- download of official "iventoy-1.0.20-win64-free.zip"
- extraction of "iventoy.dat"
- conversion back to "iventoy.dat.xz" thanks to @ppatpat's Python code
- confirm that "wintool.tar.xz" is recognized by VirusTotal as something that injects fake root certificates
The next steps are scary, given the popularity of Ventoy/iVentoy :
> Analyzing "iventoy.dat.xz\iventoy.dat.\win\vtoypxe64.exe" we see it includes a self signed certificate named "EV" certificate "JemmyLoveJenny EV Root CA0" at offset=0x0002C840 length=0x70E. > vtoypxe64.exe programmatically installs this certificate in the registry as a "trusted root certificate"
https://www.bleepingcomputer.com/news/security/hackers-explo...
Or do you think it's 100% malicious?
Doesn't mean for sure it's malicious but them not even explaining why there's blobs like this is very suspicious.
*Starts looking for alternatives just cuz*
also check if your system has the reg key listed in the issue
there's always https://www.supergrubdisk.org/super-grub2-disk/
and finally, if you are really concerned and dont want to re-install, you can always take export the registry key of your root certs of a ventoy installed system and compare against a system not loaded with ventoy
edit: can also use systemd to boot iso's (among many other things)
_a8di•9mo ago
Another source:
https://security.stackexchange.com/questions/281238/iventoy-...