Discussion
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs
I didn't run it, but I downloaded the x64 installer and portable from rufus.ie and it's signed and the sha256 matches the download page. It looks like the 'extras' download checks a hardcoded checksum database too. Do you still have the version you downloaded? Maybe check the sha256, or if you're tired of it consider sending to steveshockley.99 on signal.
I've never been able to get Rufus to work. Instead, I've been an avid user of Universal USB Installer for decades: https://en.wikipedia.org/wiki/Universal_USB_Installer
For years now it has Ventoy, so it's even better than it was originally.
@briankrebs you know you can create iso files from folders directly through PowerShell? I forget where I got the script from but it feels like magic every time I use it.
@StephenBoylett no, I didn't know that. If you can supply a link that would be helpful, thanks.
@briankrebs I think I got the original Chris Wu version that has been deleted, but this looks to be an updated fork of that.
@briankrebs tails.net has its own copy of rufus-portable.exe
I love all the commentary about how I'm supposedly inventing things here. Supply chain hacks or just selling one's site/brand happens. If you don't like the results too bad. Check them yourself.
@simon @briankrebs Please what Rufus version does it apply to? The last I've used is 4.9, and the only thing it asked to download was some Secure Boot-related pieces.
@briankrebs You cannot expect nothing good from Windows, which is a troyan itself by definition.
@briankrebs have you reported this on the rufus github repo?
@stella No. I reported it to everyone.
@briankrebs ...except the one place where its most likely to reach people who might be able to fix it?
@stella Feel free. I've been a little busy re-imaging a Windows box
@briankrebs I wonder if @torproject should know because Rufus is recommended to those who wish to install Tails from Windows:
Look, compromises happen to everyone. I have received a ton of private messages asking if I'm okay. But the reality is that I stopped using Windoze a long time ago and this was a kind of one-off thing where I was trying to re-image an old system anyway (away from Windoze).
@briankrebs I feel extremely lucky considering I have two Windows workstations and one is for ML and Gaming so perfect patient zero situation which is why it's sharing a vlan with the other embarrassment, arguably worse: windows 10 set to danger-cart mode 🚨 to run without seatbelts and use unsigned drivers.
abandonware is the default software license in amateur radio.
@briankrebs I tried Rufus but computer said no and I am glad
@briankrebs Just starting rufus-4.15 and interacting with the updater configuration ends up with Defender being disabled (in a Windows Sandbox that's probably not safe enough for something like this, oh well)...
@briankrebs Still have an older version in my downloads folder (4.6.2208, 2025-03-24), which seems fine.
@galaxis yes if you trust WindowsDefender to defend you against this attack you will be sorely mistaken. It successfully detects all the malware installed, but it acts weird and sends notifications about malware detections even though its own interface says a scan is clean.
@briankrebs Yeah no, didn't expect Defender to be useful, but counting on the Sandbox throwaway VM was probably still somewhat risky 🤷♂️
Anyway it's the first time I see this mentioned, and the current Rufus version seems to have been up for months? A timebomb that activated only recently?
@briankrebs ventoy is better. Boot the iso you want from a menu.
A kind reader submitted the Rufus installer to any.run, a sandbox which walks through the installation of software to find malware that gets installed only *AFTER* the executable is clicked. You can see exactly all of the post-install prompts to download additional software that I also saw.
@briankrebs This really looks like a malvertising campaign to me. Rufus doesn't even have an installer. You just run it directly.
I found ads on the rufus.ie site pointing to get-blazer.com, which is a known malware host.
https://any.run/report/2744d66eaf61f28d1930ae45562f9f4cd1b33db4083a1dcaca8a5d6703846282/67191634-20ef-49a1-ae63-bc194b618be1
@briankrebs@infosec.exchange the scary boxes like, downloading from the MS github and checking for its own updates, which is opt in? what the hell even is this alarmist thread
@amy alarmist? trigger much?
@demon6 wait, what? how is this related? I'm sincerely asking because IDK.
@briankrebs Rufus can insert the updated carts into windows ISO’s. It’s possible that those certs could be compromised, but that’s the additional downloads you’re seeing from what I saw in the video from
Install Fedizen
Get the full app experience
@briankrebs Weird. I just downloaded the latest portable yesterday and it was fine.