Discussion
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
@briankrebs Rufus inspect the iso you pass and if it find outdated efi drivers it ask you if you want to replace it with newer versions. That can be a problem because you have to flash the bios with the new certificates. I also found some HP that refuses to boot with the old certificates, you have to disable Secure Boot to install it, to update it later
It also could be that the site was compromised, but if you nuked everything then, who knows now.
The drama itself confirms my ~~bias~~ claim that we never should have normalized and even encouraged such patterns of downloading additional components at install- or run-time.
Kids today... there was a good reason we didn't do it like that before!
(there's a joke in there about not having the ubiquitous internet before)
@briankrebs Here’s another user who faced malware alerts while using Rufus. They were flashing Kali Linux, though, and it’s ISO file got scanned along the process.
https://www.reddit.com/r/Hacking_Tutorials/comments/1t62lrs/virus_in_rufus_while_flashing_usb_for_kali/
Ha ha ha hah: you’re still using Windows. 🤪🤭
@briankrebs @vx_underground Possible goop sighting?
I've been made aware of a post from someone representing Rufus who says I'm very confused about this post. I've reported that Windows Defender went bananas after I installed Rufus on a Windows 11 device. It immediately popped up warnings about hacktools and trojans being installed while it was installing. I wish I had a record of it but I nuked everything after the alerts.
@briankrebs Hey Mr. Krebs, I'm afraid I agree with pbatard for now. Your messages DO seem confused, Rufus does not "install", it's shipped as plain portable program. Are you sure you haven't been MitMed?
@briankrebs Brian, I've never used Rufus before but I've looked at the executable that is downloadable from their site (the first one, rufus-4.15.exe) and I assure you that it is not malicious. It's possible that Windows Defender is throwing some kind of false positive (although simply running the executable did not produce any alerts here) but I'd need more precise information, in order to determine what exactly is happening.
Could you please document the exact steps one needs to perform, in order to reproduce your results? Which executable did you download? When did the alert pop up? What parameters did you select?
The thing's UI is awful, BTW - apparently you have to click on what looks like a dropdown listbox, in order to open a file selection menu, WTF.
@briankrebs i'm sorry someone actually posted that on github issues?? Oy vey..
@briankrebs
I think it's worth noting, a long history of actors buying ad-space at the top of search engines.
The url in the ad appears legitimate (it's visually the legitimate URL), but when clicked goes to a different url. I'm not positive that's the case here, but it's been done 100s of times for 100s of other tools (AI tool installers, chrome installs, etc), and there is zero visual indication it's an ad directing to the wrong domain.
Thanks to LLMs, the landing pages have also gotten much better at copying the real pages too.
Making it more difficult, is that ads don't always present themselves, so seeing it a 2nd time may take 100s of visits
Or maybe it really was a compromised rufus domain🤷
@briankrebs Rufus doesn't have an installer though. That's the thing. One simply doesn't install Rufus.
@briankrebs There are some rather ... possessive communities around USB boot image builders, I forget if it was rufus or ventoy or what, but long story short: if you badmouth the product, the sealions. Dear god, the sealions.
@briankrebs I think the message here is that Windows is bad, and Rufus is bad.
Just use GNU+Linux with the dd command guys. Lol
Think I pulled down Rufus a couple of months back for a one off. Don't recall where I got it from, but didn't notice any untoward behavior, so possibly a more recent compromise?
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.
@briankrebs
It's that centuries old strategy of burning the ships, right?
@briankrebs Hmmm... I have version 3.21 on a Windooze 10. Downloaded early 2023 when I guess it was still clean.
But, when starting it requests the ability to make changes to the system.
Guess beter not doing that.
@briankrebs you know you can run software in a vm and let it access specific devices while running? I trust very few software packages...
windoze malware: "quick. we gotta infect this machine while we have the chance. once it's running linux, we're out of another home..."
@briankrebs while i get that point.... without linux alot are not used to console/tui tools and need a gui. i dont think its funny cause as a nerd your probably overwrite the whole windows partition anyway, pretty soon. as a newcomer you want to try out linux on a 2nd device and then this is not as funny anymore.
@snornik 100 percent agree. I'm still fuming that we're at Windos 11 hundred and there is no obvious way to write an ISO to an external image. I credit that to Microsoft understanding this capability is a strong existential threat.
@briankrebs YES! also agree 100%!
@briankrebs New Alanis lyrics just dropped.
@briankrebs Plot twist: Windoze IS the virus!
@briankrebs
Surely, the conspiracy isn't that deep. 😆
@briankrebs haven't used rufus or cd installs in awhile so thanks for the warning!
@briankrebs When you say you "installed" rufus, did it prompt you for some kind of installation? Or did the startup match what was in the any.run analysis that was submitted? I ask because rufus doesn't really have an install, you just run it and go. Trying to forensically put this back together is going to require a bit more info if you can provide it. I don't suppose, since you are wiping that computer, that you saved anything at all from it?
@briankrebs Thanks. I'm running Rufus 4.15.2396, pulled from Github via the link on the rufus dot ie page. Writing a Win11 x64 ISO out to USB in a VM. It failed the USB write, but my USB drive might also be flakey.
A kind reader submitted the Rufus installer to any.run, a sandbox which walks through the installation of software to find malware that gets installed only *AFTER* the executable is clicked. You can see exactly all of the post-install prompts to download additional software that I also saw.
@briankrebs
After watching the video 3 times I'm still puzzled to where the 100 trojans (or even a single one) is downloaded and installed.
Install Fedizen
Get the full app experience
@briankrebs I have always downloaded and used the portable version of Rufus, on a W11 PC, and have had no reason to suspect it contains malware. When I update to later versions nowadays, I use the the version from 'PortableApps': https://portableapps.com/apps/utilities/rufus-portable
PortableApps.com