Beware of hacked ISOs if you downloaded Linux Mint on February 20th (opens in new tab)

The fact that they're calling the bot "tsunami" just proves their incompetence. The bot isn't called tsunami, it's called kaiten and it's been open source for more than a decade.

https://packetstormsecurity.com/files/25575/kaiten.c.html

They also managed to confuse FTP and HTTP

>the hackers have only altered the man.cy [https://gist.github.com/Oweoqi/31239851e5b84dbba894] file, where they've added a new function called tsunami.

Doesn't look like they just added a new function called tsunami to me.

>Selling the forum's database for a meager $85 is a sign of their lack of vision. The group seems to have mishandled the entire hack, opting to distribute a silly IRC DDoS bot instead of more dangerous and lucrative malware like Bitcoin miners or banking trojans.

Stupid speculation by writer.

Linux Mint remains compromised despite the current events, it's rather unlikely that kaiten is used as a DDoS bot instead of just a stager to execute shell commands on the affected computers. The presence of DoS commands is meaningless, the only reason kaiten is still used today is because it runs everywhere so it seems fair to assume that that'd be why the attacker opted to just use it instead of writing their own. (No real benefit to that here)

Also, bitcoin mining stopped being lucrative ages ago.

edit: >One person seems to have bought the hackers' files and dumped the forum's config file on Hacker News discussions thread.

I neither bought nor sold the data.

The config.php file should not be readable by an anonymous user, that is a security risk.

If you are running Ubuntu then you already have signing key (run apt-key list), otherwise you can compare the full fingerprint with the one printed in terminal output in the guide that's hosted on https.

One minor suggestion would be to provide ISO hashes over HTTPS. It's just as secure as using GPG with fingerprints sent over HTTPS, and it's a lot easier.

The fingerprints (https://www.debian.org/CD/verify) could also be made more prominent (perhaps put on the main download page).

Thanks again!

This is kind of in 'No magnet: links for bittorrent downloads on SSL'

Maybe there's something I'm missing?

I think you're saying MD5 is still a decent checksum for non-cryptographic purposes. Without a cryptographic signature or other authenticated integrity-checked distribution channel, there's very little advantage of using a cryptographic checksum.