mastodon - Link to source

Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.

Edit: Had a conversation with the maintainer(s) of Rufus, who told me the malware alerts were almost certainly from Windows Defender scanning the files in the Linux ISO I was trying to burn, and not from the program itself. I'm willing to accept that may be the case here, but I also no longer have a way to check b/c I nuked the system after all the alerts, and the bios produced a warning when the system restarted.

Esta entrada fue editada (hoy, 13:55)
in reply to BrianKrebs
mastodon - Link to source

BrianKrebs

A kind reader submitted the Rufus installer to any.run, a sandbox which walks through the installation of software to find malware that gets installed only *AFTER* the executable is clicked. You can see exactly all of the post-install prompts to download additional software that I also saw.

infosec.exchange/@jordinki/117492425049116266

jordinki

2026-10-23 21:48:50

mastodon - Link to source

WHO ORDERED THE LARGE DEEPDISH SANDBOX ANALYSIS??

app.any.run/tasks/90d1d270-a93f-498f-81d7-84d5e8f156bf


URL analysis · Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
app.any.run

reshared this

in reply to BrianKrebs
mastodon - Link to source

jordinki

WHO ORDERED THE LARGE DEEPDISH SANDBOX ANALYSIS??

app.any.run/tasks/90d1d270-a93f-498f-81d7-84d5e8f156bf

URL analysis · Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.
app.any.run
in reply to jordinki
mastodon - Link to source

jordinki

in reply to jordinki
mastodon - Link to source

Stu

@jordinki they're pretty up front about Rufus fetching those files from the Microsoft Github. We're saying they're malware?

github.com/pbatard/rufus/issues/3039

(there's a GH issue because Microsoft moved them, causing 404 in the downloads. I assume they reverted the change because there was no new Rufus build)

UEFI DBX Update error · Issue #3039 · pbatard/rufus

Checklist I have been made aware that if my problem can be summarized as "I've created or tried to create a media using Rufus, and ...", and I am not including a log, this issue will be summarily c...
r0ckr0ll (GitHub)
@jordinki
in reply to BrianKrebs
mastodon - Link to source

Stephen Boylett

I think I got the original Chris Wu version that has been deleted, but this looks to be an updated fork of that.

github.com/TheDotSource/New-ISOFile

GitHub - TheDotSource/New-ISOFile: Function to create ISO files.

Function to create ISO files. Contribute to TheDotSource/New-ISOFile development by creating an account on GitHub.
GitHub
in reply to BrianKrebs
mastodon - Link to source

BrianKrebs

No clue whether the resulting ISO is also malicious, but tried running it just for giggles on a spare Windows PC from bootup and the machine's bios said nope, wouldn't allow b/c security policy. Not sure if it's related but I've never seen that message before trying to boot up from a USB.
in reply to BrianKrebs
mastodon - Link to source

BrianKrebs

Look, compromises happen to everyone. I have received a ton of private messages asking if I'm okay. But the reality is that I stopped using Windoze a long time ago and this was a kind of one-off thing where I was trying to re-image an old system anyway (away from Windoze).
in reply to BrianKrebs
mastodon - Link to source

Emory L.

I feel extremely lucky considering I have two Windows workstations and one is for ML and Gaming so perfect patient zero situation which is why it's sharing a vlan with the other embarrassment, arguably worse: windows 10 set to danger-cart mode 🚨 to run without seatbelts and use unsigned drivers.

abandonware is the default software license in amateur radio. 🪊 🪊

in reply to BrianKrebs
mastodon - Link to source

Liam Lynch

I have used Rufus many times in the past @briankrebs and never had an issue, but clearly if you are seeing these additional installs something has compromised it.
I usually grab the portable version and the last one I downloaded was 4.14 back in May, which worked as expected and still does.
So it would seem that 4.15 is not to be trusted.
@BrianKrebs
in reply to BrianKrebs
mastodon - Link to source

snornik

while i get that point.... without linux alot are not used to console/tui tools and need a gui. i dont think its funny cause as a nerd your probably overwrite the whole windows partition anyway, pretty soon. as a newcomer you want to try out linux on a 2nd device and then this is not as funny anymore.
in reply to BrianKrebs
mastodon - Link to source

BrianKrebs

I've been made aware of a post from someone representing Rufus who says I'm very confused about this post. I've reported that Windows Defender went bananas after I installed Rufus on a Windows 11 device. It immediately popped up warnings about hacktools and trojans being installed while it was installing. I wish I had a record of it but I nuked everything after the alerts.

github.com/pbatard/rufus/issues/3064

Brian Krebs' post about official Rufus being malware · Issue #3064 · pbatard/rufus

I am referring to https://infosec.exchange/@briankrebs/117492243281099842 and especially this statement: Not sure who needs to know this, but if you download and install the Windows version of Rufu...
pbatard (GitHub)
in reply to BrianKrebs
mastodon - Link to source

Richard "mtfnpy" Harman (he/him)

The media in this post is not displayed to visitors. To view it, please go to the original post.
There are some rather ... possessive communities around USB boot image builders, I forget if it was rufus or ventoy or what, but long story short: if you badmouth the product, the sealions. Dear god, the sealions.
Esta entrada fue editada (hoy, 3:13)
in reply to Richard "mtfnpy" Harman (he/him)
mastodon - Link to source

Will Dormann

The media in this post is not displayed to visitors. To view it, please go to the original post.
@xabean
I remember reporting a vulnerability to the Rufus developer, and he was quite rude and condescending in response.

ER: Avoid prompts that users may not properly intepret on update signature validation · Issue #1009 · pbatard/rufus

Checklist I looked at https://github.com/pbatard/rufus/wiki/FAQ to see if my question has already been answered. I performed a search in the issue tracker for similar issues, using keywords relevan...
wdormann (GitHub)
@Richard "mtfnpy" Harman (he/him)
in reply to Will Dormann
mastodon - Link to source

Koos Pol 🇺🇦

@wdormann I just read the full thread, yes the full threat, and god what an insufferable attitude from this guy. I'm convinced he'd manage to disagree with the Pope on Catholicism. @xabean @briankrebs I
@Richard "mtfnpy" Harman (he/him) @BrianKrebs @Will Dormann
in reply to Will Dormann
mastodon - Link to source

blindlynx

@wdormann @xabean Well, his bio on Github starts with this sentence:

"A Free Software Developer, with more decades of experience than we care to admit"

I wonder if he's Andrew Kelley's estranged brother.

@Richard "mtfnpy" Harman (he/him) @Will Dormann
Esta entrada fue editada (hoy, 7:02)
in reply to BrianKrebs
mastodon - Link to source

rx13

I think it's worth noting, a long history of actors buying ad-space at the top of search engines.

The url in the ad appears legitimate (it's visually the legitimate URL), but when clicked goes to a different url. I'm not positive that's the case here, but it's been done 100s of times for 100s of other tools (AI tool installers, chrome installs, etc), and there is zero visual indication it's an ad directing to the wrong domain.

Thanks to LLMs, the landing pages have also gotten much better at copying the real pages too.

Making it more difficult, is that ads don't always present themselves, so seeing it a 2nd time may take 100s of visits

Or maybe it really was a compromised rufus domain🤷

in reply to Hambone Fakenamington
mastodon - Link to source

rx13

@CenturyAvocado

Does seem to be quite a lot of look alike domains in the last week, so this is my best guess on your experience

urlscan.io/search/#domain.keyword%3A*rufus*

Search - urlscan.io

urlscan.io - Website scanner for suspicious and malicious URLs
urlscan.io
@Hambone Fakenamington
in reply to BrianKrebs
akkoma - Link to source

Michael Ilsaas

please be more specific, you're coming off like a rambling tech illiterate that complains that the PC is broken, and it turns out there is no internet connection. Did you check the checkum of the installer/exe? What ISO did you attempt to write? Can you name one single instance of malware included in the infection?
in reply to Michael Ilsaas
mastodon - Link to source

Death by Lambda

@mikeri

You have 4 posts, and 25% of them are ragging on one the most respected and savvy tech journalists of all time..?

club.shish.org/objects/e261c240-d528-4f62-91af-acf1f32dd53f

Good job man. Really good job!

@briankrebs

Michael Ilsaas

2026-10-24 04:04:04

akkoma - Link to source

please be more specific, you're coming off like a rambling tech illiterate that complains that the PC is broken, and it turns out there is no internet connection. Did you check the checkum of the installer/exe? What ISO did you attempt to write? Can you name one single instance of malware included in the infection?

@BrianKrebs @Michael Ilsaas
Esta entrada fue editada (hoy, 9:13)
in reply to BrianKrebs
mastodon - Link to source

VessOnSecurity

Brian, I've never used Rufus before but I've looked at the executable that is downloadable from their site (the first one, rufus-4.15.exe) and I assure you that it is not malicious. It's possible that Windows Defender is throwing some kind of false positive (although simply running the executable did not produce any alerts here) but I'd need more precise information, in order to determine what exactly is happening.

Could you please document the exact steps one needs to perform, in order to reproduce your results? Which executable did you download? When did the alert pop up? What parameters did you select?

The thing's UI is awful, BTW - apparently you have to click on what looks like a dropdown listbox, in order to open a file selection menu, WTF.

in reply to BrianKrebs
mastodon - Link to source

Sindarina, Edge Case Detective

The official one downloaded via github.com/pbatard/rufus or rufus.ie? 🤨

GitHub - pbatard/rufus: The Reliable USB Formatting Utility

The Reliable USB Formatting Utility. Contribute to pbatard/rufus development by creating an account on GitHub.
GitHub
in reply to BrianKrebs
mastodon - Link to source

John Breen

So I hate to be snarky, but "dd" has been there all along people. Having to install an entire 3rd party application, for something that the OS should have stable, reliable methods for, to format a storage device and transfer a standard filesystem image to it, is intolerable. But it's Windows...depends on curl to download its own updates...
in reply to John Breen
akkoma - Link to source

aetios who is back in europe

@jab01701mid Unfortunately dd-ing windows images to boot sticks just ends up with an unbootable image.

Ventoy is pretty decent, and i have to admit the Windows Media Creation Tool works well, if you have to work from Windows.

@John Breen
in reply to Cassandrich
pleroma - Link to source

Gantua

@dalias @aetios @jab01701mid IIRC Windows refuses to use a rootfs on a removable media (or what it perceives as one).

This was fun during the compact flash era, manufacturers had to cheat to work around this limitation.

@Cassandrich @aetios who is back in europe @John Breen
in reply to John Breen
glitchsoc - Link to source

Lunaphied

@jab01701mid ironically the official windows installer builder does support writing to USB directly but it doesn't have the customisation that Rufus offers for slipstreaming and deshittifying. But for other non-Windows ISOs? Yeah.

Though it should be noted that for awhile now a lot of images are designed such that if you mount them and copy their contents to the USB partition bare it'll work just fine and this can be done from stock Windows

@John Breen
in reply to BrianKrebs
mastodon - Link to source

cubeos

Do you happen to have the hash of the file you received? I just pulled github.com/pbatard/rufus/releases/download/v4.15/rufus-4.15.exe (which is also the link that is on rufus.ie) and it gave me 84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106 rufus-4.15.exe which is clean according to virustotal.
in reply to Ichinin ✅🎯🙄
mastodon - Link to source

Dr. Bruce Simpson

@Ichinin I once owned a USB3 2.5" SATA HDD disk enclosure with PIN entry for AES-256 in its microcontroller (not trusting ATA security) and selectable ISO/image boot also presented as USB Mass Storage LUNs. This is not that, clearly, but a fair amount of "Trust me bro" with the Taiwanese vendor nonetheless.
@Ichinin ✅🎯🙄
in reply to BrianKrebs
hometown - Link to source

Alexander Bochmann

Yeah wait, forget what I wrote in this post before. Realtime protection being disabled seems to be standard behaviour at least for for the W10 version of Windows Sandbox? There's just no AV providers installed...
Somehow never noticed when using that thing before 🤦‍♂️
Sorry for the noise.
Esta entrada fue editada (ayer, 23:48)
in reply to Alexander Bochmann
mastodon - Link to source

BrianKrebs

@galaxis yes if you trust WindowsDefender to defend you against this attack you will be sorely mistaken. It successfully detects all the malware installed, but it acts weird and sends notifications about malware detections even though its own interface says a scan is clean.
@Alexander Bochmann
in reply to BrianKrebs
mastodon - Link to source

Stu

I'm not usually on Windows, but looking at my /Downloads I must have fetched and used it back in July, so I have this build.

I grabbed Malwarebytes (for want of something to do) and ran it before (clean) and with Rufus running (clean).

One thing I did note - I genuinely don't recall it fetching any additional files until you select an ISO, it reads it, and determines if it needs extra files which is mentioned on the page linked below.

github.com/pbatard/rufus/wiki/Security

Security

The Reliable USB Formatting Utility. Contribute to pbatard/rufus development by creating an account on GitHub.
GitHub
in reply to BrianKrebs
mastodon - Link to source

aphantastic

I've never been able to get Rufus to work. Instead, I've been an avid user of Universal USB Installer for decades: en.wikipedia.org/wiki/Universal_USB_Installer

For years now it has Ventoy, so it's even better than it was originally.

Universal USB Installer - Wikipedia

Contributors to Wikimedia projects (Wikimedia Foundation, Inc.)
in reply to BrianKrebs
mastodon - Link to source

Fritz Adalis

I didn't run it, but I downloaded the x64 installer and portable from rufus.ie and it's signed and the sha256 matches the download page. It looks like the 'extras' download checks a hardcoded checksum database too. Do you still have the version you downloaded? Maybe check the sha256, or if you're tired of it consider sending to steveshockley.99 on signal.
in reply to BrianKrebs
mastodon - Link to source

Lina Inverse

When you say you "installed" rufus, did it prompt you for some kind of installation? Or did the startup match what was in the any.run analysis that was submitted? I ask because rufus doesn't really have an install, you just run it and go. Trying to forensically put this back together is going to require a bit more info if you can provide it. I don't suppose, since you are wiping that computer, that you saved anything at all from it?
in reply to BrianKrebs
mastodon - Link to source

Christian Gudrian

Here’s another user who faced malware alerts while using Rufus. They were flashing Kali Linux, though, and it’s ISO file got scanned along the process.
reddit.com/r/Hacking_Tutorials/comments/1t62lrs/virus_in_rufus_while_flashing_usb_for_kali/

Reddit

Virus in Rufus while flashing USB for Kali? byu/avinash__singh inHacking_Tutorials
avinash__singh (reddit)
in reply to BrianKrebs
mastodon - Link to source

Blue-Eyed Vibe-Checker

It is possible Windows flags it with a false positive.
Rufus can bypass Windows 11's minimum system requirements lock-out, and like an anti-DRM crack for games causes false positives due to the nature of the workaround, Rufus may well be in the same boat.

Haven't used Rufus for a long time, since I installed CachyOS by extracting the files from the ISO since I couldn't write it to a USB for some reason, but it may be microsoft's way of trying to block workarounds for Windows 11.

in reply to BrianKrebs
qoto - Link to source

volkris

The drama itself confirms my ~~bias~~ claim that we never should have normalized and even encouraged such patterns of downloading additional components at install- or run-time.

Kids today... there was a good reason we didn't do it like that before!

(there's a joke in there about not having the ubiquitous internet before)

in reply to BrianKrebs
mastodon - Link to source

kabutor

Rufus inspect the iso you pass and if it find outdated efi drivers it ask you if you want to replace it with newer versions. That can be a problem because you have to flash the bios with the new certificates. I also found some HP that refuses to boot with the old certificates, you have to disable Secure Boot to install it, to update it later

It also could be that the site was compromised, but if you nuked everything then, who knows now.

in reply to BrianKrebs
mastodon - Link to source

Adrian Kentleton

I have always downloaded and used the portable version of Rufus, on a W11 PC, and have had no reason to suspect it contains malware. When I update to later versions nowadays, I use the the version from 'PortableApps': portableapps.com/apps/utilities/rufus-portable

Rufus Portable | PortableApps.com

Rufus is a small utility that helps format and create bootable USB flash drives, such as USB keys/pendrives, memory sticks, etc.
PortableApps.com - Portable software for USB, portable, and cloud drives
in reply to BrianKrebs
mastodon - Link to source

Kiernian

It's been 6+ years sice I used rufus, but I recall the vpx or upx (forget the acronym) packer causing av to throw more false positives than an obscenely nested zip archive with an .scr in it.

As I understood it, this is a "the heuristics are frequently as dumb as the author of rufus is stubborn" situation, because he uses a bunch of tools that are likely to get flagged, uses stuff unsigned, and refuses to change.

Whether there's an additional, newer component to this isn't unlikely, but rufus throwing up skads of alarm bells is nothing new in the windows world.

For a while even microsoft official documentation recommended it for imaging surface tablets even though defender was screaming bloody murder about it the whole time.