The developers of the popular Linux Mint distribution have shut down the official website and forum after they were both breached by a hacker.
Linux Mint project leader Clement Lefebvre informed users on Sunday that a hacker breached their website and replaced legitimate download links with ones pointing to a modified version of the ISO for Linux Mint 17.3 Cinnamon edition. Users who downloaded the image via torrents or a direct HTTP link are not affected.
According to Lefebvre, altered ISOs for the 64-bit and 32-bit versions of Linux Mint were hosted on a server in Bulgaria. The project lead said only the 64-bit version was linked from the hacked website, but provided valid signatures for all versions of 17.3 Cinnamon to allow users who downloaded the ISO on February 20 to determine if they have a legitimate copy or one that has a backdoor.
“The hacked ISOs are hosted on 5.104.175.212 and the backdoor connects to absentvodka.com. Both lead to Sofia, Bulgaria, and the name of 3 people over there,” Lefebvre said. “What we don’t know is the motivation behind this attack.”
Lefebvre said the attacker breached Linux Mint systems via the blog, which is powered by the latest version of WordPress running a custom theme. The hacker uploaded a PHP backdoor to the themes directory of the installation.
A security firm has been called in to investigate the incident and determine how exactly the attacker broke in, but Linux Mint developers noted that there is no evidence that a WordPress zero-day vulnerability is involved.
The backdoored version of Mint includes a Linux Trojan dubbed Tsunami, which has been around for well over a decade. The malware can be leveraged by malicious actors for DDoS attacks, to download files and execute shell commands on the infected system.
In addition to replacing Linux Mint download links, the attacker also breached the official forum (forums.linuxmint.com). The compromised phpBB forum database stored information such as usernames, hashed passwords, email addresses, details included by users in their profile or signature, and information posted on the forum, including in private topics and messages.
Users have been advised to change their passwords on all websites where the same password has been set. Lefebvre warned that malicious actors might be able to crack weak passwords.
As some users pointed out on Sunday, the Linux Mint forum database, along with shell access, had been offered for sale for $85, or 0.1949 Bitcoins. According to the Have I Been Pwned service, a total of more than 71,000 accounts are included in the leak.
Script kiddies are selling @LinuxMint‘s full website’s database online for 85.000$. #InfoSec #Linux #LinuxMint pic.twitter.com/EDmPW1ouAF
— A️Nℹ️S ⚜ (@0xUID) February 21, 2016
Lefebvre said the forum will likely be restored on a different server and all user passwords will be reset. Linux Mint developers plan on buying more servers and separate services in an effort to prevent attackers from compromising multiple services if they breach one server.