Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
-
@briankrebs The official one downloaded via https://github.com/pbatard/rufus or https://rufus.ie? 🤨
@sindarina @briankrebs did you notice that the GitHub repo links to rufus.ie?
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs
What chance do I have, if you get hit? -
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs woopsiedoodle
-
@briankrebs I bookmarked it a while back because the search results were always such a crapshoot
@briankrebs ‘rufus.ie’ IS the official website, by the way, linked from the GitHub and such. Did that get compromised?
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
looks disputed as a windows defender false positive.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs huh, that is the traditional official domain for it, isn't it?
-
@sindarina @briankrebs did you notice that the GitHub repo links to rufus.ie?
@ajn142 @briankrebs Yeah, it is the official website? Or used to be, at least?
-
However, in my defense Google's default search results list rufus[.]ie as the authoritative site
@briankrebs the link the to official site from the GitHub page also links to Rufus.ie so something ain’t right
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs So I hate to be snarky, but "dd" has been there all along people. Having to install an entire 3rd party application, for something that the OS should have stable, reliable methods for, to format a storage device and transfer a standard filesystem image to it, is intolerable. But it's Windows...depends on curl to download its own updates...
-
@briankrebs So I hate to be snarky, but "dd" has been there all along people. Having to install an entire 3rd party application, for something that the OS should have stable, reliable methods for, to format a storage device and transfer a standard filesystem image to it, is intolerable. But it's Windows...depends on curl to download its own updates...
@jab01701mid You're absolutely right. It's like the flashlight app. Duh. Should be included so people don't search for it and install malware.
-
@briankrebs the link the to official site from the GitHub page also links to Rufus.ie so something ain’t right
@cienmilojos @briankrebs The download links on the site also link back to GitHub. Wikipedia shows it as the official site too.
-
@ajn142 @briankrebs Yeah, it is the official website? Or used to be, at least?
@sindarina @briankrebs somebody with a malware lab should try pulling both the rufus.ie and GitHub versions and see if the hashes match, since .ie doesn't provide hashes.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs I wonder if they have updated PHP…
-
@sindarina @briankrebs somebody with a malware lab should try pulling both the rufus.ie and GitHub versions and see if the hashes match, since .ie doesn't provide hashes.
@sindarina @briankrebs next question would be what components it downloads, and did one of them get poisoned in a supply chain attack.
-
@sindarina @briankrebs somebody with a malware lab should try pulling both the rufus.ie and GitHub versions and see if the hashes match, since .ie doesn't provide hashes.
@ajn142 @briankrebs The .ie links straight to the GitHub download, though. And as far as I can tell the checksum matches.
-
@sindarina @briankrebs next question would be what components it downloads, and did one of them get poisoned in a supply chain attack.
@ajn142 @briankrebs Also, if the portable version, which shouldn’t download anything at all, does the same thing.
-
@ajn142 @briankrebs The .ie links straight to the GitHub download, though. And as far as I can tell the checksum matches.
@sindarina @briankrebs
cool, I'm WFPhone so I couldn't tell. -
No clue whether the resulting ISO is also malicious, but tried running it just for giggles on a spare Windows PC from bootup and the machine's bios said nope, wouldn't allow b/c security policy. Not sure if it's related but I've never seen that message before trying to boot up from a USB.
@briankrebs Please consider sharing samples / IoCs, for instance blogging about it, or scanning the file & URL through virustotal
-
@sindarina @briankrebs
cool, I'm WFPhone so I couldn't tell.@sindarina @briankrebs if that's the case though, the GitHub artifacts have a verifiable availability date, so i'd bet it was one of the components pulled during installation.
-
@sindarina @briankrebs if that's the case though, the GitHub artifacts have a verifiable availability date, so i'd bet it was one of the components pulled during installation.
@ajn142 @sindarina yes. I'm guessing supply chain hack. i have no data to support that, though.
