Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
-
I didn't realize how strong a community Rufus has. Please don't shoot the messenger.
@briankrebs sounds like the five stages of grief
-
@InvertedLina all nuked
@briankrebs Thanks. I'm running Rufus 4.15.2396, pulled from Github via the link on the rufus dot ie page. Writing a Win11 x64 ISO out to USB in a VM. It failed the USB write, but my USB drive might also be flakey.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs haven't used rufus or cd installs in awhile so thanks for the warning!
-
I didn't realize how strong a community Rufus has. Please don't shoot the messenger.
it's the first thing Ubuntu tells you to do for those on windows. hope they fix it quick. read it was aided by a compromised .dll, of course. static compile should eliminate that.
-
Well if you check the process graph. there are registry modifying calls.. (i did not crosscheck the results, only seen from the provided link) which by itself would already be a bad sign. i still have the last version i used and there this is not the case. and also i don't allow outgoing connections by default, and would see them and there are none in the old version. so maybe something changed lately.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.
-
Well if you check the process graph. there are registry modifying calls.. (i did not crosscheck the results, only seen from the provided link) which by itself would already be a bad sign. i still have the last version i used and there this is not the case. and also i don't allow outgoing connections by default, and would see them and there are none in the old version. so maybe something changed lately.
@snornik @snep @jordinki @briankrebs the "standard" version stores its settings in the registry
-
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.
@briankrebs
I know you probably know, but for anyone else, I've always used Balena Etcher and never had issues. -
@bms @briankrebs Correct, it can be run portable without installation with zero problems. There is no benefit to installing it beyond that it makes a convenient icon in the start menu for people who don't know how to do that themselves (though I suspect the Venn diagram of those who know how to use Rufus' USB creator and those who can't create a shortcut is... not very overlapping...)
I'm definitely getting vibes that the site has been taken over and the uploads modified.
Actually, to the OP, did you check versus the github's uploads to see if they also have the trojans? I saw someone mentioning the github, but I didn't see whether you tried it or not.
Though I still agree with those who say Ventoy is better these days. (Also Ventoy has other OS builds too.)
@nazokiyoubinbou @bms @briankrebs to my knowledge it doesn't even offer an installer. the only difference between the "standard" and "portable" versions is that the executable checks if it has the letter "p" in the filename. if it does not, then it stores its settings in the registry and if it does, then it uses a file called rufus.ini in the directory it was started from.
-
@snornik @snep @jordinki @briankrebs the "standard" version stores its settings in the registry
@umby995 @snep @jordinki @briankrebs
yeah and it stores it in:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0DD0E83D-B8CC-4015-B164-66137069CC91}Machine\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
edit: i mean again i did not crosscheck but please (at least) read the report before stating something
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
Think I pulled down Rufus a couple of months back for a one off. Don't recall where I got it from, but didn't notice any untoward behavior, so possibly a more recent compromise?
-
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.
@briankrebs
Surely, the conspiracy isn't that deep.
-
@jordinki thank god! the Internet gods DO exist!
@briankrebs @jordinki it's Gods all the way down.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs I think the message here is that Windows is bad, and Rufus is bad.
Just use GNU+Linux with the dd command guys. Lol
-
Its very likely that Secure Boot is kicking in. A Windows .iso written to a USB stick will pass, as will Debian, Ubuntu and a few other Linux distros. VMware ESXi and Proxmox will also pass.
At the boot stage, that is not a Windows PC - its just a PC!
To be honest if you are not sure exactly what is what, then Secure Boot is a good thing.
@gerdesj @briankrebs lol mansplaining secure boot to brian krebs HAHAHAHA
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
Well crap
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
There's a good reason why I go with Ventoy nowadays. Besides of the "just drop the ISO and the USB will multiboot it" convenience -
@ajn142 @sindarina yes. I'm guessing supply chain hack. i have no data to support that, though.
@briankrebs @ajn142 @sindarina
I downloaded Rufus about a week and a half ago and I didn't notice anything suspicious, but do you know how I would check to see if I was compromised?
Thanks
-
@briankrebs @ajn142 @sindarina
I downloaded Rufus about a week and a half ago and I didn't notice anything suspicious, but do you know how I would check to see if I was compromised?
Thanks
@kiwiapple87 @ajn142 @sindarina You would likely notice on a recent model Windows PC b/c Windows Defender would go apeshit after you click yes to their prompt for installing more software.
-
@umby995 @snep @jordinki @briankrebs
yeah and it stores it in:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0DD0E83D-B8CC-4015-B164-66137069CC91}Machine\Software\Policies\Microsoft\Windows Defender\Real-Time Protectionedit: i mean again i did not crosscheck but please (at least) read the report before stating something
@snornik @snep @jordinki @briankrebs yeah that's my bad. i am confused because the text report from anyrun doesn't show any registry activity at all, but the more info section for the process in the full report does show 1347 registry events, which definitely seems suspicious.
