1

I am a bit new to Linux and I know this is late but I recently read about how Linux Mint 17.3 was hacked on February 20th and I want to make sure my version isn't hacked. I originally installed Linux Mint 17.2 back in August and I upgraded to 17.3 via the Update Manager. While I am unsure of the exact date I did this, I believe it was sometime around the date in question. In order to make sure I don't have an infected system I would like to know the answers to a few questions that would greatly help me.

1) First, if I already had Linux Mint installed on my computer and I simply upgraded from Rosa to Cinnamon via the Update Manager, am I ok?

2) If not, is there a way I can simply view when I upgraded my OS in the terminal?

3) If not, I have read the Linux Mint blog post about how to check if my ISO is compromised using the md5sum command, but in order to do that, I need to find the ISO file. Where would that be located on my computer?

  • The ISO file is the "image" file used to create the CD or DVD you used to install 17.2. – Mikel Mar 23 '16 at 16:14
2

According to Clement Lefebvre (the Mint project leader), the only danger is if you installed from a compromised ISO. Mint's download page was compromised and if you happened to have download a Mint ISO on Saturday, February 20th, that might have been a bad one.

To answer your specific questions:

1) First, if I already had Linux Mint installed on my computer and I simply upgraded from Rosa to Cinnamon via the Update Manager, am I ok?

Yes, you're fine. The only thing that was affected was the live CD images (ISOs) stored on their download server. Already installed systems wouldn't be affected. Upgrading through the Update Manager doesn't use an ISO image, it simply updates the necessary packages using the latest versions in Mint's repositories and those weren't affected by this.

2) If not, is there a way I can simply view when I upgraded my OS in the terminal?

Not relevant, see above. Upgrades are safe, it's only new installations made using a compromised ISO that are problematic.

3) If not, I have read the Linux Mint blog post about how to check if my ISO is compromised using the md5sum command, but in order to do that, I need to find the ISO file. Where would that be located on my computer?

We have no way of knowing. If you installed your system using an ISO, then you downloaded that ISO from a different system. Either on the same computer with a different operating system or a different machine. This isn't the sort of thing you could do unknowingly. ou would have had to i) download the ISO; ii) burn it onto a CD/DVD or copy it to a USB drive; iii) boot off of the DVD or USB and install your operating system.

So, the ISO, if it exists, would be wherever you have chosen to save it. Just like any other file you download from the internet. That said, the default name (which you might have changed, of course) is one of:

linuxmint-17.3-cinnamon-32bit.iso
linuxmint-17.3-cinnamon-64bit.iso
linuxmint-17.3-cinnamon-nocodecs-32bit.iso
linuxmint-17.3-cinnamon-nocodecs-64bit.iso
linuxmint-17.3-cinnamon-oem-64bit.iso

You can look for all of them using locate. First, refresh your locate database with (this can take a while):

sudo updatedb

Then run:

locate --regex 'linuxmint.*iso'

If that returns nothing, the ISOs aren't on your system.

0

Dont use Mint but all distros are pretty much the same. Each Distro has an official set of Repo's. Did you upgrade your OS using the Yum or Apt-get or Pacman or what ever Mint uses? If you upgraded using this method, have you ever altered your Repo's? If not am doubtful its a hacked version.

The ISO you quote unless i have the wrong end of this, Is a Image file you have downloaded (A Whole Image) Like a Windows 10 Disk You can MD5 this to ensure the ISO has not been modified, but i dont see how this fits with the update manager? Or did you launch a Live Image and upgrade your OS from the Live Disk?

To check if a file has been hacked, you need to know whats been hacked and with what to search for a pattern. You could always install a Rootkit to check your system for malicious code.

Had to answer as not enough room for comment.

0
  1. You should be fine as the public repositories are checked periodically by people who know what is going on. The installation, and upgrading of packages are validated using a list with md5sum hashes of packages. Although a MITM attack could make you update a hacked version, if the hacker changes the contents of the package list (has to be root for this), but I doubt this very much in your case.
  2. The Software Center has a list of all the updates you have downloaded in the past. As an alternative you can read the history.log file in /var/log/apt/history.log
  3. Do you mean the ISO for linux Mint 17.2 you downloaded in the first place? It is only located in your computer if you copied it there after installing the system from scratch.

protected by Community Jul 2 at 12:19

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.