If you use Emudeck to play Wii U games, you may have malware

Thank you. I've been grinding ni no kuni 2 on the ps5 instead of trying to play whatever I was trying to play on cemu. It was one of the Zeldas.

Yes, you would have had to downloaded a recent update, and run it at least twice.

You're right, I missed the tilda.

Some of the directories are in the home (the tilda ~ means home of the current user) and home directory is not immutable

/tmp/kubectl

If someone has kubectl installed on their steam deck, they have more problems than just malware. For example: workaholism.

Fun fact:

`rm -rf /` requires `—no-preserve-root` to work whereas `rm -rf /*` doesn’t.

That’s because the `/*` gets expanded by the shell before the command runs and it only sees the request to delete `/var`, `/dev`, `/home`, `/usr`,… recursively but not `/` specifically.

On another note: This line in the code doesn’t run through a shell and thus this won’t work and it just tries to delete the literal path of `/*` recursively - and thus fails to do any damage…

tbf the vast majority of that country support him and everything he stands for, so getting rid of one fascist won't change much

Right they need a properly omnicidal megalomanic no mere genocide

I'd set up an air-gapped test network. Could possibly set up some virtual hosts to emulate part of it, but I'd keep the whole setup isolated as a failsafe.

Which leads to the interesting question: How do the authors of infectious, destructive viruses test their code?

Whew, thankfully it didn’t work on my machine!

This is why you test your code, people

Eh the password stealing shit definitely is but the special conditions for "israel" are hilarious (even if their code is borked and doesn't actually work)

Definitely not evil

Is this considered Chaotic Good or Lawful Evil?

That’s fair. I hope Israel gets what’s coming to them.

It also trys to steal passwords/keys/etc, the Russian roulette part is just extra for people in Israel.

I think I'm on team malware now

From the river to the C:/

It turns out the malware doesn't work because it runs `subprocess.run(["rm", "-rf", "/*"])`

That will never delete anything, since there is no shell to expand the glob in `/*` here, so `rm` gets a literal `/*` as the path to delete 😭

That's prettyfuvking based


That's kind of awesome

Maybe now they'll figure out that they need to vote Netanyahu out of office for being a genocidal piece of shit

Unless the option `--no-preserve-root` is given, it should not execute.

That’s not malware.

That’s amazing.

Also I thought this part was interesting:

Special note for Israeli users:

If the malware determines that your location is Israel (it does this via locale and timezone checks) then it has a 1:6 chance that it will play a loud siren sound and run rm -rf /, essentially attempting to wipe your filesystem.

>If you are on Windows, MacOS, or used the Flatpak version, you are not affected by this malware.

Flatpacker here. Thank you for including this

The following files and directories may be created by the malware:

/tmp/.transformers

/usr/bin/pgmonitor.py

~/.local/bin/pgmonitor.py

/etc/systemd/system/pgsql-monitor.service

~/.config/systemd/user/pgsql-monitor.service

/tmp/kubectl

The absence of these files does not prove that you are safe.

Wouldn't the Steamdecks immutability prevent changes to the filesystem in these folders? After rebooting at least.

I haven't opened cemu in like a year. Am I good?