Pinned Tweet
v3.0 unisoc-framework.jar: ODM Framework Extension (Complete Decompile)
github.com/lexs201992-gif/Sy…
v6.0:** Biometric data exfiltration vector identified in Goodix fingerprint factory tool.
github.com/lexs201992-gif/Sy…
unisoc-framework.jar — ODM Framework Extension (Longcheer/Unisoc)
github.com/lexs201992-gif/Sy…
Glance (InMobi) — System-Embedded Ad Platform
OEM: Motorola (also Realme — shared SDK) Device: moto g04s, Android 14, build ULAS34.89-209-4 Package: com.glance.lockscreenM (device feature, not app)
github.com/lexs201992-gif/Sy…
Alex de la cruz retweeted
半導体メーカーのMediaTekが自社チップセットの脆弱性31件を公表し、モデムの2件は偽の基地局を通じて遠隔から権限昇格につながる可能性があるとしています。深刻度「Critical」とされたこの2件の原因は、モデム(携帯電話網との通信を担う部分)の境界チェックの欠如。書き込み先が確保済みの領域に収まるかを確かめないため、領域の外へデータを書き込む「範囲外書き込み」が起こり得るとの内容です。
MediaTekがCVEに登録した説明では、攻撃者が管理する偽の基地局に端末が接続した場合に追加の実行権限なしで悪用でき、利用者の操作も不要。全31件は修正パッチとともに公開の少なくとも2か月前に端末メーカー(OEM)へ通知済みで、実環境での悪用は認識していないとMediaTekは説明しています。
【要点の整理】
・深刻度の内訳はCritical 2件、High 9件、Medium 20件で、MediaTekはCVSS v3.1に基づいて評価。31件のうちモデム関連は11件
・Critical 2件はCVE-2026-20519とCVE-2026-20520で、いずれもMediaTekの社内で発見。対象チップセットは57種
・CISAがこの2件のCVEレコードに付加したCVSS v3.1の基本値は7.5(High)で、攻撃元区分は隣接ネットワーク、攻撃条件の複雑さは高。MediaTekの深刻度区分とは異なる評価
・High・Mediumの29件は、モデム、動画処理、表示などが対象。記載内容は範囲外の書き込み・読み取り、メモリ破壊、権限昇格、システムクラッシュ、情報漏えいの可能性など
・対象チップセットはCVEごとに異なり、一覧は作成時点の情報で完全でない可能性があるとの注記
(※可能な範囲でファクトチェックは実施済なものの、元記事の精度依存や速報・要約の性質上漏れもありうるため、正確な情報は一次情報を直接参照のこと)
詳細は以下を参照:
mediatek.com/product-securit…
v1.0 Passpoint Auto-Join: Confirmed in Smali
## Passpoint Auto-Join: Confirmed in Smali
**Class:** `UniWifiCarrierNetworkManager`
**Package:** `com.unisoc.wifi` (UID 1000, process="system")
**Source:** `UniWifiCarrierNetworkManager…`
### Mechanism
The class implements **dual-path** WiFi network pre-configuration:
1. **Modern path** (Android 10+): `WifiNetworkSuggestion` with
`setIsInitialAutojoinEnabled(true)` → device auto-connects without user
prompt or consent.
2. **Legacy path** (Android < 10): `WifiConfiguration` + `addNetwork()` +
`enableNetwork()` → same effect (UID 1000 bypasses permission checks).
### Passpoint Profile Construction (`createPasspointConfig`)
| Field | Source | OTA-updatable? |
|-------|--------|:---:|
| FQDN | `securityArray[0]` (carrier config or hardcoded resources) | Carrier config: ✅ / Resources: ❌ |
| FriendlyName | `securityArray[1]` | Same |
| IMSI | Device SIM (`TelephonyManager`) | ❌ (physical) |
| EAP Type | `securityArray[2]` (integer) | Same |
| Realm | `securityArray[3]` | Same |
The profile uses **SIM credential** (not certificate) — the device
authenticates to the Passpoint network using its IMSI. This means:
- The Passpoint network is tied to the **subscriber identity** (IMSI)
- A device with a Telcel SIM will auto-join Telcel Passpoint networks
- A device with a Tigo SIM will auto-join Tigo Passpoint networks
- The carrier can change FQDN/realm/EAP via carrier config OTA (no FOTA)
### Carrier Gate (`isCarrierIdMatch`)
The class only acts for carriers in `mUniWifiCarrierIds` (a string array
from resources, `0x7f010000`). If the SIM's carrier ID is not in the list,
`loadCarrierConfig()` is a no-op.
**Implication:** The carrier config OTA vector only affects devices with
SIMs from carriers in the whitelist. For kiosk devices (WiFi-only, no SIM),
only `loadUniWifiConfig()` (hardcoded resources) applies.
### Boot Sequence (confirmed)
UniWifiController.handleBootCompleted()
→ UniWifiCarrierNetworkManager.handleReceiveBootCompleted()
→ lambda$0()
→ loadUniWifiConfig() [hardcoded SSIDs from resources]
→ loadCarrierConfig() [carrier SSIDs from CarrierConfigManager]
Both are called **immediately in the constructor** (via `handleBootCompleted()`),
not on `BOOT_COMPLETED`. Pre-unlock, pre-user-interaction.
### Forensic Verification
```bash
# Check active network suggestions (auto-join)
dumpsys wifi | grep -A5 "NetworkSuggestion"
dumpsys wifi | grep "isInitialAutojoinEnabled"
# Check Passpoint profiles
dumpsys wifi | grep -A30 "Passpoint"
# Check carrier config (what SSIDs the carrier pushes)
content query --uri content://telephony/carrier_config | grep -i "wifi\|ssid\|passpoint"
# Check if carrier ID matches
getprop | grep -i "carrier_id"
# Compare against mUniWifiCarrierIds (decompile resources.arsc)
Alex de la cruz retweeted
#Entérate 🚨ISAIAS YA ES HURACÁN🚨 EL PRIMERO DE LA TEMPORADA EN EL ATLÁNTICO
El huracán #Isaias se ha convertido en el primer huracán de la temporada 2026 en el Atlántico. Actualmente tiene vientos máximos sostenidos de 130 km/h (80 mph) y una presión mínima de 975 mb.
Se espera que #Isaias continúe fortaleciéndose durante las próximas 24 horas, pudiendo alcanzar vientos cercanos a 175 km/h (110 mph), antes de comenzar a debilitarse al acercarse a la costa. Pero, el pronóstico indica que Isaias llegará a la costa norte del Golfo durante el viernes, todavía como huracán.
🔴 Hay Aviso de Huracán desde Ocean Springs en Mississippi hasta el límite entre los condados de Bay y Gulf en Florida. También permanece vigente un Aviso de Marejada Ciclónica desde la desembocadura del río Mississippi hasta Steinhatchee en Florida.
⚠️ Además de los vientos y la marejada ciclónica, se esperan fuertes lluvias e inundaciones. Es muy probable que algunas zonas podrían experimentar cortes de electricidad prolongados.
Informe de Seguridad Público & Evidencia Forense: Planos de Control ODM en WiFi/Telefonía
github.com/lexs201992-gif/Sy…
Alex de la cruz retweeted
🚨 🇺🇸 FBI seizes seven domains supporting China linked hacking tools
The Justice Department and FBI have disrupted infrastructure used to operate Microscan and FishHub, two tools associated with “Flax Typhoon” and China based Integrity Technology Group.
Microscan used a Mirai malware botnet to search networks for vulnerabilities that could later be exploited. Targets included a South Carolina power company, airports in Japan and Poland, Taiwanese energy companies, universities and a multinational NGO.
FishHub supported spear phishing operations and delivered malware capable of providing remote network access, searching for files and transferring them to attacker controlled servers.
Confirmed FishHub victims included approximately 20 Taiwanese universities.
This is the second public disruption of Integrity Technology Group infrastructure. A 2024 operation dismantled a related Mirai botnet containing more than 200,000 compromised devices.
Domains Seized:
c0cc[.]cc
98aicai[.]com
98aiblog[.]com
98aicode[.]com
linkedinns[.]net
outlook3650[.]com
youtubecard[.]com
Source: justice.gov/usao-wdpa/pr/jus…
V2.0 The rise of the hydra in the low gama
A Whitepaper on Factory-Embedded ORB Architecture in Unisoc T606/T616 Devices
v2.0
Author: lexs201992-gif
Date: September 2026
Classification: Public (Github)
#longcheer #unisoc #odm #C2 #Adware #Spyware #Devices #Latam
github.com/lexs201992-gif/Lo…
v1.0.0 - LogiaDeck Ronen Method - Digital Turbine Ignite Pre-Installed Backdoor - Critical 9.8
DIGITAL TURBINE IGNITE v1.0.0 - LogiaDeck Dissection
GHSA-3f3x-wg5j-gq57 | Critical 9.8 | CVE Pending
Supply chain pre-installed backdoor found in Telcel / America Movil devices.
Advisory
🔗 github.com/lexs201992-gif/DI…
CVSS: 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - 9.8 Critical
CWE: CWE-327, CWE-798, CWE-829
Packages: com.digitalturbine.ignite, com.dti.amx <= 39
Evidence in this release
DecEncryptor.smali - hardcoded rawSecretKey + IV token $ -> format $!b64(iv)$b64(cipher) - AES/CBC bypass
LegacyUUIDHelper.smali - combinedUdidWithTrackingId() -> persistence via UDID:trackingId - T1582
IgniteDatabaseOpenHelper.smali - Encrypted DB with trackingId/UDID
ServerRequest/Response.smali - C2 over play.googleapis.com 0/89 detection bypass
MITRE ATT&CK
T1071, T1095, T1105, T1571, T1573, T1582, T1593
Credits
Analyst: lexs201992-gif
Method: Ronen Method + LogiaDeck
VT: 000000a512a8 24/69
github.com/lexs201992-gif/DI…
Alex de la cruz retweeted
🚨 Hoy en ciberseguridad México:
🔴 Guanajuato apagó sus 147 kioscos de trámites desde el 2 de octubre por un "incidente informático".
Actas, CURP, trámites vehiculares, pagos. Todo abajo.
¿Vector? No dicen.
¿Datos comprometidos? No dicen.
Quinto incidente en instituciones de Guanajuato este año.
🔴 SLP y Jalisco: un mismo grupo publica en foros bases que atribuye a ambos gobiernos. Nombres, domicilios, claves tipo CURP/INE.
Ningún gobierno ha dicho nada.
🔴 Movimiento Antorchista: venden 596,652 registros de su padrón. INE, CURP, teléfono y hasta historial médico.
Silencio oficial. Cero detalle técnico. Tus datos en un foro.
Digital Turbine Announces Exclusive
Collaboration with Motorola
d1io3yog0oux5.cloudfront.net…
Alex de la cruz retweeted
$APP
@FuzzyPandaShort Let's be precise about what happened today.
San Diego County, not a state, filed a civil complaint in state court. It's allegations. Nothing has been tested in court yet. Explicit ads reaching kids is serious, and if the county proves it, APP should pay and fix it. Nobody serious defends that.
But "multiple state AGs" has been "coming" for a year. In Oct 2025 the NY Post said staff from the Delaware, Oregon and Connecticut AGs were calling short sellers. A year later I haven't seen a single state AG lawsuit, and APP said at the time it hadn't even been contacted. The SEC probe was reported Oct 2025 and confirmed "active" in Feb 2026. No charges or settlement have been disclosed.
Size it correctly too. California's unfair competition law allows penalties of up to $2,500 per violation. That can be real money, but these cases usually end in a settlement and compliance changes. And even if AGs pile on: 40+ states sued Meta in 2023 over harm to kids, and Meta kept compounding.
Now "we warned you." Your Feb 2025 report is 20 months old, so we can now go through your statement and see if they even came to fruition.
Your thesis was that APP's growth was "built on ad fraud," Meta's stolen data and silent "direct downloads." If that were true, the numbers should have broken. They didn't, and this is audited cash, not adjusted fluff:
FY25 revenue: $5.5B (+70%)
Q2 26 revenue: $1.92B (+53%)
Q2 26 GAAP net income: $1.27B
TTM FCF: $4.5B, with ~$2.5B spent on buybacks
"Direct Download = top revenue driver"
APP shut Array down in Q2 2025, and T-Mobile and Samsung both ended their partnerships. If your "top revenue driver" got killed, revenue should have cratered. Instead FY25 grew 70% and Q2 26 grew 53%, with net revenue per install up 58%.
"Stealing Meta's data" / "Meta will shut it down"
20 months later there has been no public Meta cutoff or action. Meanwhile APP's consumer advertiser spend hit a record in Q2 26, 28% above the Q4 25 holiday peak, and Store Leads data via Citi counts ~14,600 e-com accounts on AppLovin Ads. If APP were just copying Meta's homework, Meta could have ended it with a config change. It didn't.
And on MAX "seeing Meta's bids": Adam has said MAX only uses the standard win/loss notifications every bidder gets, and that bid-stream data is kept separate and purged after seven days. If you have evidence otherwise, post it.
Your 12.78 std dev "study" came from an unnamed expert, and nobody outside can check it. Two ad platforms trying to find people who buy the same wallet will correlate. That's two models doing their job, not theft. And Ridge is an AppLovin Ads advertiser. You visited ridge.com and then saw Ridge ads. Ridge knows who visits its own site. The simplest explanation is retargeting, not Meta.
"Ad fraud" / ads that click themselves
APP's advertisers are performance buyers who measure installs against downstream revenue through their own measurement partners. Junk installs don't pay back, and ROAS-driven budgets get cut. Instead advertisers kept scaling: Tenjin Q2 26 has APP's ad revenue share rising 39%→44% on iOS and 19%→23% on Android. Fraud doesn't compound for three years under that kind of measurement. And Ben Edelman, your outside expert, has disclosed a short position in APP.
(1/2)
We warned you about $APP
San Diego suing Applovin for serving sexual ads to kids
Don't be surprised if multiple state AGs file similar lawsuits in the near future
Alex de la cruz retweeted
Nueva vulnerabilidad detectada en el módulo InMobi de Android bit.ly/1eFQ715
Alex de la cruz retweeted
U turns from the Chinese Market
These companies did give it a go in China, but they gave up (or were driven away)
Remarkable that @riteshagar @oyorooms and @NaveenTewari @InMobi are able to hack Chinese market.
Have a look! – at Gurgaon, India















