Privacy concerns raised over balenaEtcher ISO writing tool, Tails recommends Rufus instead

Privacy focused Linux distribution platform Tails has warned its users to choose Rufus instead of balenaEtcher when creating bootable media.

Tails is a lightweight, privacy-focused Linux operating system developed by the TOR Project. It can be booted from a USB stick and used without leaving any traces on the computer, such as browsing history, passwords, or logs of any other activity.

However, now the Tails team is worried that some users may expose themselves via tools they use to burn the ISO image files to the USB flash drive.

Since January 2019, Tails has recommended balenaEtcher as a go-to tool to install Tails from Windows or macOS. However, due to privacy concerns with balenaEtcher, they've now replaced it with Rufus in the installation instructions.

Both apps are widely used utilities for creating bootable USB drivers from ISO files. BalenaEtcher is often preferred for its simplicity.

First, the application started displaying ads, which the team didn’t like. However, that was not the main privacy concern.

“In 2024, the situation changed: balenaEtcher started sharing the file name of the image and the model of the USB stick with the Balena company and possibly with third parties,” Tails explains in its statement.

According to the closed issue, the “very sensitive information” includes the IP of the user, the filename of the image, which lets Balena know when the user is installing Tails, and the brand and model of the USB stick. This information could be used to fingerprint the user later.

“While we have not experienced or heard of any attacks against Tails users stemming from this change, we believe it introduces potential for abuse.”

Tails evaluated seven other tools and decided to stick with Rufus for Windows machines. For macOS, balenaEtcher for now remains in installation instruction because Rufus doesn’t work on macOS.

“Still, we recommend two alternatives for macOS: installing Tails using dd on the command line or using Raspberry Pi Imager,” Tails said.

The team noted that Tails doesn’t work on Apple M1 and M2 processors and macOs represents less than 10% of installations.

According to Balena’s Privacy statement, the company provides to third parties the identifiers and internet information collected from its users.

Cybernews has reached out to Balena for comment and will include its response.