news
Xubuntu Reveals How its Website Was Hijacked
Quoting: Xubuntu Reveals How its Website Was Hijacked - OMG! Ubuntu —
As detailed in our coverage back in October, the official Xubuntu download page began serving a malicious .zip file to users attempting to download the official torrent on October 15.
Though the dodgy download link was quickly detected and dealt with, but questions raised as to how it was able to happen in the first place and whether any other downloads were impacted.
Today the Xubuntu team has answers from an incident report given to it by the Canonical Security team.
Xubuntu:
-
[xubuntu-users] Public postmortum of the brief Xubuntu.org torrent download compromise last month
As you may have heard, for a short period of time back in October, our download site at https://xubuntu.org/download/ was serving a malicious zip file instead of the torrents users expected to download.
This was caused by a malicious actor gaining access by brute forcing a vulnerable component of the WordPress installation that Canonical maintains for the team. Once they had access, they were able to inject the code that changed the download links.
The compromise was first reported on October 15, and Canonical’s infrastructure and security teams were alerted shortly afterward. The site was immediately locked down and the downloads page disabled, and an investigation began.
LWN:
-
Postmortem of the Xubuntu.org download site compromise
In mid-October, the Xubuntu download site was compromised and had directed users to a malicious zip file instead of the Torrent file that users expected. Elizabeth K. Joseph has published a postmortem of the incident, along with plans to avoid such a breach in the future...
Linuxiac:
-
Xubuntu Discloses October Download Site Compromise
Xubuntu has released a detailed postmortem describing the October compromise of its website’s download page, where the ISO download button briefly served a malicious ZIP file instead of the expected installation image.
The incident began on October 15, when visitors clicking the main “Download” button on Xubuntu.org were redirected to a file named “Xubuntu-Safe-Download.zip.” The archive was malicious.
It’s important to stress that nothing on cdimages.ubuntu.com, official Ubuntu repositories, or the mirror network was affected, and existing Xubuntu installations were never at risk.
According to the project’s postmortem, the attack was made possible after a malicious actor brute-forced a vulnerable component in the WordPress instance Canonical maintains for the Xubuntu team.