Hackers planted a backdoor inside a compromised version of Linux Mint

If you downloaded Linux Mint on Friday, February 20th, you may have grabbed a hacked version that includes a backdoor. Here's what you need to know.

If you downloaded Linux Mint on Friday, February 20th, you may have unknowingly downloaded a hacked version of the operating system.

According to a blog post on the Linux Mint site, hackers broke into the Linux Mint website at some point on Friday and made changes in order to direct users toward downloading “a modified Linux Mint ISO, with a backdoor in it.” Using the hacked version could allow hackers to steal your private information. According to Linux Mint, the hack only affects those who downloaded the Linux Mint 17.3 Cinnamon edition from the Linux Mint website on Friday.

“If you downloaded another release or another edition, this does not affect you,” the blog post states. “If you downloaded via torrents or via a direct HTTP link, this doesn’t affect you either.”

The Linux Mint website is down for the time being (aside from the blog, anyway) as the team works to re-secure the site. 

The story behind the story: Backdoors are serious threats to your security and privacy in that they could allow hackers—or government entities, for that matter—to readily bypass security measures in place and access your personal data without your knowledge. So-called backdoors have been in the news a lot in the past week, largely due to Apple’s legal fight with the FBI, which wants the Cupertino company to circumvent certain security measures on a suspect’s iPhone.

What to do if you’re affected

First and foremost, you’ll want to determine whether this hack impacts you. Check the Linux Mint blog for instructions on how to tell whether the ISO you have is legit or if it’s been compromised. If you’ve got a hacked version, you’ll want to destroy ISO—Linux Mint’s developers recommends that you delete the ISO file, throw away any DVDs you burned it to, and wipe any USB drives you stuck the hacked ISO on. 

If you installed the hacked version on your computer, you’ll also want to remove it from your PC: The Linux Mint team says to disconnect your PC from the Internet, back up your personal files, and install an un-compromised operating system. If you have it installed on a secondary partition, you can wipe that partition entirely instead. You should also change your login passwords for any important websites or services you use.

Linux Mint Forums at risk, too

In a followup blog post, the Linux Mint team says hackers got ahold of its forum database as well. If you have a Linux Mint Forums account, you’ll want to change your password for any website or service that has the same password as your forum account. (Using the same password for multiple sites is a recipe for security disaster—don’t do it.) The forum is currently down as of this writing, but you’ll want to change your forum account password as soon as it’s back up and running.

Join the CSO newsletter!

Error: Please check your email address.

More about AppleFBIISOLinuxMint

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Nick Mediati

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts