1

I am sure many have seen the news of the hack at Linux Mint. The ISOs were changed on 20th Feb with backdoored ISOs.

They gained access via the LinuxMint Wordpress blog installation.

How could they have got access to the other directories on the server using just Wordpress? Could having Wordfence installed have stopped this? http://freedompenguin.com/articles/news/lessons-linux-mint-hack/

2 Answers 2

3

Looks like was more a defacement: hackers changed the page with the downloads, pointing the links to another server where they hosted the tainted iso files. They didn't changed the iso files hosted on Mint servers:

A post on Mint Blog stats:

What happened?

Hackers made a modified Linux Mint ISO, with a backdoor in it, and managed to hack our website to point to it.

0

We can't say for sure, but there are several possible methods:

  • Incorrect permissions on folders, so Wordpress could write to arbitrary files (there are file manager plugins for Wordpress, which could be installed if they gained access)
  • Unrelated vulnerability which resulted in other folder access
  • Webshell installation, combined with privilege escalation to allow for writing to folders which the Wordpress user didn't have access to
  • Shared credentials between Wordpress and, for example, SSH. Or PHPBB.

It's rare that there is only a single issue with any given site. Usually, it's possible to chain issues together to obtain more access than any individual issue would provide.

5
  • Would having Wordfence installed have prevented this? Feb 22, 2016 at 13:58
  • Depends if they would have triggered it. If they found the login details elsewhere, no, not at all!
    – Matthew
    Feb 22, 2016 at 14:27
  • Matthew, all that was charged was the download links. I don't think that on disk folders were compromised. Feb 22, 2016 at 16:44
  • @NeilSmithline OP asked about access to other folders - don't know if they accessed any other folders, but if they did, the methods above would probably work.
    – Matthew
    Feb 22, 2016 at 16:48
  • Based on link in the question, I think OP is confused. It was a WP hack due to a weak password. The download link targets must have been in WP. Feb 22, 2016 at 16:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .