Gaming Attention: New Wii brickers may be popping up

[MaxiBash]

Post trashed. It's time to stop giving this guy what he wants:
ATTENTION.

Just don't install garbage onto your Wii from people you don't know. Let alone, the mods from Wiibrew, RC24, anything you can name are already informed. Little to no precausion is needed.

 

[UltraSUPRA]

What do people have to gain from doing this?

 

[ROllerGuy]

What do people have to gain from doing this?

Nothing other than attention.

 

[UltraSUPRA]

Nothing other than attention.

Then I'll make a homebrew Zelda fan game for the Wii that replaces Priloader with a static image that says "Please subscribe to Fish activation for memes and junk.", if all publicity is good publicity like Frutre3 thinks. </sarcasm>

 

[The Real Jdbye]

So, just within a few days, with me after doing research on Nintendo console virusses, someone got inspired to make one: Wii Bricker 9000 (aka Wii Pong).

Wii Pong is disguised as a simple pong game. But as you launch the app, it will brick your Wii, and not in a good way, because anyone can recover from a brick like this.

You thought people were done with Wii Bricker 9000, a couple of memes going around?

Nope, the creator of this trojan, Frutre3, has more plans, as he said he will make a NAND Trasher for the Wii, and a tool named "Dolphinophile". As soon these tools get leaked or released, the MD5 and CRC32 will be posted on Reddit, with an announcement placed here.

This does not only count for bricking tools made by Frutre3, but also for (older) tools that could brick a Nintendo DS, 3DS, DSi, and if someone does it, a bricker for the Wii U.

These tools may even be posted on regular Wii hacking sites, so please keep an eye out for stuff like this. Don't open applications from people you don't trust and always make sure to look through the .dol file for any suspicious code.

Trojan Info Post

Looking through the dol file for "suspicious code" is easier said than done. You need to be pretty skilled at reverse engineering for that.

 

[MaxiBash]

Looking through the dol file for "suspicious code" is easier said than done. You need to be pretty skilled at reverse engineering for that.

The brickers we found had, no joke, all the text and code into the .dol file, and it could be shown with a hex editor. So while this was just a poorly written bricker, the other ones have more up their sleeves.

 

[EmulateLife]

lol trying to brick people out of a console that was two generations ago. If they succeed you're out $20-$30 to replace it.

 

[Maeson]

Searching for "frutre3" doesn't show anything besides this post and a bunch of strange pages, so that's weird, but thanks for the warning.

I can't fathom how sad one must be to do this in the first place, but reading this has created in my head a mental image that of an enraged nerd saying to itself "I'LL SHOW THEM!" while monkey-coding bricking software for a bunch of old hardware as early 2000's edgy music blasts off in a dark room; so at the very least I got a chuckle out of this.

Sort of like Hackers, but with less cheese and more embarrassing.

Is there anything that can be done to help? How widespread this could realistically be?

 

[MaxiBash]

Searching for "frutre3" doesn't show anything besides this post and a bunch of strange pages, so that's weird, but thanks for the warning.

I can't fathom how sad one must be to do this in the first place, but reading this has created in my head a mental image that of an enraged nerd saying to itself "I'LL SHOW THEM!" while monkey-coding bricking software for a bunch of old hardware as early 2000's edgy music blasts off in a dark room; so at the very least I got a chuckle out of this.

Sort of like Hackers, but with less cheese and more embarrassing.

Is there anything that can be done to help? How widespread this could realistically be?

Maybe 1 or 2 Wii hacking websites according to him, Wii Bricker 9000 was shared on 2 Discord servers, but just by opening it up in hex, people were able to see what's going on.
However, don't be scared, because of this poor programming we can easily identify a bricker and a legit homebrew application. Plus, it won't take long to get the MD5 and CRC32 hashes before the brickers get taken down.
At this point, we aren't even sure if we should take this guy serious, he looks like a huge troll who wants attention, but other people did try to make brickers themselves, so Frutre3 has what he wanted: Bricked consoles.

 

[TimPV3]

Well at least it's disguised as Wii Pong and not something anyone will actually give a shit about downloading.

 

[Maeson]

snip

Well, as much as I'd like to think otherwise, I don't think most people would use a hex editor to see if whatever they downloaded, in case is something shady.

Most of my worries were on how easily files can be spread nowadays, and how certain places (not just homebrew related, but in general) just grab everything they see and let them be downloaded without checking first or may accidentally host one of these files that will cause problems, more than this subject's "abilities".

Sort of like bad ROM dump that's floating around for years and years, sometimes without even pointing out it's a faulty dump.

 

[Dimensional_Grape]

To be honest, I'm kinda surprised something like this didn't pop up sooner. Like Trash_Bandatcoot said, the brick it causes is pretty simple to recover from if you have any sort of brick protection installed (it just corrupts the theme files for the Wii Menu). Looks like Frutre3 is shaping up to be a Nintendo version of Leurak (guy who made MEMZ, among other things, at least he only made them as a joke).

EDIT: Worth noting, Frutre's GitHub is only 5 or 6 hours old

 

[MaxiBash]

Bricker announcement: New possible bricker found.

Name: NoConnect24
Disguise Name: RiiConnect24 Patcher
Description: Contains differences between a real RiiConnect24 patcher, malicious contents currently unknown.
MD5: 0CFC7204D909C4502D7D931F41486FA0
CRC32: f287cfab

 

[ROllerGuy]

That's not NoConnect24, but it is malicious. He changed the download link for the mail patcher to a dol file hosted on dmca.gripe, which seems to be Wii Bricker 9000.

But another actual Wii bricker has been spotted. Wii Bricker 9000 - dhtdht020 edition (by Frutre3) with the SHA1 hash of 9c81f3e8cbd129f5c4d28bfa8f5e621dca05b989. It does the Wii equivalent of rm -rf /, along with displaying some ASCII art and telling you to not turn off the Wii or your Wii will be bricked.

 

[tech3475]

lol trying to brick people out of a console that was two generations ago. If they succeed you're out $20-$30 to replace it.

It’s still $20-30 and people may have had saves, etc. They hadn’t backed up yet.

 

[BetterDuck]

I can't fathom how sad one must be to do this in the first place, but reading this has created in my head a mental image that of an enraged nerd saying to itself "I'LL SHOW THEM!" while monkey-coding bricking software for a bunch of old hardware as early 2000's edgy music blasts off in a dark room; so at the very least I got a chuckle out of this.

Limp Bizkit playing so loud that the basement dwelling 30 year old can't hear his mom knocking on the door to tell him his pizza rolls are done.

 

[ichichfly]

Bricker announcement: New possible bricker found.

Name: NoConnect24
Disguise Name: RiiConnect24 Patcher
Description: Contains differences between a real RiiConnect24 patcher, malicious contents currently unknown.
MD5: 0CFC7204D909C4502D7D931F41486FA0
CRC32: f287cfab

please use yara and not MD5. The MD5 can be changed by changing one Value for example in the dol padding. Creating thousands of Files that do the same but have different MD5.

for example

rule WiiBricker9000Dhtdht020EditionV1
{
meta:
description = "Bricks the Wii by syscall"
thread_level = 1
in_the_wild = true

strings:
$a = "Wii Bricker 9000"

condition:
$a
}

rule WiiBricker9000Dhtdht020EditionV2
{
meta:
description = "Bricks the Wii by overwriting 0000009a.app"
thread_level = 1
in_the_wild = true

strings:
$a = "/title/00000001/00000002/content/0000009a.app"
$b = "OwO UwU OwO UwU OwO UwU OwO UwU OwO UwU OwO UwU OwO UwU OwO UwU"

condition:
$a and $b
}

 

[Alex4nder001]

Looking through the dol file for "suspicious code" is easier said than done. You need to be pretty skilled at reverse engineering for that.

It would probably be an encrypted binary

 

[SnackJr]

I just want to know why? Are you that bored that you have to stoop to being malicious to entertain yourself? C'mon, man.