Xubuntu.org Might Be Compromised

(old.reddit.com)

222 points | by kekqqq 4 hours ago

12 comments

  • retsl 2 hours ago
    the malware's main function seems to be to check the clipboard for crypto wallet addresses and then replace them with attacker addresses:

      Bitcoin (bc1): bc1qrzh7d0yy8c3arqxc23twkjujxxaxcm08uqh60v
      Litecoin (ltc1/L/M): LQ4B4aJqUH92BgtDseWxiCRn45Q8eHzTkH
      Ethereum (0x): 0x10A8B2e2790879FFCdE514DdE615b4732312252D
      Dogecoin (D): DQzrwvUJTXBxAbYiynzACLntrY4i9mMs7D
      Tron (T): TW93HYbyptRYsXj1rkHWyVUpps2anK12hg
      Ripple (r): r9vQFVwRxSkpFavwA9HefPFkWaWBQxy4pU
      Cardano (addr1): addr1q9atfml5cew4hx0z09xu7mj7fazv445z4xyr5gtqh6c9p4r6knhlf3jatwv7y72deah9un6yettg92vg8gskp04s2r2qren6tw
    
    can't guarantee it doesn't do anything else.
    • riedel 1 hour ago
      Isn't possible to check in the block chain to check if the attacker is actually receiving money? Just curious how much money ine makes with such attacks.
    • anonnon 1 hour ago
      As soon as I saw the headline, I assumed something of this sort. Maybe it's naive, but I miss the days when you could just trust (however unfounded) open source software. I never had to hesitate before downloading a distro or a package. Now I only install something if I absolutely need it.
      • oofbey 1 hour ago
        But crypto is such a powerful force for good helping the underprivileged unbanked and govt overreach. /s
        • lta 12 minutes ago
          It's also very practical to allow open air corruption of highest level government elected officials.
        • anonym29 36 minutes ago
          The value of your labor is being systemically destroyed through deliberate currency manipulation by the US Federal Reserve, in conjunction with the US Government and US Treasury.

          You are more than twice as productive as your equivalent 1971 counterpart, but relative to inflation, he was being paid about the same as you. You make your employer twice as much money as he did but you're not rewarded twice as much.

          Five, ten, twenty years from now, when the trend that has been visible in the data since the 1970s is complete, and your labor has no value at all, are you going to be okay?

          The people who spent large majorities of their income accumulating scarce stores of value (gold, bitcoin, housing, profitable businesses, land, etc) are going to be fine.

        • anonnon 48 minutes ago
          You could argue that if not crypto, it would have been something else eventually, and that the heightened vigilance it has necessitated has made it more difficult for other motivated attackers (like state actors) to backdoor or compromise OSS. But as someone who doesn't use crypto, I completely get the "f*ck crypto" sentiment.
          • brokensegue 37 minutes ago
            stealing other data is less lucrative. i'm not confident someone could empty my bank account even with my username/password
            • anonym29 27 minutes ago
              other data is less lucrative than the $0 sitting in those static attacker wallets?
              • brokensegue 26 minutes ago
                i think you're comparing apples and oranges. that they have so far failed to steal any coins does not mean anything with regards to this discussion
                • anonym29 4 minutes ago
                  I don't know how familiar you are with the sheer scope of malware, black markets, data theft, various extortion techniques, but gaining the ability to drop an arbitrary .exe on Xubuntu.org and actually direct enough traffic to it that people notice it is worth a LOT more than $0.
  • crtasm 3 hours ago
    There's a sticked comment on the source thread: https://old.reddit.com/r/xubuntu/comments/1oa43gt/xubuntuorg...
    • hamdingers 3 hours ago
      > Thanks everyone. We're beholden to our hosting environment for upgrades and it looks like there was a bit of a slip-up here. It's being worked on, but for now the Downloads page is disabled.

      Calling this a "slip-up" is an outrageous downplay. If anything this makes me suspicious of the moderator who posted the comment too. One does not accidentally prepare a zip file with a malicious exe and xubuntu-specific language, upload it to a server, and point a torrent link at it.

      • OsrsNeedsf2P 2 hours ago
        > Calling this a "slip-up" is an outrageous downplay. If anything this makes me suspicious of the moderator who posted the comment too.

        You're making an assumption that this moderator is anything more than a Xubuntu enthusiast who wants to downplay outrage on Reddit. Keep in mind Xubuntu is mostly a community effort, not a large corporation with seniors who know how to handle this "best".

        • hamdingers 1 hour ago
          I am not making any assumptions, you are failing to do research.

          Start by googling the username of the account. They are the Xubuntu Marketing and Website lead. This is the domain they are responsible for and, given their long history, they should know better.

          • Vinnl 1 hour ago
            I used to be responsible for the Xubuntu.org website, way back when. I was a teenager back then.

            Which is to say, I'm fairly sure that they're still just a volunteer community member.

          • roryirvine 1 hour ago
            To what extent is Xubuntu affiliated with Ubuntu?

            This sort of thing must risk harming Canonical's reputation, so you'd think they'd want to use whatever leverage they have to enforce better practices.

        • Barrin92 1 hour ago
          >Keep in mind Xubuntu is mostly a community effort, not a large corporation with seniors who know how to handle this "best".

          which is why the whole distro zoo and "stick it to the man" theatre has always been a nightmare. Running some barely maintained operating system that is an nth-degree spin-off is like buying a pacemaker from craigslist. The people who go "I don't trust Canonical/Google" and then go download some binary blob browser fork/OS uploaded by an anonymous guy from the internet is way too large.

      • lioeters 2 hours ago
        > looks like there was a bit of a slip-up

        Indeed that is a suspicious or at least untrustworthy way to deflect the seriousness of a malware infection that potentially affects all users of an OS distribution.

        • zarzavat 2 hours ago
          Either way, nobody should use this distro ever again. It should be forked from a known good commit under a new maintainer.
      • justin66 2 hours ago
        Mistakes were made!
        • mito88 1 hour ago
          I heard tings
    • LambdaComplex 3 hours ago
      Calling this "a bit of a slip-up" while neither confirming nor denying the presence of malware is weird at best and incredibly suspicious at worst.
  • diogenes_atx 3 hours ago
    I ran the checksum for the current ISO file of the full Xubuntu desktop version on the Xubuntu website, and the checksum appears to be valid.

    https://mirror.us.leaseweb.net/ubuntu-cdimage/xubuntu/releas...

    [user@host]$ ls

    SHA256SUMS SHA256SUMS.gpg xubuntu-24.04.3-desktop-amd64.iso

    [user@host]$ cat SHA256SUMS

    b61e083d8a5ab003bad6ef7ea31ec21d7bfdf19b99d75987ab3fa3bbe85ec1bf *xubuntu-24.04.3-desktop-amd64.iso

    [user@host]$ sha256sum xubuntu-24.04.3-desktop-amd64.iso

    b61e083d8a5ab003bad6ef7ea31ec21d7bfdf19b99d75987ab3fa3bbe85ec1bf xubuntu-24.04.3-desktop-amd64.iso

    [user@host]$ echo $?

    0

    • zvmaz 3 hours ago
      From what I understood, it's the torrent link that downloads a compromised zip file rather then the authentic image:

      "Torrent downloads over at https://xubuntu.org/download/ are serving a zip file with a suspicious exe and a tos.txt inside. The TOS starts with Copyright (c) 2026 Xubuntu.org which is sus, because it is 2025. I opened the .exe with file-roller and couldn't find any .torrent inside."

    • __turbobrew__ 2 hours ago
      If an attacker can upload a compromised ISO I assume they can also upload a compromised checksum? In the age of https downloads — where the payload cannot be modified in transit — it never made sense to me why ISO checksums are a thing. For checksums to actually do anything there needs to be a chain of trust back to a trusted entity.
      • kbolino 52 minutes ago
        Mirrors.

        Lots of small, volunteer-run, low/zero-budget open-source projects cannot afford to pay for the server/CDN bandwidth they would need to host all their binary artifacts (ISOs, packages, etc.). They end up relying on mirrors provided for free by third parties instead. By publishing the checksums, they allow you to verify that the ISO image you downloaded from some mirror is the same one that they originally published.

      • normie3000 1 hour ago
        > In the age of https downloads — where the payload cannot be modified in transit — it never made sense to me why ISO checksums are a thing.

        Is there no way a download over HTTPS can be corrupted non-maliciously, or can fail to complete?

    • trebligdivad 3 hours ago
      And where did you get the reference SHA256SUMS from ? Did you check the gpg signature on them against a good sig from somewhere?
      • ntoskrnl_exe 3 hours ago
        According to the SHA256SUMS from Canonical's official download page at https://cdimage.ubuntu.com/xubuntu/releases/24.04.3/release/ that is the correct checksum.
      • tuhgdetzhh 3 hours ago
        Good Point. The checksums posted on Xubuntu.org could also compromised.
      • ranger_danger 2 hours ago
        how does one know any signature they find is "good"?
        • _def 2 hours ago
          Generally speaking, a signature is cryptographically signed, when a checksum value is encrypted with the owners private key. The according public key should ideally be distributed in a chain-of-trust, so it can be obtained through a trusted channel.
        • kwk1 1 hour ago
          If you're using a Debian derivative these keys should be in packages distributed with your distro with trust coming from that
        • SV_BubbleTime 2 hours ago
          We are in a perpetual loop of inefficient check methods, a bunch of steps, rediscovering what a supply chain attack is, a bunch of steps and just loop back over again.
      • diogenes_atx 3 hours ago
        I downloaded the checksums and the ISO image from the Xubuntu website: https://mirror.us.leaseweb.net/ubuntu-cdimage/xubuntu/releas...

        This url is on the main Xubuntu website, under "Xubuntu 24.04": click "Release page," then select United States. From there, you download the following files: SHA256SUMS, SHA256SUMS.gpg, xubuntu-24.04.3-desktop-amd64.iso

        The output of the other checksum commands is shown here:

        [user@host]$ gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS

        gpg: Signature made Thu 07 Aug 2025 06:05:22 AM CDT

        gpg: using RSA key 843938DF228D22F7B3742BC0D94AA3F0EFE21092

        gpg: Can't check signature: No public key

        [user@host]$ sha256sum --check SHA256SUMS

        xubuntu-24.04.3-desktop-amd64.iso: OK

        (output omitted for results of Xubuntu minimal version, which was not downloaded)

        The checksum is a cryptographic hash generated from the ISO file's contents. While the checksum for a specific, unchanged ISO file is fixed, the checksum that is published on a website could be deliberately altered by an attacker to hide a modified, malicious ISO.

  • 1313ed01 1 hour ago
    What scared me in that thread was the mention of the fake lubuntu site that is still up since someone took over the old domain last year(?). I downloaded and installed lubuntu just some week ago. Luckily I am pretty sure I downloaded it from the real site. The fake one only has downloads up to 19.04 or something.

    Have not installed Lubuntu in a few years, so never noticed any of the news of the domain change and take-over. Did not really find anything more about it when searching today?

    • ginsider_oaks 45 minutes ago
      if you use ublock origin you should be OK, it warns you when you try to access lubuntu.net
  • Polizeiposaune 2 hours ago
    oddly, the one "sus" thing flagged -- a " (C) 2026 " late in 2025 -- is consistent with practices of established book publishers.

    I recall purchasing a textbook in September of year X and being surprised that it was "from the future" with a "Copyright X+1".

  • cozzyd 3 hours ago
    fortunately, in this case, it seems like the malware may be moot if you use the iso to wipe your windows installation...
    • fainpul 2 hours ago
      But if you just try the live ISO and go back to your Windows without installing, you're infected? Seems like someone wants users to switch to Linux :P
      • cozzyd 58 minutes ago
        Red Pill Linux
  • eth0up 4 hours ago
    • dominick-cc 4 hours ago
      Thanks for this link. Opening reddit links on mobile is very frustrating for me because it opens the app and messes with the browser back button for me. Not sure if others have that problem too.
      • ants_everywhere 3 hours ago
        My solution is just to uninstall the app
      • Doohickey-d 1 hour ago
        On Android "Redreader" is the only third-party Reddit app that somehow survived the third-party-app-purge. Still free and open source, and much more pleasant than the official one.

        Would definitely recommend.

      • pluc 4 hours ago
        That's because you're not supposed to open reddit links anymore, you can just share your content directly with AI companies and ad brokers and cut out the middleman.
        • exe34 3 hours ago
          I had the same idea about the britcard - why doesn't the government just buy the information from the ad brokers?
      • layer8 3 hours ago
        On iOS Safari, long-press the link and select Open (or Open in Background). That will open the link in the browser instead of in the app, and Safari will remember that preference for the app. Select Open in Reddit to revert.

        Also, don’t install the app? Use Sink It instead: https://gosinkit.com/

      • ntoskrnl_exe 3 hours ago
        Try pressing on the original link and opening it in another tab, that usually bypasses opening the app for me.
      • marksbrown 3 hours ago
        For the moment "yesterday for old reddit" on firefox android works quite well.
      • eth0up 3 hours ago
        I'm a grovelling Linux fiend and usually support related posts. I tried to visit the url and saw it was blocked. Didn't want the post to die so archived it asap.

        Note too, that NextDNS blocks archive.is et al by default unless you manually add redirects.

        Whatta world

  • sylware 2 hours ago
    Somebody did sneak a wayland compositor for xfce???

    :P

  • amelius 3 hours ago
    Let's not kid ourselves. A state level actor who is playing the long game can compromise any distro, package, etc. without us knowing about it.
    • layer8 3 hours ago
      That kind of defeatism isn’t helpful.

      The present case also just seems malware easily detected by VirusTotal: https://old.reddit.com/r/xubuntu/comments/1oa43gt/xubuntuorg...

      • chorlton2080 3 hours ago
        Look at all the mainstream scanners that failed to detect it!
        • rs186 1 hour ago
          In reality, if Microsoft Defender (Security or whatever the name is) can detect it (which does in this case), it means it is flagged on most target users' machine.

          Of course, there are people who disable built-in security scanning and don't use another antivirus software, and that's on them.

        • layer8 3 hours ago
          That’s pretty normal in my experience. That’s why you check with VirusTotal instead of a single “mainstream” scanner.
      • amelius 3 hours ago
        Sticking-your-head-in-the-sand-ism isn't helpful either.

        But nobody wants to talk about true security. For example, why does a Python module that renders progress bars (for example) need my full trust about what it does to the rest of my system? Etc.

        • brookst 2 hours ago
          What's the term for the fallacy that this problem can be ignored because that problem is so much worse?

          Sorry, patient, why are we talking about setting your broken arm when you are genetically predisposed to cancer that's going to kill you anyway?

          • amelius 34 minutes ago
            Nobody said the problem could be ignored ...
    • timefirstgrav 3 hours ago
      Jia Tan with the XZ backdoor was caught because some performance obsessed person noticed a tiny delay... I'm sure they learned their lesson and are ensuring their next backdoor doesn't impact performance.
      • 3eb7988a1663 3 hours ago
        That is the insidious question - how many parallel efforts were/are in play when xz was going down? Surely that was not the only long term plan to compromise an "unrelated" component of system security. The Jia Tan organization might have already inserted back doors into dozens of different projects by now.
    • CaptainOfCoit 3 hours ago
      Sure, but realistically, how many of us right here have state level actors in our threat models? I sure don't, because it'd be impossible to live a normal life then.
      • iamnothere 3 hours ago
        But state level actors could target you, so you should immediately abandon any hope of privacy, disable your ad blockers, stop using Signal, install Windows 11, cease any complaints about the government, and eat the bugs.
      • ranger_danger 2 hours ago
        How would you know?
        • brookst 1 hour ago
          Don't most of us know what's in our threat model?

          Nobody spends energy worrying that the universe is an evil compiler that warps reality specifically to target us. Because 1) it's unlikely, and 2) if it were true there's no change in defensive posture that would help. It's the same for most individuals when considering being targeted by state actors. Unlikely, and not defensible, so no point hand wringing.

          • jijijijij 39 minutes ago
            Also, no state-actor would ever blow an immensely costly and rare backdoor like that on us peasants here. Even, if you would threaten to kill all the puppies. That's the sort of thing they reserve for state-level shenanigans, 100% targeting servers, infrastructure and industry, not individuals.

            Though, I also doubt, they would just shelve these epic exploits, since a universal Linux backdoor likely puts themself at risk too, unless you can pull off a grand conspiracy, or deliver patched packages to your own people without questions asked. Maybe a completely locked down country like North Korea could do it. I doubt many other countries got an incentive, unless in preparation of a specific attack.

    • Fnoord 2 hours ago
      Which state actor? Not all pigs are equal.
      • exceldrawing 50 minutes ago
        Your comment reflects that truth.
  • 1970-01-01 1 hour ago
    "Linux doesn't get viruses"

    Since Xubuntu inception a decade ago, facts certainly have changed!

    • anjel 1 hour ago
      A regrettable sign of Linux success
  • zvmaz 4 hours ago
    That is why I use Qubes OS [1] in order to have a certain peace of mind.

    [1] https://www.qubes-os.org/

    EDIT: further comment below:

    On second thought, Qubes OS does not prevent such types of malicious downloads; it can also happen to Qubes images. Verify your downloads with checksums and cryptographic signatures [2].

    [2] https://doc.qubes-os.org/en/latest/project-security/verifyin...

    • zvmaz 4 hours ago
      On second thought, Qubes OS does not prevent such types of malicious downloads; it can also happen to Qubes images. Verify your downloads with checksums and cryptographic signatures [1].

      [1] https://doc.qubes-os.org/en/latest/project-security/verifyin...

    • kachapopopow 4 hours ago
      qubes is just as vulnerable as xubuntu in this case (poor website security) no?
      • zvmaz 4 hours ago
        Yes indeed. Qubes has a good article on verifying distribution images not only with checksums but also with cryptographic signatures that verify the checksum files [1].

        [1] https://doc.qubes-os.org/en/latest/project-security/verifyin...

        • xyzzy123 3 hours ago
          But aren't you still trusting the website for instructions about how to verify the cryptographic signatures?
          • KAMSPioneer 3 hours ago
            The idea (outlined in the QubesOS documentation) is to clone the git repo of their website, verify the PGP commit signatures, then render the website yourself. Then you can be reasonably sure the website is legitimate, modulo a DoS attack stopping you from receiving updates to the website code, I suppose.

            Getting the correct PGP public key appears to be an exercise left to the reader, but if you are already running e.g. Fedora, you can view the packaged QubesOS distro keys distributed by your current OS, cross-reference that with a second source such as a PGP keyserver, and unless you're being Mossaded upon you're probably good if they match.

      • nekusar 3 hours ago
        Check a history on archive.org and validate the checksum wasnt changed to be the potentially malicious iso?

        Its not perfect... but its better than nothing.