Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
-
@briankrebs WHO ORDERED THE LARGE DEEPDISH SANDBOX ANALYSIS??
https://app.any.run/tasks/90d1d270-a93f-498f-81d7-84d5e8f156bf
@jordinki @briankrebs Note: Free accounts automatically make your analysis public,
so never upload files containing personal data, passwords, or private company info.
#Privacy -
I love all the commentary about how I'm supposedly inventing things here. Supply chain hacks or just selling one's site/brand happens. If you don't like the results too bad. Check them yourself.
I have used Rufus many times in the past @briankrebs and never had an issue, but clearly if you are seeing these additional installs something has compromised it.
I usually grab the portable version and the last one I downloaded was 4.14 back in May, which worked as expected and still does.
So it would seem that 4.15 is not to be trusted. -
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs I've never liked the name of this program; it sounds like it refers to a specific country. Please use only Fedora Media Writer.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs When you say you "installed" rufus, did it prompt you for some kind of installation? Or did the startup match what was in the any.run analysis that was submitted? I ask because rufus doesn't really have an install, you just run it and go. Trying to forensically put this back together is going to require a bit more info if you can provide it. I don't suppose, since you are wiping that computer, that you saved anything at all from it?
-
I love all the commentary about how I'm supposedly inventing things here. Supply chain hacks or just selling one's site/brand happens. If you don't like the results too bad. Check them yourself.
I didn't realize how strong a community Rufus has. Please don't shoot the messenger.
-
@briankrebs When you say you "installed" rufus, did it prompt you for some kind of installation? Or did the startup match what was in the any.run analysis that was submitted? I ask because rufus doesn't really have an install, you just run it and go. Trying to forensically put this back together is going to require a bit more info if you can provide it. I don't suppose, since you are wiping that computer, that you saved anything at all from it?
@InvertedLina all nuked
-
I didn't realize how strong a community Rufus has. Please don't shoot the messenger.
@briankrebs you where right to report, fuck them haters.
-
I didn't realize how strong a community Rufus has. Please don't shoot the messenger.
@briankrebs Better to know then not to know…
-
@bms @briankrebs Correct, it can be run portable without installation with zero problems. There is no benefit to installing it beyond that it makes a convenient icon in the start menu for people who don't know how to do that themselves (though I suspect the Venn diagram of those who know how to use Rufus' USB creator and those who can't create a shortcut is... not very overlapping...)
I'm definitely getting vibes that the site has been taken over and the uploads modified.
Actually, to the OP, did you check versus the github's uploads to see if they also have the trojans? I saw someone mentioning the github, but I didn't see whether you tried it or not.
Though I still agree with those who say Ventoy is better these days. (Also Ventoy has other OS builds too.)
-
I didn't realize how strong a community Rufus has. Please don't shoot the messenger.
@briankrebs sounds like the five stages of grief
-
@InvertedLina all nuked
@briankrebs Thanks. I'm running Rufus 4.15.2396, pulled from Github via the link on the rufus dot ie page. Writing a Win11 x64 ISO out to USB in a VM. It failed the USB write, but my USB drive might also be flakey.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs haven't used rufus or cd installs in awhile so thanks for the warning!
-
I didn't realize how strong a community Rufus has. Please don't shoot the messenger.
it's the first thing Ubuntu tells you to do for those on windows. hope they fix it quick. read it was aided by a compromised .dll, of course. static compile should eliminate that.
-
Well if you check the process graph. there are registry modifying calls.. (i did not crosscheck the results, only seen from the provided link) which by itself would already be a bad sign. i still have the last version i used and there this is not the case. and also i don't allow outgoing connections by default, and would see them and there are none in the old version. so maybe something changed lately.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.
-
Well if you check the process graph. there are registry modifying calls.. (i did not crosscheck the results, only seen from the provided link) which by itself would already be a bad sign. i still have the last version i used and there this is not the case. and also i don't allow outgoing connections by default, and would see them and there are none in the old version. so maybe something changed lately.
@snornik @snep @jordinki @briankrebs the "standard" version stores its settings in the registry
-
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.
@briankrebs
I know you probably know, but for anyone else, I've always used Balena Etcher and never had issues. -
@bms @briankrebs Correct, it can be run portable without installation with zero problems. There is no benefit to installing it beyond that it makes a convenient icon in the start menu for people who don't know how to do that themselves (though I suspect the Venn diagram of those who know how to use Rufus' USB creator and those who can't create a shortcut is... not very overlapping...)
I'm definitely getting vibes that the site has been taken over and the uploads modified.
Actually, to the OP, did you check versus the github's uploads to see if they also have the trojans? I saw someone mentioning the github, but I didn't see whether you tried it or not.
Though I still agree with those who say Ventoy is better these days. (Also Ventoy has other OS builds too.)
@nazokiyoubinbou @bms @briankrebs to my knowledge it doesn't even offer an installer. the only difference between the "standard" and "portable" versions is that the executable checks if it has the letter "p" in the filename. if it does not, then it stores its settings in the registry and if it does, then it uses a file called rufus.ini in the directory it was started from.
-
@snornik @snep @jordinki @briankrebs the "standard" version stores its settings in the registry
@umby995 @snep @jordinki @briankrebs
yeah and it stores it in:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0DD0E83D-B8CC-4015-B164-66137069CC91}Machine\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
edit: i mean again i did not crosscheck but please (at least) read the report before stating something
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
Think I pulled down Rufus a couple of months back for a one off. Don't recall where I got it from, but didn't notice any untoward behavior, so possibly a more recent compromise?
