I downloaded kali Linux 32-bit ISO and verified the sha256 checksum and they weren't the same. Totally different checksums and the file is fully downloaded. Any ideas? I used a reputable VPN and performed DNS leak tests to verify the connection was secure. Additionally, how difficult is it for someone to display fake checksums if a malicious user has access to your operating system or physical hardware and installed software with bad intentions? Thanks!

  • How are you calculating checksum at your end? Jul 16 '17 at 23:12
  • Using 7-zip built in checksum. I have downloaded it three times and when I discovered the checksums weren't right for the first two downloads and I downloaded it for a third time I got the correct checksum for the .iso telling me that something is wrong with the other two. Jul 16 '17 at 23:48
  • I can post the files with the source checksum (and official link to verify) as well as the .iso files and their checksums as well so you can take a look at the checksums to also see they are incorrect. Would that help? Thanks! Jul 17 '17 at 0:41

A different checksum only means that the software on your computer is not the same as the official version of the software. It does not necessarily mean that an attack is taking place.

  1. A transmission error may have corrupted the data in transit.
  2. Your download mirror may have inserted something benign to the software distribution, such as a thank-you or a request for donations.
  3. Your download mirror may have given you the wrong version of the software, for example if they are slow about updating the software on their website.
  4. Someone may have inserted a malicious program into your distribution.

If you've eventually gotten a version of your software that matches the officially published checksum then I wouldn't worry too much.

A few other observations:

Checksum values are not stable- small changes in the software can lead to totally different checksums. The fact that your checksum is radically different doesn't mean anything.

It would be exceedingly difficult for an attacker to display a fake checksum on your machine. They'd need to know what program you're using to calculate checksums, and they'd need to somehow install a malicious version of that program. If they're able to do that, then they've already got administrative access to your machine, making the purpose of further attacks a little unclear. In my mind it'd be more likely for them to hack into the software author's website and change the official checksum listed there.

Many sites use a download link that sends you to a random mirror as a simple way to provide load balancing for their mirrors. The fact that you've gotten three different checksums is not necessarily a red flag in my mind.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.