HN Reader

There's a sticked comment on the source thread: https://old.reddit.com/r/xubuntu/comments/1oa43gt/xubuntuorg...

the malware's main function seems to be to check the clipboard for crypto wallet addresses and then replace them with attacker addresses:

  Bitcoin (bc1): bc1qrzh7d0yy8c3arqxc23twkjujxxaxcm08uqh60v
  Litecoin (ltc1/L/M): LQ4B4aJqUH92BgtDseWxiCRn45Q8eHzTkH
  Ethereum (0x): 0x10A8B2e2790879FFCdE514DdE615b4732312252D
  Dogecoin (D): DQzrwvUJTXBxAbYiynzACLntrY4i9mMs7D
  Tron (T): TW93HYbyptRYsXj1rkHWyVUpps2anK12hg
  Ripple (r): r9vQFVwRxSkpFavwA9HefPFkWaWBQxy4pU
  Cardano (addr1): addr1q9atfml5cew4hx0z09xu7mj7fazv445z4xyr5gtqh6c9p4r6knhlf3jatwv7y72deah9un6yettg92vg8gskp04s2r2qren6tw

can't guarantee it doesn't do anything else.

I ran the checksum for the current ISO file of the full Xubuntu desktop version on the Xubuntu website, and the checksum appears to be valid.

https://mirror.us.leaseweb.net/ubuntu-cdimage/xubuntu/releas...

[user@host]$ ls

SHA256SUMS SHA256SUMS.gpg xubuntu-24.04.3-desktop-amd64.iso

[user@host]$ cat SHA256SUMS

b61e083d8a5ab003bad6ef7ea31ec21d7bfdf19b99d75987ab3fa3bbe85ec1bf *xubuntu-24.04.3-desktop-amd64.iso

[user@host]$ sha256sum xubuntu-24.04.3-desktop-amd64.iso

b61e083d8a5ab003bad6ef7ea31ec21d7bfdf19b99d75987ab3fa3bbe85ec1bf xubuntu-24.04.3-desktop-amd64.iso

[user@host]$ echo $?

0

What scared me in that thread was the mention of the fake lubuntu site that is still up since someone took over the old domain last year(?). I downloaded and installed lubuntu just some week ago. Luckily I am pretty sure I downloaded it from the real site. The fake one only has downloads up to 19.04 or something.

Have not installed Lubuntu in a few years, so never noticed any of the news of the domain change and take-over. Did not really find anything more about it when searching today?

oddly, the one "sus" thing flagged -- a " (C) 2026 " late in 2025 -- is consistent with practices of established book publishers.

I recall purchasing a textbook in September of year X and being surprised that it was "from the future" with a "Copyright X+1".

Somebody did sneak a wayland compositor for xfce???

:P

Let's not kid ourselves. A state level actor who is playing the long game can compromise any distro, package, etc. without us knowing about it.

fortunately, in this case, it seems like the malware may be moot if you use the iso to wipe your windows installation...

With these reports, I always wonder - do people really keep their software wallets on a machine they use every day? Personally I keep it on a laptop that is used just for that and it never occurred to me any other options is viable.

This should lead to better checksum verification mechanism, because if you compromise the site, you can put whatever compromised checksum as well. I think having a centralized checksum verification system for all major (or all) distributions would be a good start.

"Linux doesn't get viruses"

Since Xubuntu inception a decade ago, facts certainly have changed!

That is why I use Qubes OS [1] in order to have a certain peace of mind.

[1] https://www.qubes-os.org/

EDIT: further comment below:

On second thought, Qubes OS does not prevent such types of malicious downloads; it can also happen to Qubes images. Verify your downloads with checksums and cryptographic signatures [2].

[2] https://doc.qubes-os.org/en/latest/project-security/verifyin...