Post by @briankrebs@infosec.exchange

Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.

Edit: Had a conversation with the maintainer(s) of Rufus, who told me the malware alerts were almost certainly from Windows Defender scanning the files in the Linux ISO I was trying to burn, and not from the program itself. I'm willing to accept that may be the case here, but I also no longer have a way to check b/c I nuked the system after all the alerts, and the bios produced a warning when the system restarted.

0 Boosts

0 Likes

Sindarina, Edge Case Detective

@sindarina@ngmx.com 17 hr. ago

@briankrebs The official one downloaded via https://github.com/pbatard/rufus or https://rufus.ie? 🤨

Rufus - The Official Website (Download, New Releases)

Rufus is a small application that creates bootable USB drives, which can then be used to install or run Microsoft Windows, Linux or DOS. In just a few minutes, and with very few clicks, Rufus can help you run a new Operating System on your computer...

GitHub

GitHub - pbatard/rufus: The Reliable USB Formatting Utility

The Reliable USB Formatting Utility. Contribute to pbatard/rufus development by creating an account on GitHub.

BrianKrebs

@briankrebs@infosec.exchange 17 hr. ago

@sindarina ah that's my problem I guess.

DEY!

@dey@mastodon.social 17 hr. ago

@briankrebs Ventoy is the new Rufus BTW.

BrianKrebs

@briankrebs@infosec.exchange 17 hr. ago

No clue whether the resulting ISO is also malicious, but tried running it just for giggles on a spare Windows PC from bootup and the machine's bios said nope, wouldn't allow b/c security policy. Not sure if it's related but I've never seen that message before trying to boot up from a USB.

snornik

@snornik@techhub.social 15 hr. ago

@briankrebs I only had that problem if you click the skip windows login procedure. Or how ever its was called. (Last time i used it was years ago). then rufus modified the iso to skip the annoying install process which broke secure boot. Last time i used it without that option the image was valid with secure boot. and also never had any "want to download stuff" requests on my whitelist firewall. but may be outdated info.