Imagine user downloads and burns installation USB stick on their compromised Linux system. Are there any known malware that is capable of spreading via Linux distributions installation media so that after reinstallation system is still compromised through installation media? Or it is hard to automate and rather subject of targeted attack?
This question, like many others, falls under the category "yes, it is possible, but not widely seen in practice".
Is there known malware that spreads via Linux distribution installation media?
I didn't find anything exactly like this after performing a quick Google search. So it seems like not much is out there.
Or it is hard to automate and rather subject of targeted attack?
Not really. I have some scripts lying around that make changes to the distribution's installer image, given an ISO file. Once you know how to correctly unpack and pack different installers from their ISOs, it's not too hard to automate whatever changes you want to make. It also wouldn't be too hard to periodically scan for ISO files and infect them when found.
I am not aware of anything that would compromise a installation media while the user is writing it. It's possible to do something like that, but it would be a very focused attack.
An attacker would need to know the installation file and the burning software. There are a lot of ways to create a installation USB media (
unetbootin, USB Image Writer, for example), so the attacker would need to monitor all of them, intercept the read or write, and compromise the request.
Possible, but it's easier to change the DNS and direct the user to a rogue download site.