Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.

[stephenboylett@techhub.social]

@briankrebs I think I got the original Chris Wu version that has been deleted, but this looks to be an updated fork of that.

https://github.com/TheDotSource/New-ISOFile

[tehstu@hachyderm.io]

@jordinki @briankrebs they're pretty up front about Rufus fetching those files from the Microsoft Github. We're saying they're malware?

https://github.com/pbatard/rufus/issues/3039

(there's a GH issue because Microsoft moved them, causing 404 in the downloads. I assume they reverted the change because there was no new Rufus build)

[aphantastic@social.vivaldi.net]

@briankrebs

I've never been able to get Rufus to work. Instead, I've been an avid user of Universal USB Installer for decades: https://en.wikipedia.org/wiki/Universal_USB_Installer

For years now it has Ventoy, so it's even better than it was originally.

[fritzadalis@infosec.exchange]

@briankrebs
I didn't run it, but I downloaded the x64 installer and portable from rufus.ie and it's signed and the sha256 matches the download page. It looks like the 'extras' download checks a hardcoded checksum database too. Do you still have the version you downloaded? Maybe check the sha256, or if you're tired of it consider sending to steveshockley.99 on signal.

[novafunc@social.tchncs.de]

@dey @briankrebs Some distros recommend not using Ventoy because it does non-standard things and requires some hacks to work the way it does. Sometimes it breaks expectations and causes issues.

[mcourcel@allovertheplace.ca]

@briankrebs Weird. I just downloaded the latest portable yesterday and it was fine.

[tycoontom@infosec.exchange]

@jordinki @briankrebs Note: Free accounts automatically make your analysis public, so never upload files containing personal data, passwords, or private company info. #Privacy

[l2actual@infosec.exchange]

I have used Rufus many times in the past @briankrebs and never had an issue, but clearly if you are seeing these additional installs something has compromised it.
I usually grab the portable version and the last one I downloaded was 4.14 back in May, which worked as expected and still does.
So it would seem that 4.15 is not to be trusted.

[johnny_johnson@mastodon.social]

@briankrebs I've never liked the name of this program; it sounds like it refers to a specific country. Please use only Fedora Media Writer.

[invertedlina@infosec.exchange]

@briankrebs When you say you "installed" rufus, did it prompt you for some kind of installation? Or did the startup match what was in the any.run analysis that was submitted? I ask because rufus doesn't really have an install, you just run it and go. Trying to forensically put this back together is going to require a bit more info if you can provide it. I don't suppose, since you are wiping that computer, that you saved anything at all from it?

[briankrebs@infosec.exchange]

I didn't realize how strong a community Rufus has. Please don't shoot the messenger.

[briankrebs@infosec.exchange]

@InvertedLina all nuked

[cienmilojos@infosec.exchange]

@briankrebs you where right to report, fuck them haters.

[nemo@mas.to]

@briankrebs Better to know then not to know…

[nazokiyoubinbou@urusai.social]

@bms @briankrebs Correct, it can be run portable without installation with zero problems. There is no benefit to installing it beyond that it makes a convenient icon in the start menu for people who don't know how to do that themselves (though I suspect the Venn diagram of those who know how to use Rufus' USB creator and those who can't create a shortcut is... not very overlapping...)

I'm definitely getting vibes that the site has been taken over and the uploads modified.

Actually, to the OP, did you check versus the github's uploads to see if they also have the trojans? I saw someone mentioning the github, but I didn't see whether you tried it or not.

Though I still agree with those who say Ventoy is better these days. (Also Ventoy has other OS builds too.)

[rpmik@avgeek.social]

@briankrebs sounds like the five stages of grief

[invertedlina@infosec.exchange]

@briankrebs Thanks. I'm running Rufus 4.15.2396, pulled from Github via the link on the rufus dot ie page. Writing a Win11 x64 ISO out to USB in a VM. It failed the USB write, but my USB drive might also be flakey.

[janggolan@mastodon.social]

@briankrebs haven't used rufus or cd installs in awhile so thanks for the warning!

[m3t00@app.wafrn.net]

@briankrebs@infosec.exchange

it's the first thing Ubuntu tells you to do for those on windows. hope they fix it quick. read it was aided by a compromised .dll, of course. static compile should eliminate that.

[snornik@techhub.social]

@snep @jordinki @briankrebs

Well if you check the process graph. there are registry modifying calls.. (i did not crosscheck the results, only seen from the provided link) which by itself would already be a bad sign. i still have the last version i used and there this is not the case. and also i don't allow outgoing connections by default, and would see them and there are none in the old version. so maybe something changed lately.