Over the last few days, PandaLabs has detected the appearance of specific malicious code for two widely used videogame consoles. The Format.A and Tahen (variants A and B) Trojans are designed to affect Sony’s PSP (PlayStation Portable) and Nintendo DS respectively.
These three Trojans are extremely dangerous as their attacks delete critical files, and can even irreversibly render the console unusable in the case of PSP. In order to spread, Format.A is designed to imitate a tool developed to enable running unsigned code on PSP consoles. The Tahen Trojans, on the other hand, simulate home-brew applications for Nintendo DS. However, when users install them they overwrite certain areas of firmware (software embedded in certain hardware) on the Nintendo DS console and the G6, XGFlash, SuperCard and GBAMP devices (which allow cartridges to be recorded with software to run on the console).
At first glance, this looks like a serious problem as it can irreversibly affect expensive devices. However, if people use the consoles according to the manufacturers’ instructions, the chances of infection are almost zero. Luis Corrons, director of PandaLabs, is doubtful that these malicious code can spread massively. “The videogame consoles are not designed for using third-party software,” he said. “In order for the malicious codes detected so far to reach one of these consoles, users would have to voluntarily run applications from unauthorized sources. Remember that just as with PCs, downloading and running software from dubious sources is always a serious security risk.”
Even though users are unlikely to suffer an attack from Format or Tahen, PandaLabs offers a series of practical tips for users of these consoles:
• Don’t insert UMD disks or memory sticks for PSP or DS cartridges that have not been recorded by an authorized developer.
• Don’t establish external communication (USB, IrDA or WiFi) with non-trusted consoles or computers that could transfer unwanted information.
• Don’t try to run applications from unauthorized developers on the video console.
• If nevertheless, you want to install a software packet on the console, it should be previously scanned on a computer with a reliable and up-to-date anti-virus.