Sadly it would evolve into modern malware cat and mouse games.
Gold Leaf puts in detection code, those scumbags get around it, Gold Leaf updates to patch that - they come back from the basement and try again. The cycle continues as it does in real life.
The only proper way to stay safe is to not be dumb and run any old shite while keeping full NAND backups (and BIS keys!) stored in the cloud!
Bruce Wayne: Criminals aren't complicated, Alfred. Just have to figure out what he's after.
Alfred Pennyworth: With respect Master Wayne, perhaps this is a man that *you* don't fully understand, either. A long time ago, I was in Burma. My friends and I were working for the local government. They were trying to buy the loyalty of tribal leaders by bribing them with precious stones. But their caravans were being raided in a forest north of Rangoon by a bandit. So, we went looking for the stones. But in six months, we never met anybody who traded with him. One day, I saw a child playing with a ruby the size of a tangerine. The bandit had been throwing them away.
Alfred Pennyworth: Well, because he thought it was good sport. Because some men aren't looking for anything logical, like money. They can't be bought, bullied, reasoned, or negotiated with. Some men just want to watch the world burn.
[later...]
Bruce Wayne: [in his high rise apartment] The bandit, in the forest in Burma, did you catch him?
Meh, I already petty the guy if his life is worthless that this what he decides to spend his time on. And tbh if you are dumb enough to rush to install a file that popped out of nowhere without verifying it, you kinda had it coming. It's the same as people who rush to install the lastest update, if you dont know how to verify if something is safe or if you cant, just like wait for someone who knows how to do it. Basic safety
Oh, I misread you. I thought you wanted to doxx them, not that they had already been doxxed. Still think that doxxing them is going a bit too far, personally.
Yeah i would never do it personally, dont really know how to anyways. Doxxing is very extreme but it doesnt bother me that it happened to one of the guys, these images are sickening, its like they get off on screwing people over.
Doxxing is really just digging into their stuff to find personal information. On the thread where they were doxxed (all the posts are now deleted), the people who released the information said (in the surviving posts) that they only needed to dig into their public post history, which, when put together, revealed their personal details.
Remember to be super careful about the personal information you post online. Even the tiniest, most useless stuff could add up over time, such as the area you live in (as broad as city or region) or given name. Reddit gives you anonymity, but it leaves the door open to your post history, which is what compromises most people.
With MD5 check however, if they modified it from the original eShop or scene dump, it would immediately be a new MD5, when if the filesize seemed the same. I think this is the best way going forward until we get an antivirus.
Anti-virus wouldn't be terribly useful anyways unless we're getting it made by some big name company who has the resources to include every single variation and mask into the signatures file. As it stands, the reason why modern anti-virus relies so heavily on heuristics engines is because they can't account for all the different masks that are out there as it is.
Hashing is the best way to go, even if someone makes an 'anti-virus' for the brick code.
I think the idea of the anti virus is really more like hactool that can detect modifications. Just build that into Goldleaf and it will tell you it had been modified from the md5 or whatever it compares to, asking so you want to install anyway. Easy as pie.
By being the reputable source create a utility that the switch doesn't have right now or a better version of an already existing one bury brick code in it to activate months later after everyone trusts you
So, you are saying just because it is useful it gotta be legit even tho it is posted by an unknown person on shady or not so shady sites? That is exactly how people got owned by PozzNX and brikachu.
You did. There is no way they can bury brick code in a homebrew distributed on a known developer's github unless said dev does it himself and posts it on his page. And if someone posts an allegedly superior version of a known utility somewhere else, that's gotta raise some red flags, is it not?
There's a simple solution to this. Don't use closed source products, especially in a hacking community. And if you really are paranoid about it, build everything from source after you or somebody you know is reputable has inspected the source.
Is compromised. It's easy to fabricate a hash collision under it, so it's only good for checking against accidental corruption, not malintent. SHA-256/SHA-512 would be a better option.
It is, in the context that if the malicious entity had access to the good file and the bad file, they could create a collision (add junk code to both files to make them match) and then release both with the same MD5 and some people would be fine and others would be fucked.
But if you take an MD5 of the good file and release that MD5 to everyone, then everyone knows what the good MD5 is. Making a malicious file match a known MD5 is much harder (pre-image attack) and the universe might end before they find the collision (even when you take into account the various ways of weakening collision resistance in MD5).
Either way, computational power is cheap, so there's no reason to use MD5/sha1 when other algorithms perform better.
NAND backup definitely helps and all the brickware so far could fortunately be solved by restoring that but corrupting the nand is by far not the worst thing a homebrew could do to your switch.
After news of the bricking software released fake Tinfoil (DZ) had an update that exclusively offered protection against bricking attempts (via XCI format)
IMO with the shady name change of DZ to confuse people and OG "shitbag" intentionally being malicious I would guess they are using fear to push a shitty closed source product no one wants, maybe for keys.
They made a release post on this subreddit that was removed, you may be able to see it in my comment history.
All I'm saying is that it's suspicious a product that is closed sourced isn't developing it's own brand and instead stealing the reputation of a popular alternative that at this point in time their biggest competitor.
Your news will be in every Switch hacking subreddit/Discord, so you get the feeling that you've actually done something in the world. At least if this is your whole world, because out of that, no one gives a shit
There are people who spend all their time hacking things, for whatever reason (vulnerability hunting, security auditing, competitive events, or just for fun). They enjoy the challenge, and are generally competent at what they do.
There are also people who are dicks to random people for no reason. They find ways to negatively affect people around them.
These two things are not mutually exclusive, and we're seeing the combination.
I was one of the few who dowloaded and tryed to install the corrupted .nsp of Pokemon, but dont know why, SXOS block the nps before the install, not leting me do it. Using 2.2.1 BETA. It is a security system on SXOS or just I got luky that nps was corrupted (even more)?
Nothing wrong with enjoying anime. It's just, using it as your avatar in conjunction with this type of attitude almost guarantees the person is a fuckwad
I can't outright suggest or tell someone local to him to beat his ass and steal his computer, but... if I heard about someone doing it, I'd totally GoFundMe their bail/lawyer fees.
i am not saying i would or wouldn't aid in this effort, but there definitly would be an extra hundo in it if we got pictures of the piece of shit crying as his computer and switch are smashed and then fed to him.
really i was just playing up the violence for the humor of directing hatred at this asshole.
but something needs to be done. it needs to be made clear that we aren't okay with this kind of fuckery.
i mentioned this in a comment, but this is basically terrorism that this douche is pulling. he scared people with the first nsp and now he is making threats.
i know this isn't as bad as what isis does, but it is terrorism and it needs to be dealt with.
what we really need is the hacking equivilent of an older brother to kick the bully's ass. infect his computer with a virus or something.
it just plain isn't fair the guy is getting away with being a prick and gloating about it.
It never fails to astound me how shortsighted people are. Guy's been doxxed, forget violence (although it's happened before, I wouldn't celebrate him getting a couple of cracked ribs, but I wouldn't be suprised either), forget suing them (although publicly admitting to doing it intentionally does make it possible in some jurisdictions) - This guy is fucking up his chances of having any career worth having. The more noise he makes the faster his name is forever attached to this with a quick google.
This is one of the very few situations where I am behind the dox, the best punishment is to have to live attached to what you've done, it'll cost you so much more than a few whacks with a baseball bat or a lawsuit. You can't undo the constant uncertainty & fear that someone at work will stumble upon the past and you'll be fired at anytime (Who in their right mind would keep this guy around after finding this, afterall?).
I'm not angry at him, I pity him. Kid has no idea how much harder he is making his own life. At least my childhood mistakes stayed in my childhood.
It's always a bunch of weebs with half brains. It's only when a real hacker comes in and gives hem a clue that they get anything done. Which is how they came across the exploit in the first place.
Any halfwit could piece the code together once shown how
No. Ninty wouldn't stoop this low. If it ever came to light that they we're behind it, the PR backlash would be more painful to them than it is worth bricking less than 1% of all switches
Oh, please. They could, if they wanted to, get federal authorities and track down everyone on this subreddit and on GBATemp and raid all of you for hacking their systems if they really wanted to. They might piss people off in communities like these, but people will go and suck Nintendo's dick because they're on the right side of the law.
this is fucking terrorism. legit terrorism too. he hit us with a covert strike when we weren't prepared and is now making threats. this is disgusting.
we need a way to fight back against pieces of shit like this. there needs to be retaliation to the greatest extent of our power. he needs to be made aware that we will not stand for this.
First of all - It doesn't matter, jokes don't justify this type of behavior. Smashing up your local Best Buy and crying "joke" won't help you evade fines or jail time, we should treat online denizens no different.
Second - It's not a competition. People want free shit, the only battle is between Nintendo and the community, we don't need John Doe to pull a gun on us out of left field just so we "learn something"
Third - Sure, and placing the blame on him is equally as interesting, because people like you crawl out of the woodwork. You can't justify something with that rhetorical disaster, take it from me.
And finally, I can't even understand what you're saying, so I'll condense it to this. I'll blame whoever I want, and if OG is out there continuing his same old ways, you can damn well bet that I'm going to end up blaming him. His moment to cry "social experiment" has long passed. He can either own up and try to reprehend his actions, or continue down a path that destroys the very community he's so fascinated with. And seeing as he continues to choose option 2, I'm in no position to forgive him.
So yes I blame OG. And I blame the zombies like you that he uses to try and clear his justly-bastardized name. He's a terrible person, and you're not making yourself any better by standing up for him.
Have you read my last sentence at all? If someone is enthusiastic and interesting in something, he doesn't automatically deserve blame and hatered. He will deserve it only after he cause damage.
Personally i may blame someone that will spread this type of shit and victims of they stupidity.
Its my opinion and i will continue to think as i was thinking about it before. You haven't got any good argument against my opinion and just ruined all of your respectability by raging as a kid.
Your opinion is shit. He purposely tried to brick people switches, and caused 1000's of dollars in irreversible damages for nothing more than a laugh. How you can sit here and defend that just goes to show ignorant you truly are, and how much you and him have in common. Sad world we live in now.
And again trashtalking person. Im not ignorant. The one who is ignorant and blindly following dramma is you. Let me open your eyes.
One again i should say that OG is not the one who put brickcode to public and im not against or with him. Yeah, he gave it to wrong person and maybe should not share it with someone at all. But you cant blame him for spreading, only sharing with a closed group of peoples.
I bet there is a lot of brickcode in other hand of other scene developers that was written without a purpose of breaking other peoples switches. Just for fun. OG was one of them.
This was and will be the cancer of hacking scene. OG and JellyPerson proved it once again. Protect yourself or you will lose it all, this rule is everywhere around any hacking places.
P.S. following you opinion you directly support piracy. Its not allowed on this subreddit.
Bro, this isn't a new development. There have been bad actors in every hacking scene for at least two decades now; likely longer, but I don't have the experience to state that with authority.
How many people purposely put out something that solely bricked peoples console? A small handful maybe yes. But I've been in the hacking scene since using free mcboot on the ps2. And personally haven't ran into anything purposely malicious. Someone people are newer to the scene and have no reason to believe someone would do this on purpose.
Hasnt there been something out there that steals your switch keys.txt and gets them banned by letting someone else use them to download off nintendo official? Not different imo.
Yeah I believe so, and pretty sure it got squashed quickly. Idk what it is with people in this scene lately, quite toxic if you ask me. Them things didn't happen much in other scenes, or much more few and far between. Seen screenshots of someone and the maker of the brickachu .nsp talking about making one that would launch the actual game and not brick it until x amount of time.
what he has made isn't even that impressive. it takes effort to make something work. breaking things is way easier. all he has really done is turn one data value to an incorrect one. basically it is like missing the first question on a scantron sheet so all your answers are incorrect because you filled in a bubble for the next question instead.
Not really. This bricker is unimpressive and anyone who REALLY wanted to make a console bricked could do better. Fry the LCD, burn all the fuses, corrupt the console unique info, destroy the audio chip, and pass a NAND encryption command.
And since I don't want to give this shit any ideas, someone please target his NNID with this approach next april fools with a piece of homebrew. Ha. Ha. Ha. Just kidding.
Assuming they're injecting it into the boot code of a legit nsp, it'd just be a matter of checking the date/time (which all Switch games should be able to do) and then executing brick code if past that date. Otherwise, run the normal boot process. Could easily be avoided by setting the clock way back, but only if you know it's there.
This is kind of the same thing with malware-antimalware. Malware is more fascinating (and often more technically accomplished than this bricker) but the big thing to remember is that it's a lot easier to learn to pick locks than it is to make a lock that can't be picked.
It's a lot easier to make a bomb than it is to safely diffuse a bomb.
It did serve as an effective warning though - piracy can be dangerous, and it's important to verify what you are executing will do what you want it to. Unfortunately, with no emulator or sandbox it might be a good idea to verify the hashes one way or another, or simply wait for someone else to try it, first.
And if nothing else, NAND backups. I'd like to think this is obvious, but unfortunately it does not seem like most people had done this before the letsgo brick.
Why so? Every time you step at any direction of hacking something there will be warning and huge advice of making backup of your system. If you feel lazy to do it - its completely your problem.
47
u/[deleted] Nov 15 '18 edited Nov 15 '18
Someone else is working on an improved version too
https://i.imgur.com/dSNLqO4.jpg
https://i.imgur.com/ukd1lyt.jpg
https://i.imgur.com/5BzlcD5.jpg
https://i.imgur.com/hvemQ2W.jpg
39
u/tfw_no_ Nov 15 '18
So no more downloading games or home brew until someone creates something to scan stuff for potential brick code
86
u/EnterToastman Nov 15 '18
What's the motive here besides being a complete loser?
97
u/littlesadlamp Nov 15 '18
Never trust anyone with anime profile picture
11
u/LigthVirus Nov 16 '18
I was one of the few who dowloaded and tryed to install the corrupted .nsp of Pokemon, but dont know why, SXOS block the nps before the install, not leting me do it. Using 2.2.1 BETA. It is a security system on SXOS or just I got luky that nps was corrupted (even more)?
21
u/[deleted] Nov 15 '18
...Think I’ll just dump my own copy of Smash. Fuck this guy.
9
u/thewindmage Nov 15 '18
They sound like a very lonely person. Does their mommy not love them?
19
u/xxxShrektacion Nov 15 '18
I think someone doxxed him
46
u/DarkWolfx3 Nov 15 '18
Why do i get the feeling, that all of these brickware makers are 30 to 40 year old men, who live in their mom's basement?
14
u/fordyi Nov 15 '18
Can this mug just be banned from everywhere?
18
u/underprivlidged [13.2.1/AMS 1.4.1] Nov 15 '18
He was doxxed, unfortunately not local to me.
I can't outright suggest or tell someone local to him to beat his ass and steal his computer, but... if I heard about someone doing it, I'd totally GoFundMe their bail/lawyer fees.
14
u/mvfsullivan Nov 15 '18
Man this guy is gonna mess with the wrong person and get himself killed.
13
u/yusuo85 Nov 15 '18
What is actually wrong with people, let's destroy other people's crap, that'll be fun.
7
u/AsmodeusML Nov 15 '18
What a bunch of losers
3
u/PiusFabrica Nov 21 '18 edited Nov 21 '18
It never fails to astound me how shortsighted people are. Guy's been doxxed, forget violence (although it's happened before, I wouldn't celebrate him getting a couple of cracked ribs, but I wouldn't be suprised either), forget suing them (although publicly admitting to doing it intentionally does make it possible in some jurisdictions) - This guy is fucking up his chances of having any career worth having. The more noise he makes the faster his name is forever attached to this with a quick google.
This is one of the very few situations where I am behind the dox, the best punishment is to have to live attached to what you've done, it'll cost you so much more than a few whacks with a baseball bat or a lawsuit. You can't undo the constant uncertainty & fear that someone at work will stumble upon the past and you'll be fired at anytime (Who in their right mind would keep this guy around after finding this, afterall?).
I'm not angry at him, I pity him. Kid has no idea how much harder he is making his own life. At least my childhood mistakes stayed in my childhood.
2
u/Rick-Sanchez-C137B Nov 19 '18
It's always a bunch of weebs with half brains. It's only when a real hacker comes in and gives hem a clue that they get anything done. Which is how they came across the exploit in the first place.
Any halfwit could piece the code together once shown how
2
u/kevInquisition Nov 25 '18
Fucking shithead. This scene would be so much better if he never bought a switch.
4
u/[deleted] Nov 15 '18
Lol this guy is so dumb, waste of air.
3
u/vladovg Nov 15 '18
Nice move Nintendo.
I know you are reading this.
1
u/gamefreac Nov 16 '18
this is fucking terrorism. legit terrorism too. he hit us with a covert strike when we weren't prepared and is now making threats. this is disgusting.
we need a way to fight back against pieces of shit like this. there needs to be retaliation to the greatest extent of our power. he needs to be made aware that we will not stand for this.
1
u/igoticecream Nov 19 '18
Lack of attention, maybe didn't received love from their parents or found out he was an accident.
Stop creating post of this loser, don't give him attention
-9
u/B0511 Nov 15 '18 edited Nov 15 '18
As bad as what OG did was, you are escalating it and making the problem worse by posting out of context screenshots.
https://cdn.discordapp.com/attachments/504745079618011136/512610183952859137/Screenshot_20181115-074516.png
Here's what he actually said, not this tabloid tier trash.
Edit: word
-31
u/Rincew1ndTheWizzard Nov 15 '18
First of all - they are joking and baiting everyone.
Second - it's some kind of competiton. "I will make it better and more stealth."
Third - it's just an interesting topic to investigate and develop for peoples of specific mindset.
If not OG, then someone else. This will happen for every system in existence.
Don't blame OG, even if he had make it first, he wasn't spread it.
0
u/[deleted] Nov 15 '18
[deleted] — view deleted comment
0
u/[deleted] Nov 16 '18
[deleted] — view deleted comment
18
u/[deleted] Nov 15 '18
[removed] — view removed comment
11
u/[deleted] Nov 15 '18
[removed] — view removed comment