2026-10-23 21:02 UTC
Not sure who needs to know this, but if you download and install the Windows version of Rufus, the free software for writing ISO images to USB/CD-ROM, your PC will end up with about 100 trojans.
Edit: The site I downloaded from was rufus[.]ie which is apparently the official site. During installation, the software threw up a couple of rather verbose messages saying it needed to download additional components.
Replies (4)
-
@Ichinin@infosec.exchange 2026-10-23 22:05
@briankrebs@infosec.exchange ventoy is better. Boot the iso you want from a menu.
-
@briankrebs@infosec.exchange 2026-10-23 21:54
A kind reader submitted the Rufus installer to any.run, a sandbox which walks through the installation of software to find malware that gets installed only *AFTER* the executable is clicked. You can see exactly all of the post-install prompts to download additional software that I also saw. https://infosec.exchange/@jordinki/117492425049116266
-
@briankrebs@infosec.exchange 2026-10-23 21:10
However, in my defense Google's default search results list rufus[.]ie as the authoritative site
-
@briankrebs@infosec.exchange 2026-10-24 01:39
Is it ironic that your Windoze PC gets infected while trying to download a file that allows you to write an installable Linux ISO? I think very much so and I'm still LOLing about it.