Discussion
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs
After watching the video 3 times I'm still puzzled to where the 100 trojans (or even a single one) is downloaded and installed.
@briankrebs funny that it is possible to send the rufus installer to analysis when the rufus folks claim it has no installer.
The reality distortion field is strong here.
@briankrebs This really looks like a malvertising campaign to me. Rufus doesn't even have an installer. You just run it directly.
I found ads on the rufus.ie site pointing to get-blazer.com, which is a known malware host.
https://any.run/report/2744d66eaf61f28d1930ae45562f9f4cd1b33db4083a1dcaca8a5d6703846282/67191634-20ef-49a1-ae63-bc194b618be1
@briankrebs@infosec.exchange the scary boxes like, downloading from the MS github and checking for its own updates, which is opt in? what the hell even is this alarmist thread
@amy alarmist? trigger much?
@demon6 wait, what? how is this related? I'm sincerely asking because IDK.
@briankrebs Rufus can insert the updated carts into windows ISO’s. It’s possible that those certs could be compromised, but that’s the additional downloads you’re seeing from what I saw in the video from
@briankrebs ...installation? its a portable app. do you still have the actual download link?
I just downloaded it last week (from rufus[.]ie) to a Linux machine to run with Wine and had no issues with ClamAV or the Linux machine.
@briankrebs Has your CoPilot gone rogue?
@ModernMaslow I don't use AI. At least on purpose.
@briankrebs Somehow I don't think the Tech Bros will consult you first.
@briankrebs Do you happen to have the hash of the file you received? I just pulled https://github.com/pbatard/rufus/releases/download/v4.15/rufus-4.15.exe (which is also the link that is on rufus.ie) and it gave me 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106 rufus-4.15.exe which is clean according to virustotal.
@cubeos As I mentioned, the installer put up several prompts to install other components, so those probably wouldn't come up on a scan of the installer itself.
@briankrebs I'm just surprised that the behavior analysis of VT didn't catch these either. https://www.virustotal.com/gui/file/84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106/behavior says it's been reanalyzed 2h ago.
@cubeos you'd have to put it through something like any.run to view the actual stuff that gets installed when you run it. they expired my subscription or I would do it myself.
@briankrebs So I hate to be snarky, but "dd" has been there all along people. Having to install an entire 3rd party application, for something that the OS should have stable, reliable methods for, to format a storage device and transfer a standard filesystem image to it, is intolerable. But it's Windows...depends on curl to download its own updates...
@jab01701mid @briankrebs ironically the official windows installer builder does support writing to USB directly but it doesn't have the customisation that Rufus offers for slipstreaming and deshittifying. But for other non-Windows ISOs? Yeah.
Though it should be noted that for awhile now a lot of images are designed such that if you mount them and copy their contents to the USB partition bare it'll work just fine and this can be done from stock Windows
@jab01701mid You're absolutely right. It's like the flashlight app. Duh. Should be included so people don't search for it and install malware.
@briankrebs huh, that is the traditional official domain for it, isn't it?
looks disputed as a windows defender false positive.
@m3t00 again, the behavior will likely not be noticed by scanning the installer file. Needs a sandbox installation to find out what's really going on.
@briankrebs
What chance do I have, if you get hit?
However, in my defense Google's default search results list rufus[.]ie as the authoritative site
@briankrebs WHO ORDERED THE LARGE DEEPDISH SANDBOX ANALYSIS??
https://app.any.run/tasks/90d1d270-a93f-498f-81d7-84d5e8f156bf
@jordinki @briankrebs And where exactly does the malicious activity happen in that video? Can anyone name or point out the supposed trojans?
Well if you check the process graph. there are registry modifying calls.. (i did not crosscheck the results, only seen from the provided link) which by itself would already be a bad sign. i still have the last version i used and there this is not the case. and also i don't allow outgoing connections by default, and would see them and there are none in the old version. so maybe something changed lately.
@snornik @snep @jordinki @briankrebs the "standard" version stores its settings in the registry
@umby995 @snep @jordinki @briankrebs
yeah and it stores it in:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0DD0E83D-B8CC-4015-B164-66137069CC91}Machine\Software\Policies\Microsoft\Windows Defender\Real-Time Protection
edit: i mean again i did not crosscheck but please (at least) read the report before stating something
@snornik @snep @jordinki @briankrebs yeah that's my bad. i am confused because the text report from anyrun doesn't show any registry activity at all, but the more info section for the process in the full report does show 1347 registry events, which definitely seems suspicious.
@jordinki thank god! the Internet gods DO exist!
@briankrebs @jordinki it's Gods all the way down.
@briankrebs the link the to official site from the GitHub page also links to Rufus.ie so something ain’t right
@briankrebs I used the Portable one when I ran Windows. Is it just the installer, or is the portable one infected, too?
@briankrebs The official one downloaded via https://github.com/pbatard/rufus or https://rufus.ie? 🤨
@sindarina ah that's my problem I guess.
@briankrebs Ventoy is the new Rufus BTW.
Install Fedizen
Get the full app experience
A kind reader submitted the Rufus installer to any.run, a sandbox which walks through the installation of software to find malware that gets installed only *AFTER* the executable is clicked. You can see exactly all of the post-install prompts to download additional software that I also saw.
https://infosec.exchange/@jordinki/117492425049116266