How can I make sure in the terminal that my Ubuntu updates are from the real source?
I am asking because I know that one download was fake. It was rkhunter. The update was malware. Done from Bangkok. I think it was DNS hijacking.
Asked
Active
Viewed 36 times
0
-
3System updates are signed. Infection during update could thus only be done if you trust an key which was compromised or added some untrusted source for updates or if you deliberately ignored warnings. DNS hijacking or similar will not be able to work around signatures. Given that you don't provide any actual evidence that the infection went this way and about the source of the malicious update I for now doubt that the infection came through a normal system update. And your idea that it was DNS hijacking seems to come out of the blue too, i.e. there is no kind of explanation why you think so. – Steffen Ullrich Mar 09 '20 at 07:20
-
@Stefen Ullrich Thank you! Maybe it was DNS hijacking because I try to do the same update two days after from another country (Malaysia). I got a different download: different size, different name. I then went back home trying the same download. It gave me an older version of rkhunter, the same as before, and it put a rootkit on my computer. I have evidence for: Ebury. My teacher said it was probably DNS hijacking, but I am not 100% sure. – Napasakorn Sriwonkeed Mar 13 '20 at 02:55