Build log · Software & apps

Universe Browser — the privacy browser owned by the network it was built for

Software & appsdone1 versionsMalware analysisAndroid APKDNS + WHOIS forensicsStatic analysisSite archive
📄 Raw spec (.md)📁 Portfolio

reflection not written yet · every fact below is generated from this project’s own spec and files

What it is

ub66.com advertises the fastest, most private, safest browser — and sells it to people who need to get around a block. Infoblox and UNODC reverse-engineered the Windows build in October 2025 and found keylogging, silent background installs, disabled sandboxing and traffic routed through China. My own static analysis of the current build goes further: the Android package is literally bbin.mobile.browser, signed by a self-signed cert with O=bbin and CN=kingsley, shipped debuggable, and asking for contacts, accounts, credentials, precise location, silent downloads and permission to install further apps. The exclusive acceleration technology is a Go SSH tunnel with RC4 framing whose endpoints are distributed over DNS TXT records and hardcoded to Alibaba Cloud in Shenzhen. Includes an inert archive of the landing page with every network call cut.

Version history

Straight from the project’s own card data — what each version added.

V1

Keylogging and runtime behaviour are Infoblox/UNODC findings — I did static analysis only and never executed either binary.

Files on the site

What broke, and what I’d change

Not written yet. This is the part only I can write — what actually went wrong, and what I’d do differently. It lives in builds/reflections/ub66-teardown.md (see _TEMPLATE.md); as soon as that file has words in it, this section fills in on the next build.

Everything else on this page — the spec, the version history, the file counts — is generated from the project’s own build notes and files, so nothing here is guesswork.

Build spec

The project’s own build notes, rendered. Open the raw .md ↗

Show the spec

Build spec — Universe Browser (ub66.com) teardown + inert archive

Goal

A single-page security write-up on ub66.com / 寰宇瀏覽器 / "Universe Browser", published on the portfolio, plus a byte-faithful but disarmed archive of the live landing page rendered in a phone frame on the same page.

Deliverables

demos/ub66-teardown.html      write-up page; exhibit at #mirror inside a 390px phone frame
demos/ub66-mirror/            archived landing page + assets + guard.js
prompts/ub66-teardown-prompt.md

Structure of the write-up

  1. Verdict banner (red) — do not install.
  2. What the site claims (its own three promises, EN + 中文).
  3. What independent researchers found — Infoblox + UNODC, Oct 2025; WIRED / Android Authority /

    4. Gadgets 360 coverage; the Vault Viper / BBIN attribution.

  4. What I verified myself — the original work:
  • hosting: Google Cloud Storage bucket behind CloudFront, AWS Route 53, GoDaddy registration 2014;
  • download chain: download.html → files/files.json → cdn.n4dhx7bt.com;
  • the CAPTCHA is client-side only (getRandomNumber() compared in the same page) and the

    • download is delayed by a random 500–1500 ms — sandbox evasion;

  • payload host mints a fresh Last-Modified on every request (anti-forensics), with the three

    • measured timestamps shown;

  • Windows launcher: PE32, UPX-packed, no code signature, SHA-256;
  • Android APK: package bbin.mobile.browser, self-signed cert O=bbin, CN=kingsley, debuggable=true,

    • SHA-256, 6,078 files, Chromium 120 base;

  • permissions table with the dangerous ones called out (contacts, accounts, credentials,

    • location, silent downloads, install-packages, boot autostart);

  • the "acceleration" is libgojni.so — a Go SSH tunnel ("dududu") with RC4 "teapot" framing,

    • DNS-TXT failover, and a local database of visited domains;

  • hardcoded Alibaba Cloud endpoints (Shenzhen ×2, HK) + AliDNS 223.5.5.5, geolocated;
  • live dig ub66.com TXT tokens — the failover channel;
  • iOS: 寰宇浏览器安全版, seller CYBERLAND GAME STUDIO, bundle com.bbin.Titanic, 2.99/5 (620),

    • updated 2026-10-14; older app id1109296472 delisted; not on Google Play.

  1. An honest correction: no VpnService — it proxies only its own browser traffic, not the

    2. whole device. Say so; the press headlines over-read this.

  2. Threat model (who is harmed).
  3. The archive (§mirror) + what was changed.
  4. Remediation if already installed; alternatives.
  5. Method, hashes table, and an explicit limits box separating my findings from Infoblox's.

Archive rules (important)

  • Capture with wget -p -k -E -H --no-parent; flatten www.ub66.com/ to the folder root.
  • Delete the captured www.googletagmanager.com/ asset folder and strip both GA tags

    • (UA-105143657-1, G-CE11RD4VBG) from index.html and download.html — no beacons to the operator's analytics from this site.

  • Add guard.js as the first script in <head> on both pages:
  • block all cross-origin requests, XHR, fetch, WebSocket, sendBeacon;
  • block same-origin /files/ and /download/;
  • intercept clicks on anything download-ish and show a toast instead;
  • stub location.assign/replace for blocked URLs;
  • install a permanent "ARCHIVED COPY" bar.
  • Never host the APK or the EXE. Publish hashes only.
  • Keep the archive visually byte-faithful: same CSS, same images, same i18n JS, same fake captcha.

Verification (must pass before deploy)

Headless Chromium against a local static server:

  • archive: title loads, 2/2 images, #__archive_bar present, 0 external requests;
  • download button click → toast appears, URL unchanged, no navigation;
  • download.html renders the canvas CAPTCHA and makes 0 external requests;
  • write-up: 0 horizontal overflow at 390 / 430 / 900 / 1280 px;
  • iframe resolves ./ub66-mirror/index.html and its inner click/toast behaves.

Pitfalls hit

  • loading="lazy" on the exhibit iframe means the archive never loads until scrolled to — drop it.
  • Long inline heredocs / srv.shutdown()-style one-liners get blocked by the command guard; write

    • the Playwright check to /tmp/*.py and run the file.

  • strings -e l is GNU-only; macOS strings rejects -e. Use a small Python AXML parser for the

    • binary AndroidManifest.xml instead.