Discussion
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.
@briankrebs
Surely, the conspiracy isn't that deep. 😆
@briankrebs haven't used rufus or cd installs in awhile so thanks for the warning!
@briankrebs When you say you "installed" rufus, did it prompt you for some kind of installation? Or did the startup match what was in the any.run analysis that was submitted? I ask because rufus doesn't really have an install, you just run it and go. Trying to forensically put this back together is going to require a bit more info if you can provide it. I don't suppose, since you are wiping that computer, that you saved anything at all from it?
@briankrebs Thanks. I'm running Rufus 4.15.2396, pulled from Github via the link on the rufus dot ie page. Writing a Win11 x64 ISO out to USB in a VM. It failed the USB write, but my USB drive might also be flakey.
@briankrebs I've never liked the name of this program; it sounds like it refers to a specific country. Please use only Fedora Media Writer.
@briankrebs Yes, rufus[.ie] is the official site for Rufus. That being said, I haven’t used Rufus in more than a year (and honestly it didn’t work for me). Ventoy and dd work.
@briankrebs Weird. I just downloaded the latest portable yesterday and it was fine.
@briankrebs
I didn't run it, but I downloaded the x64 installer and portable from rufus.ie and it's signed and the sha256 matches the download page. It looks like the 'extras' download checks a hardcoded checksum database too. Do you still have the version you downloaded? Maybe check the sha256, or if you're tired of it consider sending to steveshockley.99 on signal.
I've never been able to get Rufus to work. Instead, I've been an avid user of Universal USB Installer for decades: https://en.wikipedia.org/wiki/Universal_USB_Installer
For years now it has Ventoy, so it's even better than it was originally.
@briankrebs you know you can create iso files from folders directly through PowerShell? I forget where I got the script from but it feels like magic every time I use it.
@StephenBoylett no, I didn't know that. If you can supply a link that would be helpful, thanks.
@briankrebs I think I got the original Chris Wu version that has been deleted, but this looks to be an updated fork of that.
@briankrebs tails.net has its own copy of rufus-portable.exe
I love all the commentary about how I'm supposedly inventing things here. Supply chain hacks or just selling one's site/brand happens. If you don't like the results too bad. Check them yourself.
I didn't realize how strong a community Rufus has. Please don't shoot the messenger.
@briankrebs Better to know then not to know…
@briankrebs you where right to report, fuck them haters.
I have used Rufus many times in the past @briankrebs and never had an issue, but clearly if you are seeing these additional installs something has compromised it.
I usually grab the portable version and the last one I downloaded was 4.14 back in May, which worked as expected and still does.
So it would seem that 4.15 is not to be trusted.
@simon @briankrebs Please what Rufus version does it apply to? The last I've used is 4.9, and the only thing it asked to download was some Secure Boot-related pieces.
@briankrebs You cannot expect nothing good from Windows, which is a troyan itself by definition.
@briankrebs have you reported this on the rufus github repo?
@stella No. I reported it to everyone.
@briankrebs ...except the one place where its most likely to reach people who might be able to fix it?
@stella Feel free. I've been a little busy re-imaging a Windows box
Install Fedizen
Get the full app experience
@briankrebs
Think I pulled down Rufus a couple of months back for a one off. Don't recall where I got it from, but didn't notice any untoward behavior, so possibly a more recent compromise?