Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
-
@briankrebs the link the to official site from the GitHub page also links to Rufus.ie so something ain’t right
@cienmilojos @briankrebs The download links on the site also link back to GitHub. Wikipedia shows it as the official site too.
-
@ajn142 @briankrebs Yeah, it is the official website? Or used to be, at least?
@sindarina @briankrebs somebody with a malware lab should try pulling both the rufus.ie and GitHub versions and see if the hashes match, since .ie doesn't provide hashes.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs I wonder if they have updated PHP…
-
@sindarina @briankrebs somebody with a malware lab should try pulling both the rufus.ie and GitHub versions and see if the hashes match, since .ie doesn't provide hashes.
@sindarina @briankrebs next question would be what components it downloads, and did one of them get poisoned in a supply chain attack.
-
@sindarina @briankrebs somebody with a malware lab should try pulling both the rufus.ie and GitHub versions and see if the hashes match, since .ie doesn't provide hashes.
@ajn142 @briankrebs The .ie links straight to the GitHub download, though. And as far as I can tell the checksum matches.
-
@sindarina @briankrebs next question would be what components it downloads, and did one of them get poisoned in a supply chain attack.
@ajn142 @briankrebs Also, if the portable version, which shouldn’t download anything at all, does the same thing.
-
@ajn142 @briankrebs The .ie links straight to the GitHub download, though. And as far as I can tell the checksum matches.
@sindarina @briankrebs
cool, I'm WFPhone so I couldn't tell. -
No clue whether the resulting ISO is also malicious, but tried running it just for giggles on a spare Windows PC from bootup and the machine's bios said nope, wouldn't allow b/c security policy. Not sure if it's related but I've never seen that message before trying to boot up from a USB.
@briankrebs Please consider sharing samples / IoCs, for instance blogging about it, or scanning the file & URL through virustotal
-
@sindarina @briankrebs
cool, I'm WFPhone so I couldn't tell.@sindarina @briankrebs if that's the case though, the GitHub artifacts have a verifiable availability date, so i'd bet it was one of the components pulled during installation.
-
@sindarina @briankrebs if that's the case though, the GitHub artifacts have a verifiable availability date, so i'd bet it was one of the components pulled during installation.
@ajn142 @sindarina yes. I'm guessing supply chain hack. i have no data to support that, though.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs Do you happen to have the hash of the file you received? I just pulled https://github.com/pbatard/rufus/releases/download/v4.15/rufus-4.15.exe (which is also the link that is on rufus.ie) and it gave me 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106 rufus-4.15.exe which is clean according to virustotal.
-
@briankrebs Do you happen to have the hash of the file you received? I just pulled https://github.com/pbatard/rufus/releases/download/v4.15/rufus-4.15.exe (which is also the link that is on rufus.ie) and it gave me 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106 rufus-4.15.exe which is clean according to virustotal.
@cubeos As I mentioned, the installer put up several prompts to install other components, so those probably wouldn't come up on a scan of the installer itself.
-
@sindarina @briankrebs
cool, I'm WFPhone so I couldn't tell.@ajn142 @briankrebs Also, the .ie points to GitHub, and is hosted by GHP.
https://github.com/pbatard/rufus-web
Very strange.
-
@ajn142 @sindarina yes. I'm guessing supply chain hack. i have no data to support that, though.
@briankrebs @sindarina yeah, I don't have any disposable boxes right now, so I can't gamble on it.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs Has your CoPilot gone rogue?
-
@briankrebs Has your CoPilot gone rogue?
@ModernMaslow I don't use AI. At least on purpose.
-
@ModernMaslow I don't use AI. At least on purpose.
@briankrebs Somehow I don't think the Tech Bros will consult you first.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
I just downloaded it last week (from rufus[.]ie) to a Linux machine to run with Wine and had no issues with ClamAV or the Linux machine.
-
@cubeos As I mentioned, the installer put up several prompts to install other components, so those probably wouldn't come up on a scan of the installer itself.
@briankrebs I'm just surprised that the behavior analysis of VT didn't catch these either. https://www.virustotal.com/gui/file/84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106/behavior says it's been reanalyzed 2h ago.
-
@briankrebs I'm just surprised that the behavior analysis of VT didn't catch these either. https://www.virustotal.com/gui/file/84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106/behavior says it's been reanalyzed 2h ago.
@cubeos you'd have to put it through something like any.run to view the actual stuff that gets installed when you run it. they expired my subscription or I would do it myself.
