Xubuntu.org Might Be Compromised

https://old.reddit.com/r/Ubuntu/comments/1oa4549/xubuntuorg_might_be_compromised/

by kekqqq • 9 months ago

365 150 9 months ago

old.reddit.com

eth0up4• 9 months ago

https://web.archive.org/web/20251019143921/https://old.reddi...

Thanks for this link. Opening reddit links on mobile is very frustrating for me because it opens the app and messes with the browser back button for me. Not sure if others have that problem too.

pluc• 9 months ago

That's because you're not supposed to open reddit links anymore, you can just share your content directly with AI companies and ad brokers and cut out the middleman.

eth0up4• 9 months ago

I'm a grovelling Linux fiend and usually support related posts. I tried to visit the url and saw it was blocked. Didn't want the post to die so archived it asap.

Note too, that NextDNS blocks archive.is et al by default unless you manually add redirects.

Whatta world

marksbrown• 9 months ago

For the moment "yesterday for old reddit" on firefox android works quite well.

ntoskrnl_exe2• 9 months ago

Try pressing on the original link and opening it in another tab, that usually bypasses opening the app for me.

ants_everywhere• 9 months ago

My solution is just to uninstall the app

layer83• 9 months ago

On iOS Safari, long-press the link and select Open (or Open in Background). That will open the link in the browser instead of in the app, and Safari will remember that preference for the app. Select Open in Reddit to revert.

Also, don’t install the app? Use Sink It instead: https://gosinkit.com/

Doohickey-d• 9 months ago

On Android "Redreader" is the only third-party Reddit app that somehow survived the third-party-app-purge. Still free and open source, and much more pleasant than the official one.

Would definitely recommend.

zvmaz4• 9 months ago

That is why I use Qubes OS [1] in order to have a certain peace of mind.

[1] https://www.qubes-os.org/

EDIT: further comment below:

On second thought, Qubes OS does not prevent such types of malicious downloads; it can also happen to Qubes images. Verify your downloads with checksums and cryptographic signatures [2].

[2] https://doc.qubes-os.org/en/latest/project-security/verifyin...

zvmaz4• 9 months ago

On second thought, Qubes OS does not prevent such types of malicious downloads; it can also happen to Qubes images. Verify your downloads with checksums and cryptographic signatures [1].

[1] https://doc.qubes-os.org/en/latest/project-security/verifyin...

kachapopopow2• 9 months ago

qubes is just as vulnerable as xubuntu in this case (poor website security) no?

zvmaz4• 9 months ago

Yes indeed. Qubes has a good article on verifying distribution images not only with checksums but also with cryptographic signatures that verify the checksum files [1].

[1] https://doc.qubes-os.org/en/latest/project-security/verifyin...

nekusar• 9 months ago

Check a history on archive.org and validate the checksum wasnt changed to be the potentially malicious iso?

Its not perfect... but its better than nothing.

baobun• 9 months ago

We should really compare it to Windows here, since that's the target. But if we do compare it to a classic Linux dist like xubuntu as baseline:

Using Qubes would limit the blast radius for a scenario like this. In QubesOS, you would use disposable VMs (with no access to your crypto wallets or other user files) to download and flash an ISO. So even if this malware was targeting Linux, it wouldn't get zit and disappear when you finish flashing and shut down that VM (as long as there isn't an unpatched exploit breaking the VM isolation involved).

Of course, if the ISO is bad then this won't save you from compromise once you boot it. But that's not what happened here.

crtasm• 9 months ago

There's a sticked comment on the source thread: https://old.reddit.com/r/xubuntu/comments/1oa43gt/xubuntuorg...

hamdingers2• 9 months ago

Thanks everyone. We're beholden to our hosting environment for upgrades and it looks like there was a bit of a slip-up here. It's being worked on, but for now the Downloads page is disabled.

Calling this a "slip-up" is an outrageous downplay. If anything this makes me suspicious of the moderator who posted the comment too. One does not accidentally prepare a zip file with a malicious exe and xubuntu-specific language, upload it to a server, and point a torrent link at it.

justin66• 9 months ago

Mistakes were made!

lioeters• 9 months ago

looks like there was a bit of a slip-up

Indeed that is a suspicious or at least untrustworthy way to deflect the seriousness of a malware infection that potentially affects all users of an OS distribution.

OsrsNeedsf2P• 9 months ago

Calling this a "slip-up" is an outrageous downplay. If anything this makes me suspicious of the moderator who posted the comment too.

You're making an assumption that this moderator is anything more than a Xubuntu enthusiast who wants to downplay outrage on Reddit. Keep in mind Xubuntu is mostly a community effort, not a large corporation with seniors who know how to handle this "best".

sim7c002• 9 months ago

WHOOPSY DAISY

LambdaComplex• 9 months ago

Calling this "a bit of a slip-up" while neither confirming nor denying the presence of malware is weird at best and incredibly suspicious at worst.

DoctorOetker• 9 months ago

perhaps the attacker has compromised maintainer credentials / logins?

amelius4• 9 months ago

Let's not kid ourselves. A state level actor who is playing the long game can compromise any distro, package, etc. without us knowing about it.

CaptainOfCoit• 9 months ago

Sure, but realistically, how many of us right here have state level actors in our threat models? I sure don't, because it'd be impossible to live a normal life then.

iamnothere• 9 months ago

But state level actors could target you, so you should immediately abandon any hope of privacy, disable your ad blockers, stop using Signal, install Windows 11, cease any complaints about the government, and eat the bugs.

ranger_danger2• 9 months ago

How would you know?

mixedbit• 9 months ago

As Stuxnet showed us, you don't need to run a nuclear program to be infected by malware developed by state level actors.

timefirstgrav• 9 months ago

Jia Tan with the XZ backdoor was caught because some performance obsessed person noticed a tiny delay... I'm sure they learned their lesson and are ensuring their next backdoor doesn't impact performance.

3eb7988a1663• 9 months ago

That is the insidious question - how many parallel efforts were/are in play when xz was going down? Surely that was not the only long term plan to compromise an "unrelated" component of system security. The Jia Tan organization might have already inserted back doors into dozens of different projects by now.

layer83• 9 months ago

That kind of defeatism isn’t helpful.

The present case also just seems malware easily detected by VirusTotal: https://old.reddit.com/r/xubuntu/comments/1oa43gt/xubuntuorg...

amelius4• 9 months ago

Sticking-your-head-in-the-sand-ism isn't helpful either.

But nobody wants to talk about true security. For example, why does a Python module that renders progress bars (for example) need my full trust about what it does to the rest of my system? Etc.

chorlton2080• 9 months ago

Look at all the mainstream scanners that failed to detect it!

Fnoord• 9 months ago

Which state actor? Not all pigs are equal.

exceldrawing• 9 months ago

Your comment reflects that truth.

cozzyd2• 9 months ago

fortunately, in this case, it seems like the malware may be moot if you use the iso to wipe your windows installation...

fainpul• 9 months ago

But if you just try the live ISO and go back to your Windows without installing, you're infected? Seems like someone wants users to switch to Linux :P

cozzyd2• 9 months ago

Red Pill Linux

diogenes_atx2• 9 months ago

I ran the checksum for the current ISO file of the full Xubuntu desktop version on the Xubuntu website, and the checksum appears to be valid.

https://mirror.us.leaseweb.net/ubuntu-cdimage/xubuntu/releas...

[user@host]$ ls

SHA256SUMS SHA256SUMS.gpg xubuntu-24.04.3-desktop-amd64.iso

[user@host]$ cat SHA256SUMS

b61e083d8a5ab003bad6ef7ea31ec21d7bfdf19b99d75987ab3fa3bbe85ec1bf *xubuntu-24.04.3-desktop-amd64.iso

[user@host]$ sha256sum xubuntu-24.04.3-desktop-amd64.iso

b61e083d8a5ab003bad6ef7ea31ec21d7bfdf19b99d75987ab3fa3bbe85ec1bf xubuntu-24.04.3-desktop-amd64.iso

[user@host]$ echo $?

zvmaz4• 9 months ago

From what I understood, it's the torrent link that downloads a compromised zip file rather then the authentic image:

"Torrent downloads over at https://xubuntu.org/download/ are serving a zip file with a suspicious exe and a tos.txt inside. The TOS starts with Copyright (c) 2026 Xubuntu.org which is sus, because it is 2025. I opened the .exe with file-roller and couldn't find any .torrent inside."

zahlman5• 9 months ago

opened the .exe with file-roller

... This is a thing?

trebligdivad• 9 months ago

And where did you get the reference SHA256SUMS from ? Did you check the gpg signature on them against a good sig from somewhere?

tuhgdetzhh• 9 months ago

Good Point. The checksums posted on Xubuntu.org could also compromised.

diogenes_atx2• 9 months ago

I downloaded the checksums and the ISO image from the Xubuntu website: https://mirror.us.leaseweb.net/ubuntu-cdimage/xubuntu/releas...

This url is on the main Xubuntu website, under "Xubuntu 24.04": click "Release page," then select United States. From there, you download the following files: SHA256SUMS, SHA256SUMS.gpg, xubuntu-24.04.3-desktop-amd64.iso

The output of the other checksum commands is shown here:

[user@host]$ gpg --keyid-format long --verify SHA256SUMS.gpg SHA256SUMS

gpg: Signature made Thu 07 Aug 2025 06:05:22 AM CDT

gpg: using RSA key 843938DF228D22F7B3742BC0D94AA3F0EFE21092

gpg: Can't check signature: No public key

[user@host]$ sha256sum --check SHA256SUMS

xubuntu-24.04.3-desktop-amd64.iso: OK

(output omitted for results of Xubuntu minimal version, which was not downloaded)

The checksum is a cryptographic hash generated from the ISO file's contents. While the checksum for a specific, unchanged ISO file is fixed, the checksum that is published on a website could be deliberately altered by an attacker to hide a modified, malicious ISO.

ntoskrnl_exe2• 9 months ago

According to the SHA256SUMS from Canonical's official download page at https://cdimage.ubuntu.com/xubuntu/releases/24.04.3/release/ that is the correct checksum.

ranger_danger2• 9 months ago

how does one know any signature they find is "good"?

__turbobrew__2• 9 months ago

If an attacker can upload a compromised ISO I assume they can also upload a compromised checksum? In the age of https downloads — where the payload cannot be modified in transit — it never made sense to me why ISO checksums are a thing. For checksums to actually do anything there needs to be a chain of trust back to a trusted entity.

normie3000• 9 months ago

In the age of https downloads — where the payload cannot be modified in transit — it never made sense to me why ISO checksums are a thing.

Is there no way a download over HTTPS can be corrupted non-maliciously, or can fail to complete?

kbolino• 9 months ago

Mirrors.

Lots of small, volunteer-run, low/zero-budget open-source projects cannot afford to pay for the server/CDN bandwidth they would need to host all their binary artifacts (ISOs, packages, etc.). They end up relying on mirrors provided for free by third parties instead. By publishing the checksums, they allow you to verify that the ISO image you downloaded from some mirror is the same one that they originally published.

retsl2• 9 months ago

the malware's main function seems to be to check the clipboard for crypto wallet addresses and then replace them with attacker addresses:

  Bitcoin (bc1): bc1qrzh7d0yy8c3arqxc23twkjujxxaxcm08uqh60v
  Litecoin (ltc1/L/M): LQ4B4aJqUH92BgtDseWxiCRn45Q8eHzTkH
  Ethereum (0x): 0x10A8B2e2790879FFCdE514DdE615b4732312252D
  Dogecoin (D): DQzrwvUJTXBxAbYiynzACLntrY4i9mMs7D
  Tron (T): TW93HYbyptRYsXj1rkHWyVUpps2anK12hg
  Ripple (r): r9vQFVwRxSkpFavwA9HefPFkWaWBQxy4pU
  Cardano (addr1): addr1q9atfml5cew4hx0z09xu7mj7fazv445z4xyr5gtqh6c9p4r6knhlf3jatwv7y72deah9un6yettg92vg8gskp04s2r2qren6tw

can't guarantee it doesn't do anything else.

_zagj• 9 months ago

As soon as I saw the headline, I assumed something of this sort. Maybe it's naive, but I miss the days when you could just trust (however unfounded) open source software. I never had to hesitate before downloading a distro or a package. Now I only install something if I absolutely need it.

fragmede3• 9 months ago

The whole supply chain, in fact. The project's site isn't necessarily the real one. the GitHub repo it links to isn't necessarily the real one, the binaries it offers to download aren't necessarily the real one, GitHub isn't even necessarily the real one! There's currently a phishing copy of GitHub up at hxxps://git.hubp.de/ that somebody is going to fall for before it's taken down. If you want to be help get it blocked, load that site up and flag it as unsafe in Chrome! (It's hilarious that the site has a Cloudflare challenge to get in, btw.)

It's a big bad dark scary Internet out there. Be careful.

bsder• 9 months ago

Let's all thank Bitcoin for making supply chain compromises worth anonymous money transfers.

riedel• 9 months ago

Isn't possible to check in the block chain to check if the attacker is actually receiving money? Just curious how much money ine makes with such attacks.

gield• 9 months ago

I just checked all wallets, they're all empty with no recent transactions.

basilikum2• 9 months ago

Here is the BTC and ETH address for convenience for anyone who wants to check: https://mempool.space/address/bc1qrzh7d0yy8c3arqxc23twkjujxx... https://etherscan.io/address/0x10A8B2e2790879FFCdE514DdE615b...

They are empty as of now.

like_any_other• 9 months ago

Do browsers still let websites read the clipboard?

integralid2• 9 months ago

That's not done in the browser, malware is hidden in the Ubuntu download (but that's a rather amateurish work, image was not compromised, malware was distributed as .exe file next to it).

retsl2• 9 months ago

Not without approval, see https://developer.mozilla.org/en-US/docs/Web/API/Clipboard_A... or https://web.dev/articles/async-clipboard#security_and_permis.... But that is not relevant here.

Instead of the .torrent files, the compromised website served a .zip file, which contained a .exe. When opened, it shows a GUI to select a Xubuntu version and a button to generate the link. When that button was clicked, the malware showed a download link to the user and, in the background, deployed a second stage to %APPDATA%\osn10963\elzvcf.exe and executed it.

The second stage monitors the clipboard for cryptocurrency addresses which it will replace with attacker-controlled ones. The second stage is also added to HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ to ensure it is run whenever the user logs in.

Both stages have some limited anti-debugging and anti-VM functionality.

Polizeiposaune• 9 months ago

I recall purchasing a textbook in September of year X and being surprised that it was "from the future" with a "Copyright X+1".

sylware• 9 months ago

Somebody did sneak a wayland compositor for xfce???

iotku• 9 months ago

Well actually...

https://wiki.xfce.org/releng/wayland_roadmap

lproven• 9 months ago

Xfce has had experimental Wayland support since 4.20, and openSUSE Leap 16 includes a version of Xfce with the Labwc compositor.

https://www.theregister.com/2025/08/07/opensuse_leap_16_reac...

1313ed012• 9 months ago

What scared me in that thread was the mention of the fake lubuntu site that is still up since someone took over the old domain last year(?). I downloaded and installed lubuntu just some week ago. Luckily I am pretty sure I downloaded it from the real site. The fake one only has downloads up to 19.04 or something.

Have not installed Lubuntu in a few years, so never noticed any of the news of the domain change and take-over. Did not really find anything more about it when searching today?

ginsider_oaks• 9 months ago

if you use ublock origin you should be OK, it warns you when you try to access lubuntu.net

hu3• 9 months ago

Indeed:

uBO has prevented the following page from loading:

"FAKElubuntu.net I wont give backlinks too"

The page was blocked because of a matching filter in uBlock filters – Badware risks.

1313ed012• 9 months ago

What is it triggered by?

I have not used unlock in years, since NoScript as a side-effect of not running scripts tends to block almost everything anyway (in particular ads), but maybe I should install it again after all for things like this.

bstsb• 9 months ago

that website, although unofficial, looks to be one of the many sites online that stuffs a bunch of ads on a wordpress template and links straight to the official download links after a long-winded AI article about the software

also see Bloxstrap, a popular Roblox bootstrapper - its official URL is https://bloxstraplabs.com, but many fakes rank high in SEO (bloxstrap[.]net, blxstrap[.]com, bloxstrape[.]com, bloxstrapper[.]com, bloxstraps[.]net, bloxstrapp[.]com, thebloxstrap[.]net)

currently it isn't hosting malware, but this could obviously change

1970-01-012• 9 months ago

"Linux doesn't get viruses"

Since Xubuntu inception a decade ago, facts certainly have changed!

anjel• 9 months ago

A regrettable sign of Linux success

bogwog• 9 months ago

Well, the virus in this case is a Windows executable targeted at Windows users trying to download Linux...

sim7c002• 9 months ago

likely it could run on wine ? :D maybe... :P

1970-01-012• 9 months ago

Official, popular, longstanding (20 years!) Linux distro is clearly distributing "a virus" via an official repo, with nothing about the danger on its website?

Linux mantra: Nothing wrong here, and if there is, someone will fix it eventually, probably, maybe..

benterix• 9 months ago

With these reports, I always wonder - do people really keep their software wallets on a machine they use every day? Personally I keep it on a laptop that is used just for that and it never occurred to me any other options is viable.

KronisLV• 9 months ago

Never underestimated the impact of convenience. At the same time, I'm so broke that any attackers could just look at my mostly empty wallet and weep (or do automated attacks and extract what little there is in the case of compromise).

danpalmer• 9 months ago

If you do your cryptocurrency stuff on a laptop/desktop you're probably already in the minority, most of the world only has a smartphone and will use that. If you have two computers you're in a tiny minority. If you can dedicate one computer to just doing cryptocurrency stuff you're now in a fraction of a fraction of a percent.

creshal2• 9 months ago

If it works with only 2-3 wallets it can be lucrative enough.

tamimio• 9 months ago

This should lead to better checksum verification mechanism, because if you compromise the site, you can put whatever compromised checksum as well. I think having a centralized checksum verification system for all major (or all) distributions would be a good start.

pona-a• 9 months ago

Why not even a PGP signature from the team? At least the public keys can be pinned so the possible compromise can be detected. I think Arch does something like that.

Xubuntu.org Might Be Compromised

Related Stories