Attack Vectors
The Ubuntu installer brings (equally to pretty much all other Linux distributions) a set of OpenPGP keys trusted by the package manager.
Given you download/get hold of a tampered ISO image, different things might happen based on what was changed.
- If the OpenPGP keys have been changed, you might either not be able to install updates any more (if the original ones have been dropped), and/or software from actually untrusted sources is trusted (when keys are added).
- If apt's
sources.list
file was modified, one could also redirect to a location providing malicious updates (and signed with "trusted" keys, if these have been added, altough not Ubuntu's ones).
- An attacker could have changed pretty much everything, including the actual verification of OpenPGP signatures or include arbitrary malware and backdoors. If the checksums are different, you don't know anything any more about the ISO image, and you couldn't reasonably verify what's wrong (but against another, untampered image).
To be sure about receiving a valid ISO image actually issued by Canonical, check against the SHA256 checksums provided on the download page, and if you have a trust path to Canonical's signing key, also verify the OpenPGP signature of that file.
When ISO Image Checksums are Valid
If you make sure you have a trusted ISO image from the start, then everything's fine. If you're scared of man-in-the-middle-attacks while downloading from Canonical (like a three letter agency shipping a tampered file to you, and also modifying the checksum file), fetch the checksum file using different internet lines, to be very sure possibly even from public computers (they can't and/or wouldn't tamper it for everybody, as this likely would've been noticed by somebody).
SHA256 is believed to be secure, if the checksum is right, everything's fine and nobody can either hide updates nor send you any malicious ones, as the whole package management chain is secured. The only thing they could do is a kind of denial of service attack, but you would realize that (as an error message would be printed).