Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs@infosec.exchange have you reported this on the rufus github repo?
-
@briankrebs@infosec.exchange have you reported this on the rufus github repo?
@stella No. I reported it to everyone.
-
@stella No. I reported it to everyone.
@briankrebs@infosec.exchange …except the one place where its most likely to reach people who might be able to fix it?
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@simon @briankrebs Please what Rufus version does it apply to? The last I've used is 4.9, and the only thing it asked to download was some Secure Boot-related pieces.
-
Look, compromises happen to everyone. I have received a ton of private messages asking if I'm okay. But the reality is that I stopped using Windoze a long time ago and this was a kind of one-off thing where I was trying to re-image an old system anyway (away from Windoze).
The cognoscenti don't use the term Windoze anymore - there is no need and it does age us somewhat!
Please tell us what you were attempting to install. We are all friends here and won't judge
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
I love all the commentary about how I'm supposedly inventing things here. Supply chain hacks or just selling one's site/brand happens. If you don't like the results too bad. Check them yourself.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs tails.net has its own copy of rufus-portable.exe
-
A kind reader submitted the Rufus installer to any.run, a sandbox which walks through the installation of software to find malware that gets installed only *AFTER* the executable is clicked. You can see exactly all of the post-install prompts to download additional software that I also saw.
@briankrebs@infosec.exchange the scary boxes like, downloading from the MS github and checking for its own updates, which is opt in? what the hell even is this alarmist thread
-
@briankrebs@infosec.exchange the scary boxes like, downloading from the MS github and checking for its own updates, which is opt in? what the hell even is this alarmist thread
@amy alarmist? trigger much?
-
@briankrebs@infosec.exchange …except the one place where its most likely to reach people who might be able to fix it?
@stella Feel free. I've been a little busy re-imaging a Windows box
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs you know you can create iso files from folders directly through PowerShell? I forget where I got the script from but it feels like magic every time I use it.
-
@briankrebs you know you can create iso files from folders directly through PowerShell? I forget where I got the script from but it feels like magic every time I use it.
@StephenBoylett no, I didn't know that. If you can supply a link that would be helpful, thanks.
-
Look, compromises happen to everyone. I have received a ton of private messages asking if I'm okay. But the reality is that I stopped using Windoze a long time ago and this was a kind of one-off thing where I was trying to re-image an old system anyway (away from Windoze).
@briankrebs I feel extremely lucky considering I have two Windows workstations and one is for ML and Gaming so perfect patient zero situation which is why it's sharing a vlan with the other embarrassment, arguably worse: windows 10 set to danger-cart mode
to run without seatbelts and use unsigned drivers.abandonware is the default software license in amateur radio.
-
No clue whether the resulting ISO is also malicious, but tried running it just for giggles on a spare Windows PC from bootup and the machine's bios said nope, wouldn't allow b/c security policy. Not sure if it's related but I've never seen that message before trying to boot up from a USB.
@briankrebs I only had that (the secure boot fail) problem if you click the skip windows login procedure. Or how ever its was called. (Last time i used it was years ago). then rufus modified the iso to skip the annoying install process which broke secure boot. Last time i used it without that option the image was valid with secure boot. and also never had any "want to download stuff" requests on my whitelist firewall. but may be outdated info. also i never used the installer only portable version. (it never tried any network-connection. nor did it spawn weird new processes/services.)
i'm pretty sure the "official" download was sourceforge at that time.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs I'm not usually on Windows, but looking at my /Downloads I must have fetched and used it back in July, so I have this build.
I grabbed Malwarebytes (for want of something to do) and ran it before (clean) and with Rufus running (clean).
One thing I did note - I genuinely don't recall it fetching any additional files until you select an ISO, it reads it, and determines if it needs extra files which is mentioned on the page linked below.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs I think I'll stick with dd.
-
@StephenBoylett no, I didn't know that. If you can supply a link that would be helpful, thanks.
@briankrebs I think I got the original Chris Wu version that has been deleted, but this looks to be an updated fork of that.
-
@briankrebs WHO ORDERED THE LARGE DEEPDISH SANDBOX ANALYSIS??
https://app.any.run/tasks/90d1d270-a93f-498f-81d7-84d5e8f156bf
@jordinki @briankrebs they're pretty up front about Rufus fetching those files from the Microsoft Github. We're saying they're malware?
https://github.com/pbatard/rufus/issues/3039
(there's a GH issue because Microsoft moved them, causing 404 in the downloads. I assume they reverted the change because there was no new Rufus build)
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
I've never been able to get Rufus to work. Instead, I've been an avid user of Universal USB Installer for decades: https://en.wikipedia.org/wiki/Universal_USB_Installer
For years now it has Ventoy, so it's even better than it was originally.
-
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs
I didn't run it, but I downloaded the x64 installer and portable from rufus.ie and it's signed and the sha256 matches the download page. It looks like the 'extras' download checks a hardcoded checksum database too. Do you still have the version you downloaded? Maybe check the sha256, or if you're tired of it consider sending to steveshockley.99 on signal.
