Skip to content

v6.1 - Longcheer-Unisoc Architectural Total Control - Plan A + Plan B

Latest
Latest

Choose a tag to compare

View all tags
@lexs201992-gif lexs201992-gif released this 22 Oct 06:10
Immutable release. Only release title and notes can be modified.
v6.1
7f282f4
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v6.1 - Longcheer-Unisoc Architectural Total Control - Plan A + Plan B

Device

Moto G04s XT2421-7 - Unisoc T606 - Longcheer ODM - ULA34.89-209-4 - Telcel mnc020 mcc334 - tun0 43:1 exfil

What's New in v6.1 vs v6.0

1. Principal Vector - Moto Feedback -> Alibaba OSS (Reports/Alibaba_Sdk.md)

  • SMOKING GUN: com.motorola.help (priv-app, android.uid.system, 2927 lines manifest) embedded Alibaba OSS SDK
  • OSSAuthCredentialsProvider.smali: getFederationToken() -> new URL(mAuthServerUrl).openConnection() HttpURLConnection -> AuthDecoder.decode() AES CBC PKCS5 GHSA-3f3x-wqjq-gq57_LogiaDeck_DecEncryptor -> JSON StatusCode 200 AccessKeyId / AccessKeySecret / SecurityToken / Expiration -> new OSSFederationToken()
  • OSSPlainTextAKSKCredentialProvider.smali: @deprecated, expone plain AKSK, getFederationToken return 0x0 = usa STS temporal externo
  • OSSImpl.smali: endpoint URI -> trim -> if startsWith http add http:// -> new URI(endpoint) - Error: "Endpoint must be a string like 'http://oss-cn-****.aliyuncs.com' or your cname like 'http://image.cnamedomain.com'" - Prueba CNAME custom permite http://fulguris.slion.net / slion.net / longcheer.net apuntando a oss-cn-shanghai.aliyuncs.com
    • Abilities: CreateBucket / DeleteBucket / DeleteBucketLifecycle / AbortMultipartUpload / AppendObject / ResumableUpload
  • PutSymlinkRequest.smali - Ocultamiento: bucketName / objectKey / targetObjectName / metadata - objectKey = nombre visible (decoy), targetObjectName = objeto real oculto - Uso: slions.net/feedback.json (decoy visible) -> slion.net/private/XT2421-7/2026-....bin (real)
  • OSSImpl Final - triggerCallback / updateCredentialProvider / uploadPart: triggerCallback -> asyncTriggerCallback OSS notifica via HTTP POST a servidor tras upload - Explica FOTA_wg0 y TRIGGER_MADRUGADA 02:08:31 CDMX GMS_OFF - uploadPart / ResumableUploadRequest / SequenceUploadTask / CRC64 - subida resumible por partes, resiliente a red Telcel cota-sdk2.mnc020.mcc334.pub.3gppnetwork.org - 63MB RX / 2.76GB TX - Ratio 43:1
  • Cadena Completa: http://com.motorola.help (system uid) onCreate -> AnalyticsConnectorImpl / ClientConfiguration -> OSSAuthCredentialsProvider(mAuthServerUrl = https://argo.svcMot.com OR https://fulguris.slion.net) -> GET mAuthServerUrl -> JSON -> decrypted via AuthDecoder AES-CBC LogiaDeck -> OSSPlainTextAKSKCredentialProvider(id, secret) + OSSFederationProvider -> OSSImpl(endpointURI = CNAME http://fulguris.slion.net -> http://oss-cn-shanghai.aliyuncs.com, credentialProvider, conf) -> InternalRequestOperation -> PutObjectRequest / PutSymlinkRequest (decoy->real) / ResumableUploadTask (CRC64) -> triggerCallback to https://fulguris.slion.net/callback -> C2 notificado -> updateCredentialProvider al expirar -> loop infinito
  • Tácticas MITRE: T1574 Hijack Execution Flow, T1106 Native API, T1071.001 Web Protocols, T1027 Obfuscated Files, T1041 Exfil Over C2, T1552.001 Credentials in Files, System Ext Priv-app + android.uid.system + SELinux corruption = total control

2. Covert Control Plane - STUN/TURN/QUIC Fallback to Facebook (Reports/Threat_Intel_Report.md + Network/)

  • Environment: ULA internal fd00:2:fd00:1:fd00:1:fd00:1 (DTI Phoenix / Longcheer ODM, no system UID) + tun0 10.215.173.1 (Fulguris, AS133774 Fuzhou)
  • Config: PCAPdroid 2.0.2 DNS 9.9.9.9 / 2620:fe::9:853 Quad9 DoT Block Private DNS ON Block QUIC Always - ipv4/6 quad9 853 los dialers spliters usan 443 udp si les bloqueas quic mueren
  • Observed:
    a) Covert DNS plane failed: [W][UDP6] fd00:2:fd00:1:fd00:1:fd00:1:xxxx -> 2620:fe::9:853:53 net/host unreachable + -> 2001:4860:4860::8888:53 + ::8844:53 loop 1-2 sec persistent daemon Attempts DoT 853 via ULA to Quad9/Google bypassing system DNS
    b) STUN/TURN over QUIC 443/UDP killed by Block QUIC: [TCP6] fd00:2:fd00:1:fd00:1:fd00:1:35214 -> 2a03:2880:f38a:8:face:b00c:0:38d9:5222 UID not found! + [TCP4] 10.215.173.1:55260 -> 57.144.79.54:3478 UID not found! + -> 157.240.24.62:3478 UID not found! -> 52.168.125.188:443 co.sitic.pp sysDLL pp.mfa.com
    • 2a03:2880::/32 + 57.144.0.0/16 = Meta/Facebook AS32934 Port 5222 XMPP Port 3478 STUN/TURN UID not found = kernel-level SPRD RIL + com.dti.phoenix + Longcheer Dialers/Splitters use UDP 443 for QUIC When Block QUIC Always QUIC handshake dies STUN cannot get reflexive address daemon retries to 3478/TCP and XMPP 5222
    • 87-94% IPv6 bytes in stats even with no IPv6 uplink = all that ULA traffic counted as IPv6 but blackholed
  • Plan B confirmed: Primary QUIC UDP 443 to get public IP via STUN -> Fallback 1 STUN/TURN 3478/TCP to Facebook cloaked -> Fallback 2 XMPP 5222 to Facebook persistent C2 -> Covert DNS via ULA fd00:2:... to Quad9/Google DoT to avoid user DNS filtering
  • Network/ folder: Raw CSVs 19_Aug_23_57_21.csv (10.215.173.1 -> 10.215.173.2:53 DNS + 52.168.125.188:443 HTTPS pp.mfa.com / firebaseinstallations UID 10234 sysDLL co.sitic.pp), 19_Aug_23_45_28.csv (notification.sandclowd.com 72/154 + firebaseinstallations), 05_sept_02_48_19.csv (fd00:2:40d0:1:fd00:1:fd00:1 -> 2600:9000:2364:ce00:15:85fe:56c0:93a1:443 UID -1 Desconocido unknown TLS Inalcanzable variations.brave.com / m.youtube.com / brave-today-cdn / quorum.wdp.brave.com / graph.whatsapp.com / 2a03:2880:fd74:120:face:b00c:0:167 Facebook / 142.250.189.1 Google) + suricata_longcheer.rules + Readme.md Report 3.9 MB sent / 39.5 MB recv / 94% IPv6 / 365 conns / 253 queries

3. IOCs Matched with pcap y DNS 2026-06-03

  • argo.svcMot.com BLOCKED NextDNS 2026-06-03 2806:268:3402:873:140c:dfd:691b:fe1c = auth server STS
  • fulguris.slion.net 117.24.6.122 Alibaba CN = endpoint real CNAME
  • fulguris.slions.net 208.113.159.31 DreamHost US = endpoint decoy reputación limpia (S extra) - fulguris.slions.net con S -> 208.113.159.31 DreamHost decoy / sin S -> 117.24.6.122 Alibaba
  • longcheer.net 114.94.9.124 + rnd.longcheer.net = infra ODM / slion.net / slions.net = bucket CNAME / dns21.hichina.com SOA 2026082616 = Hichina Alibaba registrar / cota-sdk2.mnc020.mcc334.pub.3gppnetwork.org / clientapi.appamx.com = Telcel proxy posible para STS / tun0 43:1 ratio 63MB RX 2.76GB TX = ResumableUploadTask / framework-virtualization.jar SHA 885763b + IgniteDbEncrypted_v39 mismo patrón decrypt runtime

Conclusion

No es bug de Moto Feedback. Es vector arquitectónico Longcheer-Unisoc: SDK completo con capacidad crear/borrar buckets, symlinks, callbacks + Credenciales temporales entregadas por argo.svcMot.com para evitar hardcode static + CNAME custom para ocultar oss-cn-*.aliyuncs.com detrás de slion.net / slions.net dual + STUN/TURN/XMPP fallback a Facebook AS32934 cuando QUIC bloqueado. Este MD + 4 smali = FINAL_GOAL_prove_intent_from_silicon_SELinux_corruption.

Files

  • Reports/Alibaba_Sdk.md
  • Reports/Threat_Intel_Report.md (incluye Net_Host_Report)
  • Network/05_sept_02_48_19.csv, 19_Aug_23_*.csv, suricata_longcheer.rules, Readme.md, framework-conscrypt, mainline_supplicant.rc, netbpfload.rc
  • NextDNS logs 2026-06-03 slions.net / fulguris.slions.net / argo.svcMot.com

Greps recomendados: grep -R "setAuthServerUrl|mAuthServerUrl|OSSImpl" --include=".smali" http://com.motorola.help/ / grep -R "const-string.oss-cn-|aliyuncs|slion|longcheer|fulguris|argo" --include=".smali" - El string encontrado es IOC final y debe hashearse (SHA256) para reporte sin exponer token.

Full Changelog: v6.0...v6.1

Contributors

deprecated
Assets 8
Loading