Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
-
A kind reader submitted the Rufus installer to any.run, a sandbox which walks through the installation of software to find malware that gets installed only *AFTER* the executable is clicked. You can see exactly all of the post-install prompts to download additional software that I also saw.
-
@demon6 wait, what? how is this related? I'm sincerely asking because IDK.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs I tried Rufus but computer said no and I am glad
-
@demon6 wait, what? how is this related? I'm sincerely asking because IDK.
@briankrebs Rufus can insert the updated uefi certs into windows ISO’s. It’s possible that those certs could be compromised, but that’s the additional downloads you’re seeing from what I saw in the video from @jordinki
-
@jordinki @briankrebs requiring a removable drive would be a hilariously perfect anti-sandbox method for this.
@briankrebs @jordinki @darfplatypus it'd be annoying to fully fake too because sandboxes tend to be kind of painful to add these things to yourself
-
@briankrebs So I hate to be snarky, but "dd" has been there all along people. Having to install an entire 3rd party application, for something that the OS should have stable, reliable methods for, to format a storage device and transfer a standard filesystem image to it, is intolerable. But it's Windows...depends on curl to download its own updates...
@jab01701mid @briankrebs ironically the official windows installer builder does support writing to USB directly but it doesn't have the customisation that Rufus offers for slipstreaming and deshittifying. But for other non-Windows ISOs? Yeah.
Though it should be noted that for awhile now a lot of images are designed such that if you mount them and copy their contents to the USB partition bare it'll work just fine and this can be done from stock Windows
-
@jab01701mid @briankrebs ironically the official windows installer builder does support writing to USB directly but it doesn't have the customisation that Rufus offers for slipstreaming and deshittifying. But for other non-Windows ISOs? Yeah.
Though it should be noted that for awhile now a lot of images are designed such that if you mount them and copy their contents to the USB partition bare it'll work just fine and this can be done from stock Windows
@Lunaphied Okay. But how?
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs@infosec.exchange the new DiskDestroyer...
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
Look, compromises happen to everyone. I have received a ton of private messages asking if I'm okay. But the reality is that I stopped using Windoze a long time ago and this was a kind of one-off thing where I was trying to re-image an old system anyway (away from Windoze).
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs I wonder if @torproject should know because Rufus is recommended to those who wish to install Tails from Windows:
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs@infosec.exchange have you reported this on the rufus github repo?
-
@briankrebs@infosec.exchange have you reported this on the rufus github repo?
@stella No. I reported it to everyone.
-
@stella No. I reported it to everyone.
@briankrebs@infosec.exchange …except the one place where its most likely to reach people who might be able to fix it?
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@simon @briankrebs Please what Rufus version does it apply to? The last I've used is 4.9, and the only thing it asked to download was some Secure Boot-related pieces.
-
Look, compromises happen to everyone. I have received a ton of private messages asking if I'm okay. But the reality is that I stopped using Windoze a long time ago and this was a kind of one-off thing where I was trying to re-image an old system anyway (away from Windoze).
The cognoscenti don't use the term Windoze anymore - there is no need and it does age us somewhat!
Please tell us what you were attempting to install. We are all friends here and won't judge
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
I love all the commentary about how I'm supposedly inventing things here. Supply chain hacks or just selling one's site/brand happens. If you don't like the results too bad. Check them yourself.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs tails.net has its own copy of rufus-portable.exe
-
A kind reader submitted the Rufus installer to any.run, a sandbox which walks through the installation of software to find malware that gets installed only *AFTER* the executable is clicked. You can see exactly all of the post-install prompts to download additional software that I also saw.
@briankrebs@infosec.exchange the scary boxes like, downloading from the MS github and checking for its own updates, which is opt in? what the hell even is this alarmist thread
-
@briankrebs@infosec.exchange the scary boxes like, downloading from the MS github and checking for its own updates, which is opt in? what the hell even is this alarmist thread
@amy alarmist? trigger much?
-
@briankrebs@infosec.exchange …except the one place where its most likely to reach people who might be able to fix it?
@stella Feel free. I've been a little busy re-imaging a Windows box
