r/archlinux 2d ago

DISCUSSION Ventoy might be malware

Source: https://wiki.archlinux.org/title/Ventoy

Ventoy might contain backdoors or other malicious code:

  • The author(s?) long refused to react on questions about the source code for the precompiled code inside their git repository.
  • They long refused to react on questions about the security risks.
  • When an answer was finally given, it boiled down to a simple "There is no reason to assume that we would have placed malware inside."
  • Again after a really long time the authors finally mentioned what other source code they used to generate some−but not all−of the pre-compiled code. They did not mention the build methods and refused to prove that this really was the used source code.
  • The real identities of the authors is unknown.

EDIT: The paragraph written on this archwiki page is by large consensus biased and mentions an old controversy, the wikipedia article on Ventoy has a more neutral explanation of the problem
https://en.wikipedia.org/wiki/Ventoy

168 Upvotes

181 comments sorted by

108

u/RAMChYLD 2d ago

Well, why not take Ghidra to Ventoy and tell us what you find?

80

u/New-Anybody-6206 2d ago

because the whole story is horseshit

14

u/Ybalrid 1d ago

This require skills in reverse engineering and x86_64 assembly programming

-10

u/believeinlain 1d ago

I mean, Ghidra has a built in decompiler, so really you just need to be able to read C

unless it's obfuscated or otherwise doing something weird

13

u/Ybalrid 1d ago

Well... Have you ever read C code generated from such decompiler though?

unless it's obfuscated

Most software is compiled with stripped symbols and optimiziation turned on (becuase performance and code size). So most software is somewhat obfuscated.

If you write a non-trivial C program (and not even talking about C++ here, which create a lot of additional... stuff), you compile with a modern compiler with settings set in a way that it's ready for release, then you decompile that, you will get something that looks relatively far from the original.

I am not saying it's not understandable, not at all. But what I am saying is that, the decompiled output is an help, not a magic bullet.

Very old code, not very optimized, like Nintendo 64 video games (that was a MIPS or RISC chip of some kind glued to weird hardware on this console, but this put aside) have required substantial amount of reverse engineering work to get to the state we can actually do something fun with the "decompiled" source code.

1

u/believeinlain 1d ago

yes, I work with Ghidra every day, it's my job

the output isn't that hard to read, like you said

my point was that you don't need to read assembly

3

u/Orlha 1d ago

Man

2

u/Dimtri-The-Anarchist 18h ago

Only spent an hour on it in IDA, but the Ventoy executables show no behavior that aligns with any malware. I should also say that the Ventoy executables are not signed; they are not given any automatic "passes" by Microsoft, yet none of them flag any antiviruses. People do love to hate on Windows Defender, but as far as antiviruses go, it is very competent, and unless the Ventoy devs were reverse-engineering pros with a Windows Defender 0-day that works on every version, they are not getting past Defender with any malicious code in any of their files.

308

u/jort93 2d ago edited 2d ago

Theres just some binary blobs in there

Afaik nobody actually found any proof for there being any malware.

I wouldn't say it boiled down to a simple "There is no reason to assume that we would have placed malware inside."
The answer is quite extensive https://github.com/ventoy/Ventoy/issues/3224
I'd say it comes down to "compiling all of it from source is too much effort"

86

u/47th-Element 2d ago

First time I feel like arch wiki was a bit misleading. Cause yeah after reading this, it is not a simple "no reason to assume there is malware" answer.

131

u/jort93 2d ago

People forget, it's literally one dude making this, he added 540.000 lines to the project. Next largest contributor added 400 lines, not 400 thousand, just 400.

If people are willing to help him get rid of those blobs I am sure he wouldn't mind.

93

u/jort93 2d ago edited 2d ago

The guy that added the warning to the archwiki is also the same guy that said in the issue i posted

the developer tells people he is "Hailong Sun" which is a very common name in China (and good to use as fake identity)

China is known as large source of malware

So hardly unbiased.

Well, or rather i would assume so, as one is named ngaro and the other one is named garo.

https://wiki.archlinux.org/index.php?title=Ventoy&diff=871000&oldid=812540
https://github.com/ventoy/Ventoy/issues/3224#issuecomment-5058767461

24

u/Padgriffin 1d ago

the developer tells people he is "Hailong Sun" which is a very common name in China (and good to use as fake identity)

Have we considered that it might actually be his name

20

u/jort93 1d ago

Apparently not lol.

The developed doesn't address these accusations, which honestly is fair, I wouldn't wanna prove it's my real name to some random dude either.

15

u/Padgriffin 1d ago

China also has a billion people, so even relatively uncommon names will still end up with thousands of hits, which is made worse by romanization removing tones and making names that were different in Chinese into the same ones in English

12

u/PDXPuma 1d ago

It's a very common name in China so someone named it is suspicious?

LOL. What weird ass circular logic.

13

u/[deleted] 2d ago

[deleted]

13

u/jort93 2d ago

He linked the wikipedia page in one of his comments as well, wouldn't be surprised if he edited it too. Although he might use a different name/edit without logging in.

11

u/[deleted] 2d ago

[deleted]

12

u/jort93 2d ago

I am not saying I have an proof of this, but I am saying it would be "on brand" since he already edited the archwiki.

4

u/czerilla 1d ago

To quote another ..interested party on this:

Whether Ventoy contains malware these Wikipedia edits are made by the same person or not is a different question that I can not answer with certainty. But there are certainly some important factors to consider

2

u/EuphoricNeckbeard 1d ago

The Wikipedia page doesn't follow any standards for sourcing or NPOV. It links a Reddit comment as a source for god's sake lol

47

u/Helmic 2d ago

oh, so this guy's just being fucking racist then.

after the xz thing i absolutely want ventoy to move towards fully compiling everything from source, but like yeah it's mostly one guy and nobody's really helping.

34

u/jort93 2d ago

I mean, id do the same thing if I made this by myself, download the binaries for the external tools I use and compile my own stuff.

If people care so much to compile everything from source, they can do it themselves. In the issue I linked, the maintainer described where to obtain the source code for every binary in the repo. If someone wants to fork it and compile it from scratch nobody is stopping them.

25

u/nethingelse 2d ago

Yeah, it sounds like he's open to PRs on this too, so it wouldn't even need to be a hard fork. Just not something he's interested in prioritizing as a solo maintainer, as it's not important to him, which I get.

3

u/headedbranch225 1d ago

Yeah, I remember last time this came up and everyone got pissed about it and read through it and it is completely reasonable

11

u/Dependent_House7077 2d ago

looking at that list, it would be an absolute headache to build all this.

at least someone is attempting to tackle that.

10

u/mindstormer12 1d ago

Basically, someone decides to hold a dev to a ridiculously high standard for some reason yet there are plenty of examples where they are already using hardware/software that also involve binary blobs, lack of communication or transparency, etc. and more importantly developed by people who have far more influence and responsibility to the users than this one dev for a small project.

1

u/jort93 1d ago

I think that sums it up lol.

-11

u/lordkoba 2d ago

  I'd say it comes down to "compiling all of it from source is too much effort"

it’s “too much effort” once. they just have technical debt in their build system.

the reason on why they won’t fix it doesn’t matter, may be because it’s a chore, maybe there’s malware, the point is that it’s still a massive red flag

the software cannot be recommended in good conscience

20

u/jort93 2d ago edited 2d ago

It's one dude making this software, he probably simply not have the time to change it. If you don't like it you can use something else. Or so it yourself and merge/fork it.

I feel like most people use a bunch of binary blobs. Like flatpaks, codecs, drivers, all sorts of stuff.

And the claims they his name is somehow a fake name are quite crazy.

Why make up some stuff about malware and fake identities, why not just put "it contains binary blobs of other projects" into the section and be done with it? Maybe link the GitHub issue regarding it.

Also, known issues section is normally at the end, not at the beginning.

3

u/iTrooz_ 1d ago

If you don't like it you can use something else

This is exactly what he said

6

u/jort93 1d ago edited 1d ago

Why claim that it may contain malware, tho? Just say it contains blobs and let people come to their conclusions whether or not they want to use it. Chances are, 99% of people use some blobs on their system, be it flatpaks, drivers, codecs or whatever else. All of them could contain malware.

Most people will downloads the entire thing as a blob rather than compile it as well.

And, btw. one of the altenatives listed on the arch wiki contains binary blobs too.

1

u/iTrooz_ 1d ago

I don't see where they said it is 100% malware, I see a comment where they said it could be malware, which, fair, I share that opinion.

Also, I think there's a difference between a blob in an isolated userspace app (flatpak) and a "kernelspace" one (and yes, Linux has blobs, but they come from more reputable sources so less problematic)

7

u/jort93 1d ago

This section should be at the bottom for one, like they are on other archwiki page.

And then there are claims like his identity being unknown, like, what is he supposed to do, post his passport?

There is a lot of software that has blobs in it but I've never seen a section like this.

Plus, the person that edited the archwiki is also involved in the discussion on the GitHub, which makes the neutrality questionable.

2

u/jaaval 2d ago

Though I think it's good to be aware of these cases.

Single developer who doesn't have the time, already binary blobs in a very large project. Even if there is nothing malicious in it now this seems like a good target for an attack in the future.

1

u/lordkoba 1d ago

It's one dude making this software, he probably simply not have the time to change it

I mean it's fine, I'm not pissed at the guy and no one is forcing him to do anything. I know that being an OSS maintainer is a thankless unpaid job.

That said, my point still stands, you cannot recommend the software over transparent open source alternatives, "probably" doesn't cut it.

2

u/jort93 1d ago

Anyone could fork it, or send a pull request. In the issue i linked he gave people all the information they'd need to set it up. It is the most extensive project in this multiboot usb sorta field.

But nobody does, because it is quite the endeavour.

61

u/EmberQuill 2d ago

Old news. There was a big kerfuffle about this back in March. The general consensus after things settled down was that it's probably fine, but no guarantees because the firmware blobs are hard to reproduce/verify.

-14

u/donp1ano 1d ago

"probably fine"

yes, probably. im not taking any risks for software that **installs** my OS, since that would be perfect for setting up malware at a very low level. ventoy is convenient, but id rather flash a USB stick

21

u/Ybalrid 1d ago

if your goal is to install one operating system, you probaly should just flash a USB stick and that's about it.

Ventoy is useful if you want to collect and use a large number of bootable live environment.

-5

u/ccAbstraction 1d ago edited 1d ago

Which mean all my machines could be compromised no matter what OS I'm installing! Yay!

Edit: Ventoy is also useful if you want to keep using your flash drive as a flash drive, while being able to boot from live USBs.

-1

u/headedbranch225 1d ago

If you really care so much about it just build it from source then

6

u/EmberQuill 1d ago

That's the neat part: you can't. Being unable to reproduce the builds is in fact the core of the entire controversy.

2

u/ccAbstraction 1d ago

I'm not saying Ventoy is malware, but that if Ventoy were to be compromised, the risk would be rootkit levels of enormous, and because of people tend to use ventoy across multiple machines with multiple OSes, pervasive. If Ventoy had a rootkit nearly every computer in my house would be compromised. It doesn't help anyone to downplay the potential severity of supply chain attack on stuff like Ventoy, Rufus, grub, systemd-boot etc.

2

u/ProdigySim 1d ago

then don't

3

u/EmberQuill 1d ago

"Probably" wasn't enough for me either and I stopped using it. I mostly just meant to point out that you're like four months late to the drama.

3

u/iTrooz_ 1d ago

Yeah, I think people don't realize how dangerous this could be ? It could secretly be altering all OS installations it does

7

u/AppointmentNearby161 1d ago

It could, but you could also compare the checksum of the ventoy installed base system with a base system installed from a known clean iso.

1

u/iTrooz_ 1d ago

How would you go about it ? Checksum every file in the installed filesystem ?

2

u/AppointmentNearby161 1d ago

Or tarball the whole install/top level directories and checksum the tarballs.

0

u/donp1ano 1d ago

ok, then why dont we see people that did that to confirm ventoy is safe?

im not saying its not. im just saying im not gonna take that risk just for convenience

13

u/ProdigySim 1d ago

Because doing that wouldn't prove that it's not malicious; it would prove that one single installation is not infected.

This kind of allegation would have a really high cost to concretely disprove.

4

u/AppointmentNearby161 1d ago

Exactly. It is pretty easy to prove it does not corrupt ALL installs, but without source code we cannot prove it does not corrupt ANY installs. Ventoy becomes more useful as the number of ISOs you use increases, which makes verifying them more costly.

186

u/Scxox 2d ago

bruh stop spreading FUD, the author has acknowledged this numerous times and has accepted suggestions to fix these. the currently proposed solution is labor intensive.

its an open source project, if you want things to move faster then you should contribute, not bitch and whine about the dev who does this for free

48

u/we_come_at_night 1d ago

bitching and whining is less labor intensive and doesn't require a functioning brain, actively contributing to a FOSS project on the other hand is pretty hands-on, and you have to know some stuff, can't just wish the code to existence.

-17

u/Arkaid11 2d ago

If the source is hidden then it's NOT an open source project, and you can't contribute easily

50

u/Scxox 2d ago

those blobs are not compiled from the source code of ventoy, they are binary blobs from other projects such as busybox.

ventoy itself is 100% open source

19

u/TDplay 1d ago

The Ventoy author has provided a complete list of the blobs, as well as build instructions for each.

It's certainly not convenient to build from source, but the open-source definition never mentions convenience. It is possible to build Ventoy from source, and hence it satisfies the requirement to provide source code.

It also seems like the maintainer of the understandably angry-comment-filled PKGBUILD for Ventoy is trying to replace all the blobs by building from source.

0

u/Arkaid11 1d ago

Lol at "just read the PKGBUILD" people. Look at my PKGBUILD dawg I could be downloading STUXNET in plain text and I wouldn't notice

-7

u/iTrooz_ 1d ago

Where is he "bitching" ? He helped bring the issue to light, I'll try to contribute to it in the next few months because of it

11

u/Scxox 1d ago

the issue has been brought up ages ago. this is old news. op is just instigating shit again, same as whoever phrased the situation that way in the arch wiki

132

u/dadnothere 2d ago

"Ventoy might be malware because it has pre-compiled files 🥺"

said the person with 900 fatpaks installed from who-knows-where.

27

u/Kamal2q 1d ago

I like the term fatpak

13

u/0xc0ffea 1d ago

Painfully accurate in more ways than one.

5

u/TWB0109 1d ago

As a fan of flatpaks, i do too lmao

3

u/iTrooz_ 1d ago

Who has such a configuration? All the flatpaks I use are from the official repos, which either build packages from source or from upstream

2

u/wyn10 1d ago

New Linux users who have no idea what they're doing. Where they find this stuff, no clue. Personally I'm native all thw way.

0

u/iTrooz_ 1d ago

Are there really third party repos that don't only package their own apps ? (Idc about repos from a software author, I trust the author of the software anyway)

3

u/Any_Fox5126 1d ago

Wow! That's a lot of fallacies packed into just a few words. And it has that many upvotes? This community is truly pitiful.

-1

u/Orlha 1d ago

Well that’s a huge assumption. Plenty of people avoid flatpaks, I personally have none.

1

u/Reypatey 1d ago

Noob here.

I could only find orca slicer in flatpak, it's the only one I have installed. Is that a bad thing? What else could I do?

7

u/Maximum-Bobcat5612 1d ago

If you're new then keep in mind that people like stirring shit in the linux community. It's famous for witch hunting people on whims.

Look at how much discussion there is in the repo: https://github.com/ventoy/Ventoy/issues/3224

Also consider how the OP posted this accusation 13 hours ago and has not responded to anyone.

1

u/nathan22211 1d ago

orca slicer has the file in realeses but I usually just grab it from the AUR since I can handly get the flatpak file to work

1

u/Majestic-Coat3855 15h ago

Doesn't matter bro unless you're running on a 128gb ssd

1

u/TheGamerForeverGFE 17h ago

Also reminder that shit like the Steam client is not open source.

0

u/Commercial-Worth7301 1d ago

Flatpak até vai, mas aí vai ver, e o cidadão que não confia no ventoy é o mesmo que gabaritou a lista de pacotes infectados do AUR, e que não satisfeito ainda baixou o vírus do "hyprland-fixed" no AUR

15

u/tjj1055 1d ago

post proof of it being malware then. gonna keep using it because its more convenient than using one usb for one iso.

40

u/mindstormer12 2d ago

Do you question all the binary blobs for your hardware to work too?

10

u/iTrooz_ 1d ago

Trust isn't a black or white thing, I can decide to trust some entities out of necessity without wanting to trust anyone..

-8

u/ZorbaTHut 1d ago

Yes? Do you not?

18

u/Ybalrid 1d ago

Do you question the code in the security processor embedded in your Intel or AMD chip?

Do you question the microcode inside your modern CPU?

Do you question the non upgradable non operating system loaded firmware in all the devices within your computer (controllers for your drives, for your network hardware)?

Do you question the electronic control unit that makes the engine of your car actually able to work (that is probably something modern with electronic injection and a catalytic converter and all those funny sensors and computers in it)?

Do you question the source code in the microcontroller that drive the logic that makes your microwave oven work?

Do you question the baseband and SIM card inside your phone? Those are external computers to whatever runs your OS there, and they touch pretty much everything you do on the cell network.

Do you question the very fabric of reality itself?

-3

u/ZorbaTHut 1d ago

Do you question the code in the security processor embedded in your Intel or AMD chip?

Yes.

Do you question the microcode inside your modern CPU?

Yes.

Do you question the non upgradable non operating system loaded firmware in all the devices within your computer (controllers for your drives, for your network hardware)?

Yes.

Do you question the electronic control unit that makes the engine of your car (that is probably something modern with electronic injection and a catalytic converter and all those funny sensors and computers in it)?

Yes.

Do you question the source code in the microcontroller that drive the logic that makes your microwave oven work?

Yes.

Do you question the baseband and SIM card inside your phone? Those are external computers to whatever runs your OS there, and they touch pretty much everything you do on the cell network.

Yes.

Do you question the very fabric of reality itself?

Yes.

Though we haven't found any security holes in that one yet. But the way things are going it's only a matter of time.


I actually give it a 50/50 that your reply was an intentional setup for this, in which case, well done.

But if not . . . you should maybe be a little more aware of how many software exploits are out there waiting to be found.

9

u/Ybalrid 1d ago

I'm broadly in the biz of "making software", and very well placed to know that there's problem on each layers of the stack of turtles that we call "reality" 🤭

-9

u/ZorbaTHut 1d ago

Yeah, pretty much :V

And it is fair to note that while I question all this stuff, I also grudgingly tolerate it because I don't really have a practical choice.

But gosh I'd really like a choice.

And if I can avoid some China-originated opaque binary blobs by using a slightly different bootloader on my USB sticks . . . yeah, okay, guess I'm gonna do that then.

7

u/Ybalrid 1d ago

what has china anything to do with anything here?

-6

u/ZorbaTHut 1d ago

The Ventoy developer is (probably) in China and I don't trust the Chinese government; in terms of "interest in compromising computers", "ability to force their citizens to help", and "ability to hide the fact that this is all going on", they're very high on every axis, to an extent that IMO no other country is.

I don't mind Chinese people. I just don't trust the Chinese government.

-9

u/Any_Fox5126 1d ago

OP didn't say he distrusts all blobs, but he did explain why he doesn't trust the authors of ventoy. Pay attention.

5

u/mindstormer12 1d ago edited 1d ago

And the implication is that they do not hold the same high standard to the developers of these other blobs for hardware who have greater influence and responsibility to their users than some optional software project. Practically everyone is running on what might be malware then. Use your brain.

Also, OP's concerns are already addressed in a variety of discussions including open pinned issue. If that's not satisfactory, don't use the software, lmao. They are not obligated to provide personal identification or prove anything. Most people don't assume their routers, PCs, phones, etc. running off proprietary firmware to be at risk of malware nor do they cry about it on the forums even if it's technically possible. If you're wearing the tin foil hat, you would be looking at hardware that supports open-source only and not spread FUD based on double standards.

-4

u/Any_Fox5126 1d ago

No. It makes no sense to compare the trustworthiness of well‑known devs or big‑company teams with complete strangers. The fact that it is optional software actually means there is even less scrutiny.

4

u/mindstormer12 1d ago

No shit, you're using a free product.

0

u/Any_Fox5126 1d ago edited 1d ago

That's irrelevant. There's plenty of trustworthy open-source software, and it's usually not because of the reputation of its authors, but because of its transparency. The point here is that ventoy lacks both.

4

u/mindstormer12 1d ago edited 1d ago

No where did I claim Ventoy is trustworthy. I merely claimed that if you're worried about this, you should actually worry about the proprietary blob running on the hardware you paid for and prioritize less on accusing a particular project that is free, itself 100% open-source. I pointed out double standards as the issue.

Also, have you actually looked into the discussions about this issue on their repo page or are you merely looking to pick at battle based on misleading premises set by the OP? They even pinned the primary one and it's met with overwhelming positivity by the public. The author is open to accepting contributions. Their 100% free and open-source project depends on proprietary blobs because of lack of manpower, and they welcome any that addresses this issue. What exactly do you expect more from them?

Sigh, pay attention.

-1

u/Any_Fox5126 1d ago

You never said it was trustworthy, but that’s hardly the point after several comments defending ventoy and aggressively attacking the OP for raising a reasonable concern. If you acknowledge that even the devs themselves recognize the importance of the issue, then it becomes pretty clear how absurd it is to focus your replies on attacking the person pointing it out and mocking the concern itself.

The irony is that you accuse the OP of a double standard, yet depending on what suits your argument it’s either "it’s a free product" or "hardware blobs are more deserving of scrutiny". If these are different categories, then demanding that they be treated as equivalent makes no sense in the first place. And either way, you’re just repeating a basic whataboutism.

It’s especially incoherent to call it 100% open source while admitting it depends on proprietary blobs. With your argument, logic is clearly working overtime.

2

u/mindstormer12 1d ago

You're way too emotional and fixated on attempting to argue against my points when they are not relevant to OP's issue at all. I already proved OP's claims are misleading by pointing out the dev has addressed the concerns adequately in a pinned github post on their repo as well made it clear how double standards are the issue.

You're not longer worth my time anymore, sorry. Should have been obvious from your condescending initial reply to my top comment without any of your own supporting thoughts. You can do better.

1

u/Any_Fox5126 1d ago

You're way too emotional

How ironic that you’re making a personal judgment about my emotional state right after several paragraphs of logical analysis addressing your inconsistencies point by point.

and fixated on attempting to argue against my points when they are not relevant to OP's issue at all. (...) as well made it clear how double standards are the issue.

The issue isn't your criticism of the OP's standards. You introduced that argument yourself, derailing the issue. The existence of contradictory standards does not even invalidate the underlying concern.

. I already proved OP's claims are misleading by pointing out the dev has addressed the concerns adequately in a pinned github post on their repo

That doesn't prove it.

You're not longer worth my time anymore

Likewise, I'll leave it here. Your theatrical exit was a nice touch, though.

Should have been obvious from your condescending

True, but you're being hypocritical, again. I'll leave you to reflect on your consistency.

31

u/Kurse71 2d ago

Maybe present some proof, not just rumors or conjecture. Come on , man, what's this?

49

u/47th-Element 2d ago

That's a shame, I like ventoy. But here's the question that presents itself, is there an actively maintained fork/clone/alternative to ventoy that is more open source than ventoy?

20

u/Excellent-Copy-2688 2d ago

https://wiki.archlinux.org/title/Multiboot_USB_drive#Automated_tools
there are some apparently, not sure if there replicate complete functionality of ventoy, but you can check for yourself

4

u/Charming_Professor53 1d ago

I'm a big fan of MultiOS-USB. It supports Secure Boot and booting Windows images. The multiboot approach is also a lot more puristical using a very lightly modified version of Grub (Ventoy esentially "hijacks early boot" from what I heard/understood). The only downside is that Ubuntu(-based distro) images can't boot from exFAT since Ubuntu live images don't include exFAT drivers for some stupid reason, but Ubuntu images are too large (>4 GiB) for FAT.

6

u/Outrageous-Machine-5 2d ago

isn't ventoy using grub under the hood

3

u/imactuallynotalright 1d ago

ventoy is a convoluted hack that shouldn't work, but nothing works as well as ventoy if you need windows support. The alternatives are Linux only.

1

u/Vova_xX 1d ago

personally, I have never had problems with unetbootin or Balena Etcher

39

u/mindstormer12 2d ago

Yes, there's always risk to using software that uses pre-compiled code. How is this Arch Linux-specific?

25

u/SmallRocks 2d ago

“How is this Arch specific?”

From Rule 1:

“Only Arch Linux itself; no Arch-based distros. Posts about other software used on Arch are welcome

-3

u/[deleted] 2d ago

[deleted]

7

u/SmallRocks 2d ago

Yes [u/selfcleaningtaint](u/selfcleaningtaint)

Wiki which was also posted by OP

11

u/cyh555 2d ago

yet another thread going nowhere

4

u/-i0f- 1d ago

I find this one really weird. I'm somewhat sure, it really is not malware, after this discussion surfaced some time ago. But I would never use software that I was "somewhat sure" about. Why would anyone use a software that contains the base of an operating system under this premise?

Everybody can do as they please, but this strikes me as one of the worst things you could do.

1

u/Historical_Move6359 18h ago

Do you use Android or Iphone ? 

1

u/-i0f- 18h ago

Yes (although GrapheneOS). While that could be seen as hypocritical, my point is still valid. With mobile phones you usually don't have a choice. In this case you have.

1

u/Historical_Move6359 15h ago

Well their is always a choices. And you made yours.

4

u/Ybalrid 1d ago edited 1d ago

I haven't used Ventoy in years, and so I do not really care about this, but from what I can see, this "Ventoy might contain backdoors or other malicious code:" section on the wiki seems an over reach and oversealous.

Though, one thing to me is sure: it would be better if it was straightforward to compile Venoty 100% from source code rather than relying on precompiled blobs for the bits and bobs of busybox and whatnot that are in there

But I see absolutely no reason to see any malice in the way Ventoy is built and distributed. But to each there own.

TL;DR: it's probably just FUD. though it would be better if it was 100% built from source anyways.

3

u/RandomXUsr 1d ago

We have to use caution with any software we install. Especially those in the AUR.

Nothing wrong with being skeptical and running it through some reverse engineering tools.

I'm suspicious of that one person is putting in all that work for vendor. Its a herculean effort to get ventoy built.

Additionally; we should not make assumptions about what may be in the software.

Extraordinary claims require Extraordinary evidence. If someone is going to make the claim; be prepared to show your work.

9

u/Charming_Professor53 2d ago

Ventoy has not been proven malicious, but it is pretty prone to a supply chain attack. For that reason, I like the more puristical polyrepo approach of MultiOS-USB: https://github.com/Mexit/MultiOS-USB

2

u/DEAMONzWojSKA 1d ago

You are the goat man, thanks

3

u/tjj1055 1d ago

ventoy has never been proven malicious, there is literally zero evidence of it being malware.

10

u/Charming_Professor53 1d ago edited 1d ago

That's what I meant to say. The problem however is that malware could very easily be overlooked/hidden the way that the project is managed. The entire build process is based on a EoL distribution - CentOS 7, released 2014, EoL 2024 - that gets no security updates. Also see the rant by the AUR maintainer: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=ventoy

Next to the build process and blobs, the monorepo makes it particularly difficult to track the exact patches made to all the different components Ventoy is made of. GRUB+Shim itself is already a humongous project, but it being included in full source code will make it only difficult to update it regularly to include security updates for example. I find the patches used by MultiOS-USB's GRUB repo easier to understand what is being done/modified and what is being achieved.

3

u/rassawyer 1d ago

This has been documented for like what, 5 years? Why is it coming back up now?

2

u/Any_Fox5126 1d ago

I guess someone has noticed this now. More importantly, why hasn't it been resolved yet? This is a serious issue in terms of security and transparency.

1

u/TheGamerForeverGFE 17h ago

It's been resolved, just run the checksums 

1

u/Any_Fox5126 17h ago

Is that really a solution? Is it now 100% transparent and reproducible?

1

u/TheGamerForeverGFE 17h ago

It always was, it's still using  binaries from other projects but you can run checksum checks since now the hashes are provided.

1

u/jc_denty 1d ago

Recent AUR attacks

3

u/Fast_Librarian 1d ago

What was anyone’s first thought when this could slip stream anything into the iso

1

u/Fast_Librarian 1d ago

I’ve widely felt like this since I discovered ventoy

7

u/onefish2 2d ago

Old news...

2

u/XOmniverse 1d ago

I just use Fedora Media Writer. Works fine for basically everything, not just Fedora.

2

u/bem981 1d ago

I love the level of toxicity about this in the comments lol!!!!

2

u/v0id09 21h ago

> ⁠The real identities of the authors is unknown.

Do we know the real world identity of the wiki page authors?

2

u/TheGamerForeverGFE 17h ago

Here we go again, people already did this shit a while ago.

No, it's not, the checksums are available and you can do the work yourself to make sure the blobs are safe.

And, just because they're Chinese doesn't mean we should be racist.

3

u/ByteCorum 1d ago

There were plenty of conserns around Ventoy for a long time, sadly almost none had gone. I'm not using tools, which source code can not be fully audited, cuz what the point of being open source if there are some shaidy parts with no particular description or reason. This is not trustworthy software, it looks more like "oh hey I'm open source you can trust me, but actually not".

I've used https://github.com/Mexit/MultiOS-USB for a long time and so far perfect user experience!

1

u/Charming_Professor53 1d ago

Yup, me too. The only downside is Ubuntu(-derivative) live images not being able to boot from exFAT partitions due to no exFAT drivers being enabled in the live image, so you have to add a NTFS partition and boot it from there. That's only a Ubuntu issue AFAIK. No issues with any other distro's, and it even has support for Secure Boot and Windows images :D.

3

u/cd109876 1d ago

Microsoft Excel might be malware. the NVIDIA GPU driver might be malware.

4

u/enozian 2d ago

Isn't the source available at https://github.com/ventoy/Ventoy

2

u/Ybalrid 1d ago

it definitely is

1

u/Any_Fox5126 1d ago

But without the source code for some blobs.

3

u/Practical-Plan-2560 2d ago

What are the alternatives?

0

u/Expensive-Sock-7876 2d ago

Build from source

-1

u/Practical-Plan-2560 1d ago

If the concern is that there’s already precompiled code in the Git repository, but there’s no source code for it, your comment doesn’t address the issue.

-1

u/Expensive-Sock-7876 1d ago

0

u/Practical-Plan-2560 1d ago

What are you talking about?

As an example, this folder has blobs with no source code: https://github.com/ventoy/Ventoy/tree/master/BUSYBOX/chmod

https://github.com/ventoy/Ventoy/issues/3224 has more information on a full list.

It seems like you are just defending Ventoy using incredibly basic arguments that aren't realistic.

2

u/Lashmush 1d ago

Isn't it possible to binwalk the precompiled stuff and make sure? 

3

u/Ybalrid 1d ago

it's basically bits of busybox, and yes it is very possible to dissasemble and check. Who has the time for that?

1

u/Lashmush 1d ago

Yeah it's probably not easy both in time and comprehension required but Im just saying, if people start getting paranoid about reasonably popular software, they have an avenue to figure out the truth of it. I had a security colleague who liked sitting with music and binwalking firmwares and other stuff just to relax.

2

u/DaffyDuckMuthaFucker 1d ago

Blah blah blah.

Come back with some actual evidence and you might actually be taken seriously...

2

u/Rayregula 1d ago

The author(s?) long refused to react on questions about the source code for the precompiled code inside their git repository.

Few companies do.

They long refused to react on questions about the security risks.

What risks

When an answer was finally given, it boiled down to a simple "There is no reason to assume that we would have placed malware inside."

Perfectly reasonable. Why would you assume so.

Again after a really long time the authors finally mentioned what other source code they used to generate some-but not all-of the pre-compiled code they did not mention the build methods and refused to prove that this really was the used source code

Doesn't many anything.

The real identities of the authors is unknown

Like the people who work for the company you mean? Which is normal. When a windows update comes out we don't know who the authors were that contributed to it are.

Or you mean like who the company is owned by.

2

u/azdak 1d ago

i mean if you don't want to use closed source software, that is reasonable, but accusing something of being malware simply on the basis of being closed source is absurd

1

u/dogwalker805 1d ago

I like ventoy but don't really trust it. why have we not created a duplicate by now?

1

u/Commercial-Worth7301 1d ago

Que exagero, é só um software de inicialização estilo canivete suíço.

Já recuperei uma partição inteira pelo systemrescue, sergei strelec, instalei meu arch por lá, tenho um Linux mint para resolver problemas simples, um debian para servidores e um mini-OS para computadores fracos

1

u/Glum_Hamster_2104 21h ago

If it’s truly malware then go ahead and tell me the payload

1

u/DenysMb 7h ago

This debate wouldn't even exist if Ventoy had been developed by programmers from the land of "democracy and freedom," but since it was developed in China...

It's always the same. "When it comes from China, something has to be wrong!"

u/Comprehensive_Map806 40m ago

AUR is practically a malware

1

u/ZVyhVrtsfgzfs 1d ago

The question about binary blobs in Ventoy was raised after the XZ take over, the primary author is a professor in computer science in China, questions of how much liberty a developer has in a dictatorship were raised.

But it's been two years and no one has found anything and the developers are working slowly on removing the binary blobs.

I have discontinued using Ventoy out of an abundance of caution, but at this point I would be surprised if it did turn out to actually have any malware.

1

u/Amate087 1d ago

Only use Ventoy one time, but not like the close code and never use this app.

-16

u/[deleted] 2d ago

[deleted]

22

u/st_heron 2d ago

Why? It works really nice, I can just throw a bunch of isos on one flash drive and install any of them. What's an alternative?

-5

u/NyCodeGHG 1d ago

ventoy injects itself into the boot process to do it's thing. UEFI doesn't have the concept of a loop device, so it's a giant pile of hacks. It's known to cause a bunch of weird problems.

-16

u/Affectionate-Oil4675 2d ago

It seemed sketchy so I always refused to use it.

-18

u/Slight_Advertising_9 2d ago

Yeah me too, took a short look and ran.

0

u/anxious_and_stupid 2d ago

I literally have to learn how to manually boot win11 iso via grub after I learned about this sometime ago

0

u/VendorNeutral 2d ago

Ventoy and rustdesk are the two tools I had to kick off the tool list at work after a supply chain audit. Not only aren't there enough eyes on all of the code, but there are no legal entities I can drag in front of a court if things go sideways.

9

u/LefTimaDev 1d ago

The latter applies to basically all open source software. If it's not owned by anyone, you're using it at your own risk. If you want to always have a legal entity to drag in front of a court you probably shouldn't be using Linux, except Ubuntu

-1

u/VendorNeutral 1d ago

Yes, but the paid tier rustdesk is closed source and (as this discussion indicates and is about) ventoy contains binary blobs. Open source can be audited and verified and even built myself, while closed source software requires a different angle. The moment I can't do either, software is off the list.

-11

u/Excellent-Copy-2688 2d ago edited 2d ago

you guys use USB for installation? I just live boot into ISOs from grub

if you don't have grub, just extract the ISO on a fat32 partition, and boot into it from your boot menu(might have to add a boot entry in UEFI)
I have installed win 10 iot ltsc this way, debian too (it required downloading and replacing the kernel and initrd with versions labeled as 'hd-media')
I've seen someone on yt use this method for ubuntu as well

for ISOs larger than 4GB you might need some extra steps of splitting some big file, I am not completely sure about the process

14

u/anonymous-bot 2d ago

Ain't no one got time for that. I just make my Ventoy USB and then I can use it across multiple computers.

-1

u/Excellent-Copy-2688 2d ago edited 1d ago

my usb broke :(

I used gemini for the custom boot entry, did not expect it to work but it did somehow.
Took less than a minute, faster than downloading ventoy, literally

I understand the structure of the custom grub entry now, I can reuse it for all distros, just need to change 2 lines

3

u/archover 2d ago edited 2d ago

Thanks for this info. I will test and report back.

Good day.

3

u/LefTimaDev 1d ago

That's... not an alternative, the methods you described have a different use case (booting into another ISO on a machine that already has an OS)

2

u/Any_Fox5126 1d ago

... yes? Pretty much everyone has a USB drive, and the installation guides always use one.

0

u/onefish2 2d ago

I do this with rEFInd. I extract the Arch iso into a directory in/boot/EFI/archiso and have rEFInd boot it. I do the same with Clonezilla.

-1

u/iTrooz_ 1d ago

Scary how people in this thread are overlooking this.. this sounds like a huge security problem, I'll definitely stop using Ventoy for now

0

u/V2UgYXJlIG5vdCBJ 1d ago

First time I even heard of this software. Install OpenSnitch, which will catch it if it tries to phone home. Firejail couldn’t hurt either.

0

u/lamalasx 16h ago

glhf installing anything to a bootloader

0

u/r4ppz 1d ago

bruh my heart literally dropped reading the title cause I just installed Ventoy yesterday 😭

0

u/instancer-kirik 1d ago

If I had a spare x86_64 machine that wasn't secure boot locked by AWS for their specific Ubuntu distro, I'd consider doing this migration bc I'm free this whole month

-14

u/OwningLiberals 2d ago

I like how a lot of people are shitting on OP without realizing this is basically a direct excerpt from the arch wiki. If you guys want to shit on this that's fine but you should probably fix the arch wiki if you care so much.

19

u/jort93 2d ago

Well, anyone can add stuff to the arch wiki. You should look into it yourself before vouching for the information. I can write on there that grub may contain malware if i feel like it, doesn't mean one should repost it.

7

u/[deleted] 2d ago

[deleted]

14

u/jort93 2d ago

Put Wikipedia as the source on archwiki and archwiki as the source on Wikipedia, big brain

-8

u/activedusk 2d ago edited 1d ago

I mention it all the times ventoy is recommended, it is not to be trusted, from any Linux distro, you don't even need a GUI to prepare a bootable USB drive. You can use TTY console with wget examplelink to download the .iso (you can manually type download link from smartphone and it will download to working directory, cd to /home/user/Downloads for safety) and use

sudo dd if=/home/user/Downloads/exact-name.iso of=/dev/sdX bs=4M status=progress oflag=sync

Note to use lsblk before to identify USB name correctly and write the name of the entire USB device and not a partition within, if any, example if internal SATA drive is sda, USB drive will be sdb so of=/dev/sdb and not of=/dev/sdb1. Also it is recommended to unmount the USB drive but not eject it before using dd, check with lsblk, the command is umount /dev/sdb1 (I did not forget the n in umount, that's just the command, blame nerds for thinking that's an abbreviation).

While you should be cautious with dd and not take it lightly, it is the best way to make a bootable USB that I found. Alternative create a bootable partition within the drive, as in that partition will boot with .iso like a bootable USB, it is however a drive partition. There are several solutions, the Arch .iso works with systemd-boot but it is more universal to use GRUB. With systemd-boot you would need to size /boot partition beforehand to be able to house the Arch .iso because it needs it to be on the ESP (EFI System Partition, more precisely /boot/EFI/ subdirectory or /boot/efi/EFI/) to be able to install from internal drive, with GRUB it is easier, make a separate, say 5GB partition at the end of the drive with cfdisk or your GUI partitioning program of choice. It may or may not be possible to extract the .iso and use some files within to make an EFI boot stub but said extracted files need to be on ESP afaik.

To prepare a Windows bootable USB, same thing, download .iso from official source, things differ a bit afterwards. First format USB to NTFS, will need dependencies like ntfs 3G package. After that mount .iso, cd to it and copy the contents to USB drive. Wait a few minutes after it says it finished to actually finish and it should be done, this can be done from GUI or TTY console, in both cases.

I did not try but from Windows to prepare bootable Linux USB, it might be possible to use WSL and reuse the dd command. It is easier however to make a bootable partition within the internal drive, mount .iso, copy contents to that partition and make it an EFI system partition with command prompt, there are tutorials on youtube.

11

u/LefTimaDev 1d ago

You don't seem to realize the point of Ventoy is being able to drag and drop multiple ISOs into a folder on the same USB, then when booting from the USB choose which ISO to boot into. While the remaining space on the USB drive is free to be used for anything else.

You can't do any of these things with the methods you listed