Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.

[snornik@techhub.social]

@RedOct @briankrebs lol etcher... well yes you could use a electron app and waste ram and resources or just dd it (even in wingw), if the iso is properly created

[bot4sale@fairdinkum.one]

@briankrebs Plot twist: Windoze IS the virus!

[vnangia@mastodon.social]

@briankrebs New Alanis lyrics just dropped.

[briankrebs@infosec.exchange]

@umby995 @snornik @snep @jordinki lol you said 1,347 registry events. queue the famous laughing Spanard

[swade2569@masto.swader.social]

@InvertedLina @briankrebs

Had to chime in since I used Rufus just last night myself. I did download the 4.15.2396 version from the rufus.ie site. I launched it once to build my bootable usb and closed it, but used the wrong image. I launched it a second time and didn't have anything odd happen. It is signed by Akeo Consulting with a signing time of 30 JUN 2026. I kept the file in case someone wants some details from it.

[snornik@techhub.social]

@briankrebs while i get that point.... without linux alot are not used to console/tui tools and need a gui. i dont think its funny cause as a nerd your probably overwrite the whole windows partition anyway, pretty soon. as a newcomer you want to try out linux on a 2nd device and then this is not as funny anymore.

[briankrebs@infosec.exchange]

@snornik 100 percent agree. I'm still fuming that we're at Windos 11 hundred and there is no obvious way to write an ISO to an external image. I credit that to Microsoft understanding this capability is a strong existential threat.

[snornik@techhub.social]

@briankrebs YES! Sadly true!

[glitterbean@wehavecookies.social]

@briankrebs dude you're still on that? lolz

[stevenally@mastodon.social]

@snornik @RedOct @briankrebs Ok. If not etcher, what?

[snornik@techhub.social]

@stevenally @RedOct @briankrebs

dd (easy if you already have a linux), if not, wsl or mingw

params are: if=inputPath of=outputPath status=progress (the last only needed if you want to see how long its gonna take)

"if" is the path to the iso
and "of" should be the device path not the partition mount point
and unmount all partitions before

Edit:
but yeah as a newcomer to linux just use etcher, just for the first time, if your stuck on win probably easier than learning the difference between mount point and device paths.
one time does not make a big difference that's more of a pro tip i guess. if you need to write more than one iso to a drive, or do it often.

[briankrebs@infosec.exchange]

I've been made aware of a post from someone representing Rufus who says I'm very confused about this post. I've reported that Windows Defender went bananas after I installed Rufus on a Windows 11 device. It immediately popped up warnings about hacktools and trojans being installed while it was installing. I wish I had a record of it but I nuked everything after the alerts.

https://github.com/pbatard/rufus/issues/3064

[xabean@infosec.exchange]

@briankrebs There are some rather ... possessive communities around USB boot image builders, I forget if it was rufus or ventoy or what, but long story short: if you badmouth the product, the sealions. Dear god, the sealions.

[wdormann@infosec.exchange]

@xabean @briankrebs
I remember reporting a vulnerability to the Rufus developer, and he was quite rude and condescending in response.

[paul_ipv6@infosec.exchange]

@briankrebs

windoze malware: "quick. we gotta infect this machine while we have the chance. once it's running linux, we're out of another home..."

[rossmadness@infosec.exchange]

@briankrebs @vx_underground Possible goop sighting?

[dalias@hachyderm.io]

@aetios @briankrebs @jab01701mid Why would they be unbootable?

[j@social.ekis.me]

@briankrebs Rufus doesn't have an installer though. That's the thing. One simply doesn't install Rufus.

[rx13@infosec.exchange]

@briankrebs
I think it's worth noting, a long history of actors buying ad-space at the top of search engines.

The url in the ad appears legitimate (it's visually the legitimate URL), but when clicked goes to a different url. I'm not positive that's the case here, but it's been done 100s of times for 100s of other tools (AI tool installers, chrome installs, etc), and there is zero visual indication it's an ad directing to the wrong domain.

Thanks to LLMs, the landing pages have also gotten much better at copying the real pages too.

Making it more difficult, is that ads don't always present themselves, so seeing it a 2nd time may take 100s of visits

Or maybe it really was a compromised rufus domain

[chessert@mastodon.online]

@briankrebs

Ha ha ha hah: you’re still using Windows. 🤪🤭

I recommend you self boost this one a bunch! LOL!