A place to discuss and support all Steam Hardware, including Steam Deck, Steam Machine, Steam Frame, and SteamOS in general.
As Lemmy doesn't have flairs yet, you can use these prefixes to indicate what type of post you have made, eg:
[Flair] My post title
The following is a list of suggested flairs:
[Deck] - Steam Deck related.
[Controller] - Steam Controller related.
[Machine] - Steam Machine related.
[Frame] - Steam Frame related.
[Discussion] - General discussion.
[Help] - A request for help or support.
[News] - News about the deck.
[PSA] - Sharing important information.
[Game] - News / info about a game on the deck.
[Update] - An update to a previous post.
[Meta] - Discussion about this community.
If your post is only relevant to one hardware device (Deck/Machine/Frame/etc) please specify which one as part of the title or by using a device flair.
These are not enforced, but they are encouraged.
Rules:
Also I thought this part was interesting:
Special note for Israeli users: If the malware determines that your location is Israel (it does this via locale and timezone checks) then it has a 1:6 chance that it will play a loud siren sound and run rm -rf /, essentially attempting to wipe your filesystem.
That's prettyfuvking based
It turns out the malware doesn't work because it runs subprocess.run(["rm", "-rf", "/*"])
That will never delete anything, since there is no shell to expand the glob in /* here, so rm gets a literal /* as the path to delete 😭
This is why you test your code, people
Whew, thankfully it didn’t work on my machine!
From the river to the C:/
That's kind of awesome
I think I'm on team malware now
Maybe now they'll figure out that they need to vote Netanyahu out of office for being a genocidal piece of shit
Right they need a properly omnicidal megalomanic no mere genocide
That’s not malware.
That’s amazing.
It also trys to steal passwords/keys/etc, the Russian roulette part is just extra for people in Israel.
Is this considered Chaotic Good or Lawful Evil?
Definitely not evil
That’s fair. I hope Israel gets what’s coming to them.
Unless the option --no-preserve-root is given, it should not execute.
Fun fact:
rm -rf / requires —no-preserve-root to work whereas rm -rf /* doesn’t.
That’s because the /* gets expanded by the shell before the command runs and it only sees the request to delete /var, /dev, /home, /usr,… recursively but not / specifically.
On another note: This line in the code doesn’t run through a shell and thus this won’t work and it just tries to delete the literal path of /* recursively - and thus fails to do any damage…
The following files and directories may be created by the malware: /tmp/.transformers /usr/bin/pgmonitor.py ~/.local/bin/pgmonitor.py /etc/systemd/system/pgsql-monitor.service ~/.config/systemd/user/pgsql-monitor.service /tmp/kubectl The absence of these files does not prove that you are safe.
Wouldn't the Steamdecks immutability prevent changes to the filesystem in these folders? After rebooting at least.
Some of the directories are in the home (the tilda ~ means home of the current user) and home directory is not immutable
You're right, I missed the tilda.
/tmp/kubectl
If someone has kubectl installed on their steam deck, they have more problems than just malware. For example: workaholism.
If you are on Windows, MacOS, or used the Flatpak version, you are not affected by this malware.
Flatpacker here. Thank you for including this