Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs@infosec.exchange
any more, if I have the choice of loading stuff to a VM or directly to my laptop's real OS, I choose the former.
Sorta like when I need to run AI agents, I do it inside containers ...inside VMs. -
@briankrebs Ventoy is the new Rufus BTW.
@dey @briankrebs I must STRONGLY second this. Ventoy does everything that could do far far better.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs This is absolutely insane. I've been using Rufus for years and years back when I was on Windows. Certainly it never used to have trojans. So I guess this means their site must have been taken over by someone hostile or something probably?
-
@briankrebs While the analysis marks as malicious, I couldn't get anything to pop. There is a caveat that it might only trigger if theres a removable drive inserted. Further, I did notice that the Google search result took me to the spanish version right away. Running updates catches an update for secure boot (believe microsoft posted a newer one for UEFI certs and so on) but the english version randomly complains about file header lengths not matching or something.
Something fishy about this, kinda smells like the notepad++ debacle but who knows without more defacto evidence.
SHA Dumpz
/es/ files:
rufus-4.15.exe - 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106
rufus-4.15p.exe - 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106
rufus-4.15_x86.exe - 20e1345715aff4aebf016839f721390882201a2b5d00655424c4ca38cb919576
/en/:
rufus-4.15.exe - 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106rufus-4.15_arm64.exe - 98304:2j+pov9zclawddtljxynwkqya0sgygvzz93jrozodglintci09jnrvgnisaapitw:kmqv
rufus-4.15p.exe - 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106
@jordinki @briankrebs requiring a removable drive would be a hilariously perfect anti-sandbox method for this.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs@infosec.exchange That site might have been taken over or something. Rufus was a "download and run" program that doesn't require installation. -
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs huh, that's a shame. My normal workflow is that it might ask for a dd download but not much else. The secure boot is usually because of the need to allow third party certificates in the bios settings.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs ventoy is better. Boot the iso you want from a menu.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs Yeah wait, forget what I wrote in this post before. Realtime protection being disabled seems to be standard behaviour at least for for the W10 version of Windows Sandbox? There's just no AV providers installed...
Somehow never noticed when using that thing before
️
Sorry for the noise. -
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs it's always nice to have measurements of that sort of thing to point people at. thanks.
-
@briankrebs Yeah wait, forget what I wrote in this post before. Realtime protection being disabled seems to be standard behaviour at least for for the W10 version of Windows Sandbox? There's just no AV providers installed...
Somehow never noticed when using that thing before️
Sorry for the noise.@galaxis yes if you trust WindowsDefender to defend you against this attack you will be sorely mistaken. It successfully detects all the malware installed, but it acts weird and sends notifications about malware detections even though its own interface says a scan is clean.
-
A kind reader submitted the Rufus installer to any.run, a sandbox which walks through the installation of software to find malware that gets installed only *AFTER* the executable is clicked. You can see exactly all of the post-install prompts to download additional software that I also saw.
-
@demon6 wait, what? how is this related? I'm sincerely asking because IDK.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs I tried Rufus but computer said no and I am glad
-
@demon6 wait, what? how is this related? I'm sincerely asking because IDK.
@briankrebs Rufus can insert the updated uefi certs into windows ISO’s. It’s possible that those certs could be compromised, but that’s the additional downloads you’re seeing from what I saw in the video from @jordinki
-
@jordinki @briankrebs requiring a removable drive would be a hilariously perfect anti-sandbox method for this.
@briankrebs @jordinki @darfplatypus it'd be annoying to fully fake too because sandboxes tend to be kind of painful to add these things to yourself
-
@briankrebs So I hate to be snarky, but "dd" has been there all along people. Having to install an entire 3rd party application, for something that the OS should have stable, reliable methods for, to format a storage device and transfer a standard filesystem image to it, is intolerable. But it's Windows...depends on curl to download its own updates...
@jab01701mid @briankrebs ironically the official windows installer builder does support writing to USB directly but it doesn't have the customisation that Rufus offers for slipstreaming and deshittifying. But for other non-Windows ISOs? Yeah.
Though it should be noted that for awhile now a lot of images are designed such that if you mount them and copy their contents to the USB partition bare it'll work just fine and this can be done from stock Windows
-
@jab01701mid @briankrebs ironically the official windows installer builder does support writing to USB directly but it doesn't have the customisation that Rufus offers for slipstreaming and deshittifying. But for other non-Windows ISOs? Yeah.
Though it should be noted that for awhile now a lot of images are designed such that if you mount them and copy their contents to the USB partition bare it'll work just fine and this can be done from stock Windows
@Lunaphied Okay. But how?
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs@infosec.exchange the new DiskDestroyer...
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
Look, compromises happen to everyone. I have received a ton of private messages asking if I'm okay. But the reality is that I stopped using Windoze a long time ago and this was a kind of one-off thing where I was trying to re-image an old system anyway (away from Windoze).
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs I wonder if @torproject should know because Rufus is recommended to those who wish to install Tails from Windows:
