#speakingstone — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #speakingstone, aggregated by home.social.
-
After disclosing ENDLESSDOORS this month, @albinolobster began researching the global ZBT router supply chain. He expected to find more ENDLESSDOORS.
Instead, he found two totally different implants: #DARKLANTERN and #SPEAKINGSTONE.
DARKLANTERN is a backdoor that listens on the WAN and executes arbitrary commands. VulnCheck Target Intelligence found DARKLANTERN in 22 countries worldwide, primarily in the United States.
SPEAKINGSTONE is a phone-home implant that can execute commands as root, redirect DNS traffic, and open remote-access tunnels. It had a hard-coded C2 backup domain that was unregistered at time of discovery. So @albinolobster registered it, and hundreds of implants started calling in.
Callbacks to the VulnCheck-sinkholed domain came almost exclusively from China (83% came from China Mobile's network). In other words, SPEAKINGSTONE is domestic surveillance technology that made its way into the global supply chain.
https://www.vulncheck.com/blog/zbt-darklantern-speakingstone