How to Detect a Compromised Linux Mint 17.3 ISO and Secure Your System

Issue Overview

Linux Mint reported that attackers compromised the download links for the Linux Mint 17.3 Cinnamon ISO. The malicious ISO files were hosted on the IP address 5.104.175.212 and contain a back‑door that contacts the domain absentvodka.com. Only users who downloaded the ISO on or after 20 February 2016 are potentially affected.

Compromised ISO Details

The affected images are the Cinnamon edition of Linux Mint 17.3. Other editions (e.g., MATE, Xfce) were not altered.

Verification Steps

To ensure the integrity of a downloaded ISO, compute its MD5 hash and compare it with the official values:

6e7f7e03500747c6c3bfece2c9c8394f linuxmint-17.3-cinnamon-32bit.iso e71a2aad8b58605e906dbea444dc4983 linuxmint-17.3-cinnamon-64bit.iso 30fef1aa1134c5f3778c77c4417f7238 linuxmint-17.3-cinnamon-nocodecs-32bit.iso 3406350a87c201cdca0927b1bc7c2ccd linuxmint-17.3-cinnamon-nocodecs-64bit.iso df38af96e99726bb0a1ef3e5cd47563d linuxmint-17.3-cinnamon-oem-64bit.iso

Run the following command and compare the output: md5sum /path/to/yourfile.iso If the computed hash differs from the values above, the ISO has been altered.

In addition to the MD5 check, verify the ISO’s GPG signature to confirm authenticity:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 3EE67F3D0C8C6B0F
 gpg --verify linuxmint-17.3-cinnamon-64bit.iso.asc linuxmint-17.3-cinnamon-64bit.iso

A valid signature indicates the file was signed by the official Linux Mint maintainers.

Detection in Live Session

If you have already burned the ISO to a DVD or USB and booted a live session, check for the presence of the file /var/lib/man.cy. Its existence is an indicator that the ISO is compromised.

Remediation

Disconnect the affected system from any network.

Back up personal data to an external medium.

Change passwords for any accounts that may have been exposed.

Re‑format the installation media and reinstall Linux Mint using a verified ISO.

Note that the official package repositories were not compromised, but it is still advisable to verify package signatures after reinstalling.