9 ms·
Xubuntu.org Might Be Compromised
- deleted 1y ago[deleted]
- eth0up 1y agohttps://web.archive.org/web/20251019143921/https://old.reddit.com/r/Ubuntu/comments/1oa4549/xubuntuorg_might_be_compromised/ https://web.archive.org/web/20251019143921/https://old.reddi...
- dominick-cc 1y agoThanks for this link. Opening reddit links on mobile is very frustrating for me because it opens the app and messes with the browser back button for me. Not sure if others have that problem too.
- pluc 1y agoThat's because you're not supposed to open reddit links anymore, you can just share your content directly with AI companies and ad brokers and cut out the middleman.
- deleted 1y ago[deleted]
- exe34 1y agoI had the same idea about the britcard - why doesn't the government just buy the information from the ad brokers?
- eth0up 1y agoI'm a grovelling Linux fiend and usually support related posts. I tried to visit the url and saw it was blocked. Didn't want the post to die so archived it asap. Note too, that NextDNS blocks archive.is et al by default unless you manually add redirects. Whatta world
- aspenmayer 1y agoI’ve noticed that even on VPNs, US exit points sometimes block archive.is. Not sure if that is DNS related or what. Non-US VPN exit points don’t seem to be blocked at those times that the site navigation fails on US ones. I believe NextDNS is headquartered in the US, which may be related to the site nav issues we’re both experiencing. Curiously, uBlock Origin and my blocklists seem to block content on archive.is from loading from mail.ru, which may be related to the blocks, but I have never heard anyone on HN or elsewhere mention this, so I am, so that it can be known and explained if any explanation exists for why mail.ru scripts on archive.is are present. I don’t seem to see those scripts on the Tor version of archive.today, which archive.is is a mirror of today; apparently the original domain is the .is one, in any case. Consider my curiousity piqued! More info about the archive.is|.today mirrors including the Tor (.onion) version of the site are on the Wikipedia entry for the site: https://en.wikipedia.org/wiki/Archive.today https://en.wikipedia.org/wiki/Archive.today > archiveiya74codqgiixo33q62qlrqtkgmcitqx5u2oeqnmn5bpcbiyd.onion
- ROBLOX_MOMENTS 1y agoCan you define "block" ? The archive.is owner do a lot of fake blocking behaviour if they don't like your IP , if you try to use an anonymizer
- aspenmayer 1y agoI mean that the page doesn’t even begin to load. I get early and often Google reCAPTCHAs on archive.is and its mirrors under normal operation over HTTPS/Tor, but I was referring to the site not loading in at all, and getting some kind of PTR/SSL error iirc when it happens, which is most/all of the time when using US VPN exit points over HTTP(S). I don’t experience these errors at all over Tor, because their Tor site doesn’t use certificates. I run HTTPS-only mode in the clearnet, so perhaps others don’t experience this issue on their machine(s), but I don’t want any kind of MITM and/or downgrade attacks to slip through the cracks, just in case.
- aspenmayer 1y agoMore info about NextDNS (AS34939), which is indeed operated in a US jurisdiction: https://bgp.tools/as/34939 https://bgp.tools/as/34939
- marksbrown 1y agoFor the moment "yesterday for old reddit" on firefox android works quite well.
- ntoskrnl_exe 1y agoTry pressing on the original link and opening it in another tab, that usually bypasses opening the app for me.
- ants_everywhere 1y agoMy solution is just to uninstall the app
- layer8 1y agoOn iOS Safari, long-press the link and select Open (or Open in Background). That will open the link in the browser instead of in the app, and Safari will remember that preference for the app. Select Open in Reddit to revert. Also, don’t install the app? Use Sink It instead: https://gosinkit.com/ https://gosinkit.com/
- Doohickey-d 1y agoOn Android "Redreader" is the only third-party Reddit app that somehow survived the third-party-app-purge. Still free and open source, and much more pleasant than the official one. Would definitely recommend.
- curious_ralts 1y agoThanks for this, I was resorting to creating a PWA on old reddit (which has horrible ergonomics for mobile) per subreddit (you can't rename them so I remember which is which by position) thinking all the reddit clients that don't require login are gone.
- z500 1y agoThat was what I did for a year before I found out Revanced Manager had a patch for Reddit is fun. That was an inconvenient year.
- phatskat 1y agoThe day Apollo died is the day I stopped logging in to Reddit, or going there regularly. I use old when I have to go there for more than a top-level reply from a Google search. I want to say they really goofed up, but tbh Reddit seems fine without me. I’m mostly fine without it, but I do miss a few of my communities.
- zvmaz 1y agoThat is why I use Qubes OS [1] in order to have a certain peace of mind. [1] https://www.qubes-os.org/ https://www.qubes-os.org/ EDIT: further comment below: On second thought, Qubes OS does not prevent such types of malicious downloads; it can also happen to Qubes images. Verify your downloads with checksums and cryptographic signatures [2]. [2] https://doc.qubes-os.org/en/latest/project-security/verifying-signatures.html https://doc.qubes-os.org/en/latest/project-security/verifyin...
- kachapopopow 1y agoqubes is just as vulnerable as xubuntu in this case (poor website security) no?
- zvmaz 1y agoYes indeed. Qubes has a good article on verifying distribution images not only with checksums but also with cryptographic signatures that verify the checksum files [1]. [1] https://doc.qubes-os.org/en/latest/project-security/verifying-signatures.html https://doc.qubes-os.org/en/latest/project-security/verifyin...
- xyzzy123 1y agoBut aren't you still trusting the website for instructions about how to verify the cryptographic signatures?
- KAMSPioneer 1y agoThe idea (outlined in the QubesOS documentation) is to clone the git repo of their website, verify the PGP commit signatures, then render the website yourself. Then you can be reasonably sure the website is legitimate, modulo a DoS attack stopping you from receiving updates to the website code, I suppose. Getting the correct PGP public key appears to be an exercise left to the reader, but if you are already running e.g. Fedora, you can view the packaged QubesOS distro keys distributed by your current OS, cross-reference that with a second source such as a PGP keyserver, and unless you're being Mossaded upon you're probably good if they match.
- crtasm 1y agoThere's a sticked comment on the source thread: https://old.reddit.com/r/xubuntu/comments/1oa43gt/xubuntuorg_might_be_compromised/ https://old.reddit.com/r/xubuntu/comments/1oa43gt/xubuntuorg...
- hamdingers 1y ago> Thanks everyone. We're beholden to our hosting environment for upgrades and it looks like there was a bit of a slip-up here. It's being worked on, but for now the Downloads page is disabled. Calling this a "slip-up" is an outrageous downplay. If anything this makes me suspicious of the moderator who posted the comment too. One does not accidentally prepare a zip file with a malicious exe and xubuntu-specific language, upload it to a server, and point a torrent link at it.
- justin66 1y agoMistakes were made!
- mito88 1y agoI heard tings
- lioeters 1y ago> looks like there was a bit of a slip-up Indeed that is a suspicious or at least untrustworthy way to deflect the seriousness of a malware infection that potentially affects all users of an OS distribution.
- zarzavat 1y agoEither way, nobody should use this distro ever again. It should be forked from a known good commit under a new maintainer.
- integralid 1y ago
- amelius 1y agoLet's not kid ourselves. A state level actor who is playing the long game can compromise any distro, package, etc. without us knowing about it.
- CaptainOfCoit 1y agoSure, but realistically, how many of us right here have state level actors in our threat models? I sure don't, because it'd be impossible to live a normal life then.
- iamnothere 1y agoBut state level actors could target you, so you should immediately abandon any hope of privacy, disable your ad blockers, stop using Signal, install Windows 11, cease any complaints about the government, and eat the bugs.
- ranger_danger 1y agoHow would you know?
- brookst 1y agoDon't most of us know what's in our threat model? Nobody spends energy worrying that the universe is an evil compiler that warps reality specifically to target us. Because 1) it's unlikely, and 2) if it were true there's no change in defensive posture that would help. It's the same for most individuals when considering being targeted by state actors. Unlikely, and not defensible, so no point hand wringing.
- jijijijij 1y agoAlso, no state-actor would ever blow an immensely costly and rare backdoor like that on us peasants here. Even, if you would threaten to kill all the puppies. That's the sort of thing they reserve for state-level shenanigans, 100% targeting servers, infrastructure and industry, not individuals. Though, I also doubt, they would just shelve these epic exploits, since a universal Linux backdoor likely puts themself at risk too, unless you can pull off a grand conspiracy, or deliver patched packages to your own people without questions asked. Maybe a completely locked down country like North Korea could do it. I doubt many other countries got an incentive, unless in preparation of a specific attack.
- cozzyd 1y agofortunately, in this case, it seems like the malware may be moot if you use the iso to wipe your windows installation...
- diogenes_atx 1y agoI ran the checksum for the current ISO file of the full Xubuntu desktop version on the Xubuntu website, and the checksum appears to be valid. https://mirror.us.leaseweb.net/ubuntu-cdimage/xubuntu/releases/24.04/release/ https://mirror.us.leaseweb.net/ubuntu-cdimage/xubuntu/releas... [user@host]$ ls SHA256SUMS SHA256SUMS.gpg xubuntu-24.04.3-desktop-amd64.iso [user@host]$ cat SHA256SUMS b61e083d8a5ab003bad6ef7ea31ec21d7bfdf19b99d75987ab3fa3bbe85ec1bf *xubuntu-24.04.3-desktop-amd64.iso [user@host]$ sha256sum xubuntu-24.04.3-desktop-amd64.iso b61e083d8a5ab003bad6ef7ea31ec21d7bfdf19b99d75987ab3fa3bbe85ec1bf xubuntu-24.04.3-desktop-amd64.iso [user@host]$ echo $? 0
- trebligdivad 1y agoAnd where did you get the reference SHA256SUMS from ? Did you check the gpg signature on them against a good sig from somewhere?
- tuhgdetzhh 1y agoGood Point. The checksums posted on Xubuntu.org could also compromised.
- diogenes_atx 1y agoI downloaded the checksums and the ISO image from the Xubuntu website: https://mirror.us.leaseweb.net/ubuntu-cdimage/xubuntu/releases/24.04/release/ https://mirror.us.leaseweb.net/ubuntu-cdimage/xubuntu/releas... This url is on the main Xubuntu website, under "Xubuntu 24.04": click "Release page," then select United States. From there, you download the following files: SHA256SUMS, SHA256SUMS.gpg, xubuntu-24.04.3-desktop-amd64.iso The output of the other checksum commands is shown here: [user@host]$ gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS gpg: Signature made Thu 07 Aug 2025 06:05:22 AM CDT gpg: using RSA key 843938DF228D22F7B3742BC0D94AA3F0EFE21092 gpg: Can't check signature: No public key [user@host]$ sha256sum --check SHA256SUMS xubuntu-24.04.3-desktop-amd64.iso: OK (output omitted for results of Xubuntu minimal version, which was not downloaded) The checksum is a cryptographic hash generated from the ISO file's contents. While the checksum for a specific, unchanged ISO file is fixed, the checksum that is published on a website could be deliberately altered by an attacker to hide a modified, malicious ISO.
- retsl 1y agothe malware's main function seems to be to check the clipboard for crypto wallet addresses and then replace them with attacker addresses: Bitcoin (bc1): bc1qrzh7d0yy8c3arqxc23twkjujxxaxcm08uqh60v Litecoin (ltc1/L/M): LQ4B4aJqUH92BgtDseWxiCRn45Q8eHzTkH Ethereum (0x): 0x10A8B2e2790879FFCdE514DdE615b4732312252D Dogecoin (D): DQzrwvUJTXBxAbYiynzACLntrY4i9mMs7D Tron (T): TW93HYbyptRYsXj1rkHWyVUpps2anK12hg Ripple (r): r9vQFVwRxSkpFavwA9HefPFkWaWBQxy4pU Cardano (addr1): addr1q9atfml5cew4hx0z09xu7mj7fazv445z4xyr5gtqh6c9p4r6knhlf3jatwv7y72deah9un6yettg92vg8gskp04s2r2qren6tw can't guarantee it doesn't do anything else.
- _zagj 1y agoAs soon as I saw the headline, I assumed something of this sort. Maybe it's naive, but I miss the days when you could just trust (however unfounded) open source software. I never had to hesitate before downloading a distro or a package. Now I only install something if I absolutely need it.
- oofbey 1y ago[flagged]
- _zagj 1y agoYou could argue that if not crypto, it would have been something else eventually, and that the heightened vigilance it has necessitated has made it more difficult for other motivated attackers (like state actors) to backdoor or compromise OSS. But as someone who doesn't use crypto, I completely get the "f*ck crypto" sentiment.
- brokensegue 1y agostealing other data is less lucrative. i'm not confident someone could empty my bank account even with my username/password
- 1y ago
- sylware 1y agoSomebody did sneak a wayland compositor for xfce??? :P
- iotku 1y agoWell actually... https://wiki.xfce.org/releng/wayland_roadmap https://wiki.xfce.org/releng/wayland_roadmap
- lproven 1y agoXfce has had experimental Wayland support since 4.20, and openSUSE Leap 16 includes a version of Xfce with the Labwc compositor. https://www.theregister.com/2025/08/07/opensuse_leap_16_reaches_rc/ https://www.theregister.com/2025/08/07/opensuse_leap_16_reac...
- Polizeiposaune 1y agooddly, the one "sus" thing flagged -- a " (C) 2026 " late in 2025 -- is consistent with practices of established book publishers. I recall purchasing a textbook in September of year X and being surprised that it was "from the future" with a "Copyright X+1".
- 1313ed01 1y agoWhat scared me in that thread was the mention of the fake lubuntu site that is still up since someone took over the old domain last year(?). I downloaded and installed lubuntu just some week ago. Luckily I am pretty sure I downloaded it from the real site. The fake one only has downloads up to 19.04 or something. Have not installed Lubuntu in a few years, so never noticed any of the news of the domain change and take-over. Did not really find anything more about it when searching today?
- ginsider_oaks 1y agoif you use ublock origin you should be OK, it warns you when you try to access lubuntu.net
- hu3 1y agoIndeed: uBO has prevented the following page from loading: "FAKElubuntu.net I wont give backlinks too" The page was blocked because of a matching filter in uBlock filters – Badware risks.
- 1313ed01 1y agoWhat is it triggered by? I have not used unlock in years, since NoScript as a side-effect of not running scripts tends to block almost everything anyway (in particular ads), but maybe I should install it again after all for things like this.
- horseradish7k 1y agothe "badware risks" filter list
- bstsb 1y agothat website, although unofficial, looks to be one of the many sites online that stuffs a bunch of ads on a wordpress template and links straight to the official download links after a long-winded AI article about the software also see Bloxstrap, a popular Roblox bootstrapper - its official URL is https://bloxstraplabs.com https://bloxstraplabs.com, but many fakes rank high in SEO (bloxstrap[.]net, blxstrap[.]com, bloxstrape[.]com, bloxstrapper[.]com, bloxstraps[.]net, bloxstrapp[.]com, thebloxstrap[.]net) currently it isn't hosting malware, but this could obviously change
- 1970-01-01 1y ago"Linux doesn't get viruses" Since Xubuntu inception a decade ago, facts certainly have changed!
- anjel 1y agoA regrettable sign of Linux success
- bogwog 1y agoWell, the virus in this case is a Windows executable targeted at Windows users trying to download Linux...
- sim7c00 1y agolikely it could run on wine ? :D maybe... :P
- 1970-01-01 1y agoOfficial, popular, longstanding (20 years!) Linux distro is clearly distributing "a virus" via an official repo, with nothing about the danger on its website? Linux mantra: Nothing wrong here, and if there is, someone will fix it eventually, probably, maybe..
- benterix 1y agoWith these reports, I always wonder - do people really keep their software wallets on a machine they use every day? Personally I keep it on a laptop that is used just for that and it never occurred to me any other options is viable.
- KronisLV 1y agoNever underestimated the impact of convenience. At the same time, I'm so broke that any attackers could just look at my mostly empty wallet and weep (or do automated attacks and extract what little there is in the case of compromise).
- danpalmer 1y agoIf you do your cryptocurrency stuff on a laptop/desktop you're probably already in the minority, most of the world only has a smartphone and will use that. If you have two computers you're in a tiny minority. If you can dedicate one computer to just doing cryptocurrency stuff you're now in a fraction of a fraction of a percent.
- creshal 1y agoIf it works with only 2-3 wallets it can be lucrative enough.
- tamimio 1y agoThis should lead to better checksum verification mechanism, because if you compromise the site, you can put whatever compromised checksum as well. I think having a centralized checksum verification system for all major (or all) distributions would be a good start.
- pona-a 1y agoWhy not even a PGP signature from the team? At least the public keys can be pinned so the possible compromise can be detected. I think Arch does something like that.
- mr128bit 1y ago[dead]
- mr128bit 1y ago[dead]