@briankrebs I actually tried Ventoy last night after reading this, and it wasn't really a good fit for me or so I found, I appreciate the guy's trying to unify PXE/UEFI boot along with it. SYSLINUX trod only some of this ground by providing a loader but without provisioning tools.

@briankrebs It's been 6+ years sice I used rufus, but I recall the vpx or upx (forget the acronym) packer causing av to throw more false positives than an obscenely nested zip archive with an .scr in it.

As I understood it, this is a "the heuristics are frequently as dumb as the author of rufus is stubborn" situation, because he uses a bunch of tools that are likely to get flagged, uses stuff unsigned, and refuses to change.

Whether there's an additional, newer component to this isn't unlikely, but rufus throwing up skads of alarm bells is nothing new in the windows world.

For a while even microsoft official documentation recommended it for imaging surface tablets even though defender was screaming bloody murder about it the whole time.

@briankrebs I have always downloaded and used the portable version of Rufus, on a W11 PC, and have had no reason to suspect it contains malware. When I update to later versions nowadays, I use the the version from 'PortableApps': https://portableapps.com/apps/utilities/rufus-portable

@briankrebs Rufus inspect the iso you pass and if it find outdated efi drivers it ask you if you want to replace it with newer versions. That can be a problem because you have to flash the bios with the new certificates. I also found some HP that refuses to boot with the old certificates, you have to disable Secure Boot to install it, to update it later

It also could be that the site was compromised, but if you nuked everything then, who knows now.

@briankrebs

The drama itself confirms my ~~bias~~ claim that we never should have normalized and even encouraged such patterns of downloading additional components at install- or run-time.

Kids today... there was a good reason we didn't do it like that before!

(there's a joke in there about not having the ubiquitous internet before)

@briankrebs @ask

@briankrebs Here’s another user who faced malware alerts while using Rufus. They were flashing Kali Linux, though, and it’s ISO file got scanned along the process.
https://www.reddit.com/r/Hacking_Tutorials/comments/1t62lrs/virus_in_rufus_while_flashing_usb_for_kali/

@briankrebs

@briankrebs

Ha ha ha hah: you’re still using Windows. 🤪🤭

@briankrebs @vx_underground Possible goop sighting?

I've been made aware of a post from someone representing Rufus who says I'm very confused about this post. I've reported that Windows Defender went bananas after I installed Rufus on a Windows 11 device. It immediately popped up warnings about hacktools and trojans being installed while it was installing. I wish I had a record of it but I nuked everything after the alerts.

https://github.com/pbatard/rufus/issues/3064

@briankrebs

Well crap

@briankrebs I think the message here is that Windows is bad, and Rufus is bad.

Just use GNU+Linux with the dd command guys. Lol

@briankrebs

Think I pulled down Rufus a couple of months back for a one off. Don't recall where I got it from, but didn't notice any untoward behavior, so possibly a more recent compromise?

Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.

@briankrebs haven't used rufus or cd installs in awhile so thanks for the warning!

@briankrebs When you say you "installed" rufus, did it prompt you for some kind of installation? Or did the startup match what was in the any.run analysis that was submitted? I ask because rufus doesn't really have an install, you just run it and go. Trying to forensically put this back together is going to require a bit more info if you can provide it. I don't suppose, since you are wiping that computer, that you saved anything at all from it?

@briankrebs I've never liked the name of this program; it sounds like it refers to a specific country. Please use only Fedora Media Writer.

@briankrebs Yes, rufus[.ie] is the official site for Rufus. That being said, I haven’t used Rufus in more than a year (and honestly it didn’t work for me). Ventoy and dd work.

@briankrebs Weird. I just downloaded the latest portable yesterday and it was fine.

@briankrebs
I didn't run it, but I downloaded the x64 installer and portable from rufus.ie and it's signed and the sha256 matches the download page. It looks like the 'extras' download checks a hardcoded checksum database too. Do you still have the version you downloaded? Maybe check the sha256, or if you're tired of it consider sending to steveshockley.99 on signal.

@briankrebs

I've never been able to get Rufus to work. Instead, I've been an avid user of Universal USB Installer for decades: https://en.wikipedia.org/wiki/Universal_USB_Installer

For years now it has Ventoy, so it's even better than it was originally.

@briankrebs you know you can create iso files from folders directly through PowerShell? I forget where I got the script from but it feels like magic every time I use it.

@briankrebs tails.net has its own copy of rufus-portable.exe

I love all the commentary about how I'm supposedly inventing things here. Supply chain hacks or just selling one's site/brand happens. If you don't like the results too bad. Check them yourself.