Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.

[gerdesj@mastodonapp.uk]

@briankrebs

The cognoscenti don't use the term Windoze anymore - there is no need and it does age us somewhat!

Please tell us what you were attempting to install. We are all friends here and won't judge

[briankrebs@infosec.exchange]

I love all the commentary about how I'm supposedly inventing things here. Supply chain hacks or just selling one's site/brand happens. If you don't like the results too bad. Check them yourself.

[mike805@noc.social]

@briankrebs tails.net has its own copy of rufus-portable.exe

[amy@sk.girlthi.ng]

@briankrebs@infosec.exchange the scary boxes like, downloading from the MS github and checking for its own updates, which is opt in? what the hell even is this alarmist thread

[briankrebs@infosec.exchange]

@amy alarmist? trigger much?

[briankrebs@infosec.exchange]

@stella Feel free. I've been a little busy re-imaging a Windows box

[stephenboylett@techhub.social]

@briankrebs you know you can create iso files from folders directly through PowerShell? I forget where I got the script from but it feels like magic every time I use it.

[briankrebs@infosec.exchange]

@StephenBoylett no, I didn't know that. If you can supply a link that would be helpful, thanks.

[emory@soc.kvet.ch]

@briankrebs I feel extremely lucky considering I have two Windows workstations and one is for ML and Gaming so perfect patient zero situation which is why it's sharing a vlan with the other embarrassment, arguably worse: windows 10 set to danger-cart mode to run without seatbelts and use unsigned drivers.

abandonware is the default software license in amateur radio. 🪊 🪊

[snornik@techhub.social]

@briankrebs I only had that (the secure boot fail) problem if you click the skip windows login procedure. Or how ever its was called. (Last time i used it was years ago). then rufus modified the iso to skip the annoying install process which broke secure boot. Last time i used it without that option the image was valid with secure boot. and also never had any "want to download stuff" requests on my whitelist firewall. but may be outdated info. also i never used the installer only portable version. (it never tried any network-connection. nor did it spawn weird new processes/services.)

i'm pretty sure the "official" download was sourceforge at that time.

[tehstu@hachyderm.io]

@briankrebs I'm not usually on Windows, but looking at my /Downloads I must have fetched and used it back in July, so I have this build.

I grabbed Malwarebytes (for want of something to do) and ran it before (clean) and with Rufus running (clean).

One thing I did note - I genuinely don't recall it fetching any additional files until you select an ISO, it reads it, and determines if it needs extra files which is mentioned on the page linked below.

https://github.com/pbatard/rufus/wiki/Security

[glitterbean@wehavecookies.social]

@briankrebs I think I'll stick with dd.

[stephenboylett@techhub.social]

@briankrebs I think I got the original Chris Wu version that has been deleted, but this looks to be an updated fork of that.

https://github.com/TheDotSource/New-ISOFile

[tehstu@hachyderm.io]

@jordinki @briankrebs they're pretty up front about Rufus fetching those files from the Microsoft Github. We're saying they're malware?

https://github.com/pbatard/rufus/issues/3039

(there's a GH issue because Microsoft moved them, causing 404 in the downloads. I assume they reverted the change because there was no new Rufus build)

[aphantastic@social.vivaldi.net]

@briankrebs

I've never been able to get Rufus to work. Instead, I've been an avid user of Universal USB Installer for decades: https://en.wikipedia.org/wiki/Universal_USB_Installer

For years now it has Ventoy, so it's even better than it was originally.

[fritzadalis@infosec.exchange]

@briankrebs
I didn't run it, but I downloaded the x64 installer and portable from rufus.ie and it's signed and the sha256 matches the download page. It looks like the 'extras' download checks a hardcoded checksum database too. Do you still have the version you downloaded? Maybe check the sha256, or if you're tired of it consider sending to steveshockley.99 on signal.

[novafunc@social.tchncs.de]

@dey @briankrebs Some distros recommend not using Ventoy because it does non-standard things and requires some hacks to work the way it does. Sometimes it breaks expectations and causes issues.

[mcourcel@allovertheplace.ca]

@briankrebs Weird. I just downloaded the latest portable yesterday and it was fine.

[tycoontom@infosec.exchange]

@jordinki @briankrebs Note: Free accounts automatically make your analysis public, so never upload files containing personal data, passwords, or private company info. #Privacy

[l2actual@infosec.exchange]

I have used Rufus many times in the past @briankrebs and never had an issue, but clearly if you are seeing these additional installs something has compromised it.
I usually grab the portable version and the last one I downloaded was 4.14 back in May, which worked as expected and still does.
So it would seem that 4.15 is not to be trusted.