Detection
Due to the silicon-anchored nature of the backdoor, no mitigation is available. The backdoor cannot be removed via OTA or user-space modifications.
Endpoint Detection (Velociraptor VQL)
The following VQL rule detects the presence of the backdoor by monitoring critical kernel device nodes:
// Project LION: Detection of Longcheer/Unisoc Silicon-Anchored Backdoor
// Target: Unisoc T606/T616/SC9863A (Moto G04s, E13, etc.)
// Detection: Kernel-level permissions for TEE, RPMB, GNSS, and Camera
LET critical_nodes = SELECT
Node,
Mode,
Owner,
Group
FROM pslist()
WHERE Name IN ('ueventd', 'init', 'system_server')
LET device_permissions = SELECT
Path,
Mode,
Owner,
Group
FROM glob(globs='/dev/trusty-ipc-dev0,/dev/rpmb0,/dev/block/by-name/gnssmodem_a,/dev/sprd_isp')
LET suspicious_rc_files = SELECT
Path,
Hash,
Size
FROM glob(globs='/system/vendor/etc/ueventd.rc,/odm/etc/ueventd.rc')
// Alert if critical device nodes exist with system UID permissions
SELECT
'PROJECT-LION: Silicon-Anchored Backdoor Detected' AS Alert,
device_permissions.Path AS Evidence_Node,
device_permissions.Mode AS Evidence_Mode,
device_permissions.Owner AS Evidence_Owner,
suspicious_rc_files.Hash AS Evidence_RC_Hash
FROM device_permissions
WHERE device_permissions.Owner = 'system'
AND device_permissions.Mode IN ('0660', '0666')
AND device_permissions.Path IN (
'/dev/trusty-ipc-dev0',
'/dev/rpmb0',
'/dev/block/by-name/gnssmodem_a',
'/dev/sprd_isp'
)
Detection Due to the silicon-anchored nature of the backdoor, no mitigation is available. The backdoor cannot be removed via OTA or user-space modifications.
Endpoint Detection (Velociraptor VQL) The following VQL rule detects the presence of the backdoor by monitoring critical kernel device nodes: // Project LION: Detection of Longcheer/Unisoc Silicon-Anchored Backdoor // Target: Unisoc T606/T616/SC9863A (Moto G04s, E13, etc.) // Detection: Kernel-level permissions for TEE, RPMB, GNSS, and Camera
LET critical_nodes = SELECT Node, Mode, Owner, Group FROM pslist() WHERE Name IN ('ueventd', 'init', 'system_server')
LET device_permissions = SELECT Path, Mode, Owner, Group FROM glob(globs='/dev/trusty-ipc-dev0,/dev/rpmb0,/dev/block/by-name/gnssmodem_a,/dev/sprd_isp')
LET suspicious_rc_files = SELECT Path, Hash, Size FROM glob(globs='/system/vendor/etc/ueventd.rc,/odm/etc/ueventd.rc')
// Alert if critical device nodes exist with system UID permissions SELECT 'PROJECT-LION: Silicon-Anchored Backdoor Detected' AS Alert, device_permissions.Path AS Evidence_Node, device_permissions.Mode AS Evidence_Mode, device_permissions.Owner AS Evidence_Owner, suspicious_rc_files.Hash AS Evidence_RC_Hash FROM device_permissions WHERE device_permissions.Owner = 'system' AND device_permissions.Mode IN ('0660', '0666') AND device_permissions.Path IN ( '/dev/trusty-ipc-dev0', '/dev/rpmb0', '/dev/block/by-name/gnssmodem_a', '/dev/sprd_isp' )
Longcheer operates on a high-volume, low-margin model (1.35% net profit margin) that relies on opacity rather than transparency.
So an hardware backdoor by China in a chip used by some smartphones and tablets...
How many devices are affected? Tens of millions?
[dead]
[dead]