I am sure many have seen the news of the hack at Linux Mint. The ISOs were changed on 20th Feb with backdoored ISOs.

They gained access via the LinuxMint Wordpress blog installation.

How could they have got access to the other directories on the server using just Wordpress? Could having Wordfence installed have stopped this? http://freedompenguin.com/articles/news/lessons-linux-mint-hack/


Looks like was more a defacement: hackers changed the page with the downloads, pointing the links to another server where they hosted the tainted iso files. They didn't changed the iso files hosted on Mint servers:

A post on Mint Blog stats:

What happened?

Hackers made a modified Linux Mint ISO, with a backdoor in it, and managed to hack our website to point to it.


We can't say for sure, but there are several possible methods:

  • Incorrect permissions on folders, so Wordpress could write to arbitrary files (there are file manager plugins for Wordpress, which could be installed if they gained access)
  • Unrelated vulnerability which resulted in other folder access
  • Webshell installation, combined with privilege escalation to allow for writing to folders which the Wordpress user didn't have access to
  • Shared credentials between Wordpress and, for example, SSH. Or PHPBB.

It's rare that there is only a single issue with any given site. Usually, it's possible to chain issues together to obtain more access than any individual issue would provide.

  • Would having Wordfence installed have prevented this? – tripwire1000 Feb 22 '16 at 13:58
  • Depends if they would have triggered it. If they found the login details elsewhere, no, not at all! – Matthew Feb 22 '16 at 14:27
  • Matthew, all that was charged was the download links. I don't think that on disk folders were compromised. – Neil Smithline Feb 22 '16 at 16:44
  • @NeilSmithline OP asked about access to other folders - don't know if they accessed any other folders, but if they did, the methods above would probably work. – Matthew Feb 22 '16 at 16:48
  • Based on link in the question, I think OP is confused. It was a WP hack due to a weak password. The download link targets must have been in WP. – Neil Smithline Feb 22 '16 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.