Can you create a fake (malicious) Ubuntu iso

Question

Recently I got into an exchange with someone on social media about the security of Linux versus OSX and Windows. I stated that it is possible (and probable) that someone could code a low level back door ( or whatever pesky malware they desire), and put it into the open source Linux code they downloaded, as well as add all of the proprietary software that Ubuntu has; compile it to an iso and label it as “UbuNtU”. This new iso would install an OS that would look and feel like the real ubuntu, however it would have a back door that nobody could see. This would require a faked checksum as well, but that is somewhat besides the point because it can be faked too. (also the user might be just given a usb from a trusted source with the fake iso). My question is straightforward, could somebody create a fake Ubuntu with a back door by compiling the open source software into an iso and labeling it as “UbUnTu”. I would also like to add that this can be done with OSX and Windows however it would be much more difficult due to that fact that neither of these are open source!

I strongly believe that open source software is more vulnerable to hackers point blank!

Answer 1

If an OS is open source or not is not the important factor if someone could build a malicious installer image.

Recent versions of Windows use a technique that bases on WIM images which can be generated from existing Windows installations just like a backup software creates an image. Therefore it is pretty easy to generate a malicious Windows image, just capture an existing Windows installation that has been prepared with malware.

The same is true for Linux based OS like Ubuntu.

Therefore no matter what OS you install it is important only to use installer respectively ISO images that are directly downloaded from a trusted source using a secure channel like HTTPS, usually directly from the manufacturer or alternatively if you can verify the authenticity e.g. using a GPG signature.

Answer 2

First of all:

This would require a faked checksum as well, but that is somewhat besides the point because it can be faked too.

What do you mean by faked? If the user checks the checksum against the one provided on the distribution's official page, the attempt is instantly foiled because the checksum will be different. There's no way around that (of course except for finding a hash collision but... good luck with that).

Moving on, as most answers already stated, the attack you describe is certainly very feasible and has been done! But it has been done regardless of whether the software is open-source or closed-source. I mean, if you believe otherwise, go ahead and download/install a Windows ISO from a site other than Microsoft's and see how safe you feel. Not to mention the countless examples of malware-infested pirated software which is proprietary.

In fact, I can make a pretty good counterpoint: open-source software is free so there's no need to pirate it or download it from shady sources. Meanwhile, proprietary software is often pirated meaning it has much higher potential to cause malware infections.

To summarise, it may be marginally easier to patch an Ubuntu ISO than a Windows ISO. But it'll be thousands of times easier to infect someone with the pirated Windows ISO than the Ubuntu one, because anyone can download Ubuntu for free so they have no reason to trust you.

Answer 3

I strongly believe that open source software is more vulnerable to hackers point blank!

Windows is a closed source software, yet there exists Windows XP Gold and Vision Ultimate which are unofficial ISOs of Windows that contain pre-installed software, tweaks, etc. So it's possible to make a fake ISO even if the software is not open source.

I can't add a link because it's piracy but these can be found easily on Internet.

Answer 4

I'd say this is mostly answered, but I'll also add that Ubuntu now supports SecureBoot as well. You wouldn't be able to modify certain parts of the kernel at minimum without the computer refusing to run it.

Of course, there's plenty that can still be done in userland, but there is some security in place.

I am unsure how the hypothetical ISO would end up on anyone's computer, though, since I imagine most people download it from the official sources.

Answer 5

As many others have already pointed out, your inclination to believe that open source software is more easily hacked/exploited is completely unwarranted. The point of this answer is just to share a personal story of mine that speaks to this, forcefully so, in my opinion:

Many many years ago (back when Windows NT was standard issue in enterprise deployments) i felt compelled to subvert a particular installation by modifying the console/desktop logon process so as to capture user's logon credentials. As you may imagine, i have no access to anything like Microsoft's source code, yet it took me less than an afternoon to find the relevant module (i still remember it was called WINGINA.DLL; no idea if it's still around in current versions, as i have long since let go of Windows completely), then to identify the very few functions that had to be modified, and to fit the required code (x86 assembly, obviously) into several nooks & crannies that these executables tend to have unoccuppied. It worked beautifully.

Now suppose i wanted to fix, for myself, one of the many flaws that Microsoft's products have (and i don't mean only security flaws). For the vast majority of cases, that would be very hard (next to impossible, really) without source code.

So the lack of an open source is a tremendous hindrance to amelliorating a product; not so much when it comes to covertly turning it into malware.

Answer 6

You are missing the point here. The main difficulty of this attack is not in making it possible to create a malicious ISO, it is in convincing a victim to use it.

That has been done over and over again to all kinds of software. Why do you think tech support scam by and large uses "we are Microsoft tech support" disguise? And how well do you suppose that works? (spoiler: very well)

"Click that link" "authenticate this action" are ultimately social engineering attacks, and the software used being open source is not really making it much easier to make it look convincing. As already stated in the answers, faking hash is quite a hard task but also too much effort given people very commonly wouldn't check it and a harder part would be to convince someone to download from your mirror and not some of the official ones. Chain of trust is a thing; it is not terribly hard to compromise locally but everything security-related is based upon it. Main protection mechanism in FOSS is basically that in order to cause significant damage, one would need to build up a lot of reputation first AND somehow fly under the radar of people reading the code.

The main reason many open source bits of software are potentially more vulnerable than their closed-source counterparts is just not enough scrutiny. Too much software, too many updates - it is feasible to sneak in some vulnerable code with malicious intent.

TL;DR: If you can convince people that you are a trusted source of software and they should run it, the rest is a piece of cake.

Answer 7

Sure, malicious code could be injected into packages in the ISO - the same way malicious code is often injected into Windows and MacOS media that people download from unofficial sources. There is no difference here between Ubuntu, Windows and MacOS.

ISO files are often mirrored so its likely that your ISO image is not downloading directly from the vendor's website. Thats why they will provide you with MD5/SHA/GnuPG checksums on the Ubuntu/MS/Apple website. You use the checksum to validate that the ISO image you downloaded is the ISO the vendor made. This effectively means you have an authoritative method to validate your ISO.

Checksums are usually provided by all before mentioned vendors on downloads.

Your belief that open-source is more vulnerable to hackers is both true and false... but mostly false. You think "i can see your code, so I can hack you" - which is completely wrong. Peer reviewed code is significantly more secure.

The fundamental things that secure you on the internet (VPN, SSL/TLS, etc) is predominantly based on open-source. (Else it would be based on trusting a company that's unwilling to show you whats behind the curtain).

Your argument is like saying a car with 6 wheels will always go faster than a 4 wheel car. If your basing this observation on traction alone - then its possibly correct, but there are significantly more variables involved in a car that determines its top speed.

I recommend you read "The Cathedral and the Bazaar" - which compares the mindset of open and closed source. Its a few years old, but should give you some insight.