I downloaded kali Linux 32-bit ISO and verified the sha256 checksum and they weren't the same. Totally different checksums and the file is fully downloaded. Any ideas? I used a reputable VPN and performed DNS leak tests to verify the connection was secure. Additionally, how difficult is it for someone to display fake checksums if a malicious user has access to your operating system or physical hardware and installed software with bad intentions? Thanks!
A different checksum only means that the software on your computer is not the same as the official version of the software. It does not necessarily mean that an attack is taking place.
- A transmission error may have corrupted the data in transit.
- Your download mirror may have inserted something benign to the software distribution, such as a thank-you or a request for donations.
- Your download mirror may have given you the wrong version of the software, for example if they are slow about updating the software on their website.
- Someone may have inserted a malicious program into your distribution.
If you've eventually gotten a version of your software that matches the officially published checksum then I wouldn't worry too much.
A few other observations:
Checksum values are not stable- small changes in the software can lead to totally different checksums. The fact that your checksum is radically different doesn't mean anything.
It would be exceedingly difficult for an attacker to display a fake checksum on your machine. They'd need to know what program you're using to calculate checksums, and they'd need to somehow install a malicious version of that program. If they're able to do that, then they've already got administrative access to your machine, making the purpose of further attacks a little unclear. In my mind it'd be more likely for them to hack into the software author's website and change the official checksum listed there.
Many sites use a download link that sends you to a random mirror as a simple way to provide load balancing for their mirrors. The fact that you've gotten three different checksums is not necessarily a red flag in my mind.