Privacy + Secure Tech Corner Channel 🛡

👍

Summary: • NextWheel is a fork of Treat Wheel by ThePedroo, a general-purpose root hiding module made to work with NextZygisk. • It's the app layer of the NEXT stack: NextWheel hides the Zygisk and root environment in apps, NextZygisk is the standalone Zygisk that loads it, and NextSUSFS hides traces at the kernel level. • It's a personal project, so use it at your own risk and keep a way to boot without modules (safe mode) before installing. • Features include C99 code, traceless hiding, low complexity, a live dashboard showing when hiding works or crashes, and support for NextZygisk and ReZygisk. • It shows NextSUSFS when installed and has a WebUI in 11 languages, including Arabic, for phones and tablets. • Requirements are Magisk Official, KernelSU Official (or API compliant), or APatch, plus NextZygisk or ReZygisk 508 or higher, and Android 7.1 or higher. • To install, download NextWheel.zip from Releases, install it from the root manager under Modules, reboot, and open the WebUI. • Support goes through this repository's issues, not the Treat Wheel developers, and no support is given if requirements aren't met. • The only setup needed is for RVU (ReVanced Umount): ReVanced modules must include a tw_config file with module_type=revanced and allow_umount=true. • NextWheel keeps Treat Wheel's module ID and data folder, so it installs over Treat Wheel and keeps its settings; only one of the two can be installed at a time. • It's built on the work of the Treat Wheel developers and The PerformanC Organization, and is licensed under AGPLv3.

👍

Summary: • NextSUSFS is a KernelSU module that hides root at the kernel level using SuSFS. • It's part of the NEXT stack, alongside NextWheel (apps layer) and NextZygisk (Zygote layer). • It automatically hides the NEXT stack folders and Zygisk libraries on every boot, plus AlwaysStrong, Play Integrity Fix and HMA-OSS. • It has a full WebUI with over 40 settings across 7 pages, covering paths, custom ROM traces, kernel identity, system properties, KernelSU, developer options and display. • You can add your own lists of paths to hide, re-hide, remove from memory maps, unmount for apps, or redirect. • The WebUI shows whether SuSFS is working, which kernel features are present, and the state of the NEXT stack. • Detection apps (Native Detector, TrustAttestor, KKND Detector) can be opened from the Tools page. • It includes logs, settings backup and reset to defaults. • It supports arm64, arm, x86 and x86_64, in English and Arabic, on phones and tablets. • Requirements: KernelSU or a fork (KernelSU Next, ReSukiSU, SukiSU Ultra) and a kernel patched with SuSFS v2. • Other SuSFS modules (susfs4ksu, SuSFS Manager, BRENE) must be uninstalled, and NextSUSFS disables them on install since only one can run. • Install from Releases via the root manager's Modules section, reboot, then open the WebUI. • It's a personal project, so keep a way to boot without modules (safe mode) before installing.

👍

Summary: • NextZygisk is a standalone version of Zygisk that runs Zygisk modules like LSPosed, Play Integrity Fix, Shamiko and Treat Wheel on KernelSU, ReSukiSU, Magisk and APatch, and hides root from apps you choose. • It's a fork of ReZygisk focused on faster app launches, robustness and accurate hiding, with a dashboard you open from your root manager. • It's a personal project: it runs as root inside Zygote, so a broken build can stop your phone from booting. Keep a way to remove modules before installing. • It keeps ReZygisk's module ID (rezygisk), installs over an existing ReZygisk as an update, and modules that need ReZygisk keep working. • Speed comes from answering the denylist and root checks from memory: loading Magisk policies and denylist once, parsing APatch's package_config once, and using one stat() for manager detection. • More than a dozen bugs are fixed, including a stack overflow in the status writer, a 100% CPU loop in the monitor, file descriptor leaks and double closes inside Zygote. • The dashboard has Home (live status, warnings, hiding modules, device info), Modules (real status per module and why it fails), Actions (monitor controls, root unmount switch, daemon query, live logs, diagnostics export, soft reboot) and Settings (themes, 8 accent colors, auto refresh, 15 languages including Arabic right to left). • The root manager's Action button prints the full status as text, which is useful on Magisk since it has no built-in WebUI. • It needs KernelSU kernel 10940 / ksud 11425, Magisk 26402 (with built-in Zygisk off), APatch 10655, or ReSukiSU / SukiSU / KernelSU Next; Android 7.1 or newer; arm64-v8a, armeabi-v7a, x86_64 or x86. • Two root solutions at once, installing from recovery, and Zygisk Next are not supported; Zygisk Next is disabled automatically during installation. • Download the release zip from Releases or from the latest successful GitHub Actions run, install it from storage in your root manager, read the install log, turn off… Read in full →

👍

Summary: • 333 infected Tor exit nodes started intercepting SSH and unencrypted mail on Friday Oct 2. That's about 10% of all exit relays. • The attackers broke into the servers in August and quietly installed Ebury 1.8.3, an OpenSSH backdoor and credential stealer for Linux. • If you got one of those exit nodes and tried SSH on port 22, you were redirected to one of 12 interception servers. You'd see a scary host key warning. • If you ignored the warning, they stole your password, watched every command you typed, and infected your server with Ebury too. • The author reported it to the Tor Project's network health team on Friday evening. • Over that weekend the relays got marked BadExit, users stopped exiting through them, and the servers got shut down. A clear dip in the Tor metrics since Oct 4 hasn't recovered. • The author found the nodes by scripting exitmap to test SSH fingerprints across all ~3000 exits. Some served fake fingerprints; over 300 redirected to the same interception servers. • A honeypot showed the attackers used paramiko and tried to install Ebury with a base64-encoded Perl command after checking sudo permissions. • Nobody knows how they got into the servers. One theory is the hosting company was hacked. • No one is sure who's behind it, but Ebury and the data collection suggest a financially motivated crime group. • The author thinks they picked a Friday on purpose, hoping nobody would respond over the weekend. • The takeaway: disable password authentication and use SSH keys, ideally hardware keys. Treat relays as highly targeted production machines.

👍

👍

👍

👍

FinaSU v1.0.5 Official Version Released: Kernel Updated with Brand-New Dynamic Interactions This update focuses on improving page navigation, theme consistency, and kernel compatibility. Interface & Interactions 1. Added position-based container transitions: Pages expand from the clicked card or button, and return to the exact same origin position when navigating back. 2. Improved predictive back gestures: Quick fling, slow-drag commit, and slow-drag cancel no longer cause rebound or repeated shrinkage. 3. The installation page now supports smooth expansion from the install button in the top bar of the home screen and from the status card. 4. Wallpaper mode uses independent transitions to avoid interference with container transformations in normal mode. 5. Unified frosted glass appearance, removed the old liquid glass rendering path, and optimized the selected material and back button fill in wallpaper mode. 6. Refreshed the display of theme setting names and category color schemes. Features & Stability 1. The home screen now displays the actual module mounting implementation and includes the number of plugins in the statistics. 2. Fixed an issue where custom sorting was lost when the module list temporarily returned empty. 3. Fixed the retry flow for boot patch mode after failed attempts. 4. The installation page no longer blocks kernel modules that have not yet been loaded; related statuses are determined by actual runtime results. 5. Improved synchronization between app lock credential storage and theme store settings. Kernel & Compatibility 1. Adapted to the execveat SELinux setup for Android 17 QPR3. 2. Adapted to kernel function changes in Linux 6.19+. 3. su_mount_ns now uses ksyscall to invoke ksys_unshare. 4. Fixed init.rc recognition in bind mount scenarios. 5. Updated version handling in the ksud boot patching logic. Open-source repository: https://github.com/LyraVoid/FinaSU

👍