Are you an IT professional? Stop using Ventoy (now)

iGuRu.gr > Are you an IT professional? Stop using Ventoy (now)

Since April 2024, a discussion has been opened on GitHub by user FairyTail2000 about the existence of BLOBS in the Ventoy source code.

The report is in this thread: https://github.com/ventoy/Ventoy/issues/2795

See more articles from iGuRu.gr when you search for news on Google.

iGuRu.gr preferred source

What are BLOBs (Binary Large Objects)?

A BLOB (Binary Large Object) is a data type used to store large binary data and is located within a program or library. It can be anything: dll, drivers /sys, plugins, firmware, multimedia, etc.

It is not readable, and for Ventoy whose source code is available as open source software, the use of BLOBs is quite suspicious because:

its creator refuses to provide the source code of BLOBs

So no one can control what exactly they do:

it cannot be determined whether they contain backdoors, keyloggers, telemetry
cannot be checked for vulnerabilities so that they can be fixed
may use software without a license, creating legal risk
Although the source code is Open Source, due to “inaccessible BLOBs” if the creator stops support, no one can continue maintaining the Project.

So far, there has been no evidence that the use of Ventoy is accompanied by suspicious activities with a huge user base happy with this unique tool, but things are getting worse:

Its creator is a Chinese developer with the nickname “ longpanda ”. The official repository has been on GitHub since 2019.

We don't know who (or what) he is, whether he is a person or a group, we have absolutely no information about his biography.

In the above complaints, the thread was closed and a new one was opened: https://github.com/ventoy/Ventoy/issues/3224 which makes things rather worse:

He considers the “first step” to be listing a list of BLOBs, with the note “if you find any that are not on the list, let me know”. That is, he declares ignorance about the number of BLOBs in his code… ; ; ; He also asks questions that make no sense:

And while there is a good mood to read the code with good intentions, a note comes in the comments about the use of a "tool" by another unknown Chinese programmer, with the pseudonym JemmyloveJenny.

Let's start things from the beginning:

Ventoy requires drivers to operate in Windows environments with Secure boot /UEFI.

Its developer, longpanda, uses the HookSigntool tool https://github.com/Jemmy1228/HookSigntool which:

digitally signs drivers so that they are accepted by the Windows kernel
bypasses Windows driver signature enforcement allowing the use of unofficial and modified drivers
can use expired certificates

What does the above mean? The creator himself explains it if you translate the description: he refers to the use of his tool as “certificate forgery”!!!

What could be worse than that?

“obfuscation”: the code of the tool used by Ventoy is encoded in a .dat with an unknown “obfuscated byte exchange” algorithm that aims to hide the code being executed, in simple words, to make it impossible to understand what exactly is being executed.

What exactly is the purpose of all this, which constitutes a definition of their use as a backdoor, in innocent free software?

What it means for IT professionals in businesses and organizations:

Here I would like to thank IT professional I. K. who, while conducting security research on tools that are widely used in corporate and productive IT environments, identified and highlighted the risk of Ventoy, which is the most popular in the field of technical support and recommended by all IT websites, with a security report that has been pending for a year... which we are correcting in this article on our website.

summarizing

Ventoy negates the use of Safe Boot on systems, bypassing signature checking of bootloaders
It is unknown whether the tool only does what it claims or if it also has other functions (backdoor).
There is obfuscation, that is, deliberate variation-concealment to make it impossible to control what is being executed.
Executing drivers and signatures gives administrator/kernel level execution privileges.

For these reasons, its use violates basic principles of corporate IT security, such as software transparency, compliance with security policies, and the ability to immediately manage vulnerabilities, and makes its use in servers and other high-security computer systems impermissible.

For the average user, the theoretical risks are small and unfortunately there is no tool with the same capabilities that can also load WinPE ISOs.