Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
-
@briankrebs Do you happen to have the hash of the file you received? I just pulled https://github.com/pbatard/rufus/releases/download/v4.15/rufus-4.15.exe (which is also the link that is on rufus.ie) and it gave me 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106 rufus-4.15.exe which is clean according to virustotal.
@cubeos As I mentioned, the installer put up several prompts to install other components, so those probably wouldn't come up on a scan of the installer itself.
-
@sindarina @briankrebs
cool, I'm WFPhone so I couldn't tell.@ajn142 @briankrebs Also, the .ie points to GitHub, and is hosted by GHP.
https://github.com/pbatard/rufus-web
Very strange.
-
@ajn142 @sindarina yes. I'm guessing supply chain hack. i have no data to support that, though.
@briankrebs @sindarina yeah, I don't have any disposable boxes right now, so I can't gamble on it.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs Has your CoPilot gone rogue?
-
@briankrebs Has your CoPilot gone rogue?
@ModernMaslow I don't use AI. At least on purpose.
-
@ModernMaslow I don't use AI. At least on purpose.
@briankrebs Somehow I don't think the Tech Bros will consult you first.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
I just downloaded it last week (from rufus[.]ie) to a Linux machine to run with Wine and had no issues with ClamAV or the Linux machine.
-
@cubeos As I mentioned, the installer put up several prompts to install other components, so those probably wouldn't come up on a scan of the installer itself.
@briankrebs I'm just surprised that the behavior analysis of VT didn't catch these either. https://www.virustotal.com/gui/file/84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106/behavior says it's been reanalyzed 2h ago.
-
@briankrebs I'm just surprised that the behavior analysis of VT didn't catch these either. https://www.virustotal.com/gui/file/84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106/behavior says it's been reanalyzed 2h ago.
@cubeos you'd have to put it through something like any.run to view the actual stuff that gets installed when you run it. they expired my subscription or I would do it myself.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs ...installation? its a portable app. do you still have the actual download link?
-
@briankrebs So I hate to be snarky, but "dd" has been there all along people. Having to install an entire 3rd party application, for something that the OS should have stable, reliable methods for, to format a storage device and transfer a standard filesystem image to it, is intolerable. But it's Windows...depends on curl to download its own updates...
@jab01701mid @briankrebs Unfortunately dd-ing windows images to boot sticks just ends up with an unbootable image.
Ventoy is pretty decent, and i have to admit the Windows Media Creation Tool works well, if you have to work from Windows. -
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@BorrisInABox @briankrebs Well then I guess it's a good thing I have the portable version, huh?
-
However, in my defense Google's default search results list rufus[.]ie as the authoritative site
@briankrebs WHO ORDERED THE LARGE DEEPDISH SANDBOX ANALYSIS??
https://app.any.run/tasks/90d1d270-a93f-498f-81d7-84d5e8f156bf
-
looks disputed as a windows defender false positive.
@m3t00 again, the behavior will likely not be noticed by scanning the installer file. Needs a sandbox installation to find out what's really going on.
-
@briankrebs WHO ORDERED THE LARGE DEEPDISH SANDBOX ANALYSIS??
https://app.any.run/tasks/90d1d270-a93f-498f-81d7-84d5e8f156bf
@jordinki thank god! the Internet gods DO exist!
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
A kind reader submitted the Rufus installer to any.run, a sandbox which walks through the installation of software to find malware that gets installed only *AFTER* the executable is clicked. You can see exactly all of the post-install prompts to download additional software that I also saw.
-
@briankrebs WHO ORDERED THE LARGE DEEPDISH SANDBOX ANALYSIS??
https://app.any.run/tasks/90d1d270-a93f-498f-81d7-84d5e8f156bf
@briankrebs While the analysis marks as malicious, I couldn't get anything to pop. There is a caveat that it might only trigger if theres a removable drive inserted. Further, I did notice that the Google search result took me to the spanish version right away. Running updates catches an update for secure boot (believe microsoft posted a newer one for UEFI certs and so on) but the english version randomly complains about file header lengths not matching or something.
Something fishy about this, kinda smells like the notepad++ debacle but who knows without more defacto evidence.
SHA Dumpz
/es/ files:
rufus-4.15.exe - 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106
rufus-4.15p.exe - 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106
rufus-4.15_x86.exe - 20e1345715aff4aebf016839f721390882201a2b5d00655424c4ca38cb919576
/en/:
rufus-4.15.exe - 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106rufus-4.15_arm64.exe - 98304:2j+pov9zclawddtljxynwkqya0sgygvzz93jrozodglintci09jnrvgnisaapitw:kmqv
rufus-4.15p.exe - 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106
-
No clue whether the resulting ISO is also malicious, but tried running it just for giggles on a spare Windows PC from bootup and the machine's bios said nope, wouldn't allow b/c security policy. Not sure if it's related but I've never seen that message before trying to boot up from a USB.
Its very likely that Secure Boot is kicking in. A Windows .iso written to a USB stick will pass, as will Debian, Ubuntu and a few other Linux distros. VMware ESXi and Proxmox will also pass.
At the boot stage, that is not a Windows PC - its just a PC!
To be honest if you are not sure exactly what is what, then Secure Boot is a good thing.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs@infosec.exchange
any more, if I have the choice of loading stuff to a VM or directly to my laptop's real OS, I choose the former.
Sorta like when I need to run AI agents, I do it inside containers ...inside VMs. -
@briankrebs Ventoy is the new Rufus BTW.
@dey @briankrebs I must STRONGLY second this. Ventoy does everything that could do far far better.
