Detection Due to the silicon-anchored nature of the backdoor, no mitigation is available. The backdoor cannot be removed via OTA or user-space modifications.

Endpoint Detection (Velociraptor VQL) The following VQL rule detects the presence of the backdoor by monitoring critical kernel device nodes: // Project LION: Detection of Longcheer/Unisoc Silicon-Anchored Backdoor // Target: Unisoc T606/T616/SC9863A (Moto G04s, E13, etc.) // Detection: Kernel-level permissions for TEE, RPMB, GNSS, and Camera

LET critical_nodes = SELECT Node, Mode, Owner, Group FROM pslist() WHERE Name IN ('ueventd', 'init', 'system_server')

LET device_permissions = SELECT Path, Mode, Owner, Group FROM glob(globs='/dev/trusty-ipc-dev0,/dev/rpmb0,/dev/block/by-name/gnssmodem_a,/dev/sprd_isp')

LET suspicious_rc_files = SELECT Path, Hash, Size FROM glob(globs='/system/vendor/etc/ueventd.rc,/odm/etc/ueventd.rc')

// Alert if critical device nodes exist with system UID permissions SELECT 'PROJECT-LION: Silicon-Anchored Backdoor Detected' AS Alert, device_permissions.Path AS Evidence_Node, device_permissions.Mode AS Evidence_Mode, device_permissions.Owner AS Evidence_Owner, suspicious_rc_files.Hash AS Evidence_RC_Hash FROM device_permissions WHERE device_permissions.Owner = 'system' AND device_permissions.Mode IN ('0660', '0666') AND device_permissions.Path IN ( '/dev/trusty-ipc-dev0', '/dev/rpmb0', '/dev/block/by-name/gnssmodem_a', '/dev/sprd_isp' )

So an hardware backdoor by China in a chip used by some smartphones and tablets...

How many devices are affected? Tens of millions?

[dead]