Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
looks disputed as a windows defender false positive.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs huh, that is the traditional official domain for it, isn't it?
-
@sindarina @briankrebs did you notice that the GitHub repo links to rufus.ie?
@ajn142 @briankrebs Yeah, it is the official website? Or used to be, at least?
-
However, in my defense Google's default search results list rufus[.]ie as the authoritative site
@briankrebs the link the to official site from the GitHub page also links to Rufus.ie so something ain’t right
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs So I hate to be snarky, but "dd" has been there all along people. Having to install an entire 3rd party application, for something that the OS should have stable, reliable methods for, to format a storage device and transfer a standard filesystem image to it, is intolerable. But it's Windows...depends on curl to download its own updates...
-
@briankrebs So I hate to be snarky, but "dd" has been there all along people. Having to install an entire 3rd party application, for something that the OS should have stable, reliable methods for, to format a storage device and transfer a standard filesystem image to it, is intolerable. But it's Windows...depends on curl to download its own updates...
@jab01701mid You're absolutely right. It's like the flashlight app. Duh. Should be included so people don't search for it and install malware.
-
@briankrebs the link the to official site from the GitHub page also links to Rufus.ie so something ain’t right
@cienmilojos @briankrebs The download links on the site also link back to GitHub. Wikipedia shows it as the official site too.
-
@ajn142 @briankrebs Yeah, it is the official website? Or used to be, at least?
@sindarina @briankrebs somebody with a malware lab should try pulling both the rufus.ie and GitHub versions and see if the hashes match, since .ie doesn't provide hashes.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs I wonder if they have updated PHP…
-
@sindarina @briankrebs somebody with a malware lab should try pulling both the rufus.ie and GitHub versions and see if the hashes match, since .ie doesn't provide hashes.
@sindarina @briankrebs next question would be what components it downloads, and did one of them get poisoned in a supply chain attack.
-
@sindarina @briankrebs somebody with a malware lab should try pulling both the rufus.ie and GitHub versions and see if the hashes match, since .ie doesn't provide hashes.
@ajn142 @briankrebs The .ie links straight to the GitHub download, though. And as far as I can tell the checksum matches.
-
@sindarina @briankrebs next question would be what components it downloads, and did one of them get poisoned in a supply chain attack.
@ajn142 @briankrebs Also, if the portable version, which shouldn’t download anything at all, does the same thing.
-
@ajn142 @briankrebs The .ie links straight to the GitHub download, though. And as far as I can tell the checksum matches.
@sindarina @briankrebs
cool, I'm WFPhone so I couldn't tell. -
No clue whether the resulting ISO is also malicious, but tried running it just for giggles on a spare Windows PC from bootup and the machine's bios said nope, wouldn't allow b/c security policy. Not sure if it's related but I've never seen that message before trying to boot up from a USB.
@briankrebs Please consider sharing samples / IoCs, for instance blogging about it, or scanning the file & URL through virustotal
-
@sindarina @briankrebs
cool, I'm WFPhone so I couldn't tell.@sindarina @briankrebs if that's the case though, the GitHub artifacts have a verifiable availability date, so i'd bet it was one of the components pulled during installation.
-
@sindarina @briankrebs if that's the case though, the GitHub artifacts have a verifiable availability date, so i'd bet it was one of the components pulled during installation.
@ajn142 @sindarina yes. I'm guessing supply chain hack. i have no data to support that, though.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs Do you happen to have the hash of the file you received? I just pulled https://github.com/pbatard/rufus/releases/download/v4.15/rufus-4.15.exe (which is also the link that is on rufus.ie) and it gave me 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106 rufus-4.15.exe which is clean according to virustotal.
-
@briankrebs Do you happen to have the hash of the file you received? I just pulled https://github.com/pbatard/rufus/releases/download/v4.15/rufus-4.15.exe (which is also the link that is on rufus.ie) and it gave me 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106 rufus-4.15.exe which is clean according to virustotal.
@cubeos As I mentioned, the installer put up several prompts to install other components, so those probably wouldn't come up on a scan of the installer itself.
-
@sindarina @briankrebs
cool, I'm WFPhone so I couldn't tell.@ajn142 @briankrebs Also, the .ie points to GitHub, and is hosted by GHP.
https://github.com/pbatard/rufus-web
Very strange.
-
@ajn142 @sindarina yes. I'm guessing supply chain hack. i have no data to support that, though.
@briankrebs @sindarina yeah, I don't have any disposable boxes right now, so I can't gamble on it.
