replace posted checksums, which IIRC are present along with a public signing key. Site appears to be offline ATM.)
2. Story therefore also doesn't mention whether the trojaned images match signing keys posted for them by the intruders. (Didn't happen.)
3. Story doesn't even attempt to address why users wouldn't become suspicious when the download links foe the Cinnamon edition (only) suddenly pointed to Bulgaria.
4. Story also fails to mention the one interesting bit, that remote attackers took advantage of a locally-unfixed bug in Wordpress to spawn www-data - owned processes under intruder control.
In short, bad coverage as usual. _______________________________________________ hangout mailing list hangout-at-nylxs.com http://www.nylxs.com/
|
|