PSA: PS Vita Bricking VPK's Targeting PlayStation Vita Pirates

This weekend as MaiDumpTool continues being updated reports of PS Vita bricking VPK's surfaced from Reddit PlayStation Vita backups hub 'VitaPiracy' with details from AssuredlyAThrowAway below, to quote:

Hello again,

The following two dumps were posted to the subreddit today, and they both were confirmed as resulting in bricked Vitas;

• "Fruit Ninja [US] [TESTED] [MAIDUMP]"
• "Kung Fu Rabbit - tested working - maidump v233.2z8"

The users who posted the links were banned, and the topics removed from the subreddit.

Please send us a modmail ASAP if you come across users posting VPKs that result in bricked Vita's. We will ensure they are IP banned from reddit on a permanent basis.

Thanks to the folks on the vitapiracy discord for pointing out these threads to me, and thanks to our very active users who called out the malicious links in the comments section straight away.

Update 1: Technical explanation from /u/tuxdude143; As much as I don't condone backups I couldn't just leave this be as the consequences would be far too dangerous.

Anyways with that being said I have been analysing the vpks along with my friend /u/DinduStuffin and we have found that both of them make calls to OS0. The particular cause for concern is how they call for OS0 to be mounted along with OS0:KD and VS0. Now once those are mounted it basically just wipes them clean.

The consequence is the vita had no operating system to boot at all, nor does it even have any drivers to interface with any of the components (which are contained in OS0:KD. Basically the result is an UNRECOVERABLE BRICK which leaves the nand completely wiped and unbootable.

Consider it the first ever serious vita exploit.

I'll update this comment as we learn more about what makes this thing tick.

Finally, from yifanlu to quote: We knew something like this was bound to happen which is why we implemented safe homebrews and the_flow helped in implementing checks in vitamin and vitashell. It appears that mai does not do these checks so of course everything is at your own risk.

My advice is for someone to implement a quick check tool that runs on your PC and checks the eboot.bin for the proper (safe homebrew) auth id and patch in the right safe homebrew auth id if it's not valid. Then people can get in the habit of running the tool before putting stuff on their vita.

Or someone should get the mai people to implement the same safe homebrew checks as vitashell.

 

[DvdXploitr]

I swear, people that upload these kind of things (whether it be an intentional brick for the Vita or a PC exploit, etc..) are idiots and serve no function as a human.....

 

[Kraken]

VitaOrganizer lists the permissions for each dump and has a "make safe" option that removes extra permissions. Assuming that the extra permissions aren't needed aside from for some more in-depth homebrew (like the whitelister), perhaps we should get in the habit of removing the extended permissions on everything before sending it to the Vita?

 

[PSXHAX]

I updated the OP with more tweets, it appears this is still going on for those who own PlayStation Vitas and use homebrew etc.