Security implications of using a GOS Pixel 3a as a mobile router

N1b

I still have my old 3a with the latest available GOS version based on Android 12 (2023020600).

Nowadays I use it exclusively as a hotspot for my unlimited Telekom mobile internet subscription and nothing else. What are the security implications of this? What could a threat actor without physical access to the device do?

I considered the following ideas for what to do next based on your answers:

Stay on GOS because security ramifications are negligible.
Switching to DivestOS so I get at least software updates.
Switching to a dedicated mobile router such as the GL.iNet MUDI V2 and use the 3a for shenanigans like testing Ubuntu Touch.

I'm looking forward to your advice and ideas. :)

X43

N1b assuming the device is legit (proper install from trustworthy source, no browsing on device) it's good. no remote control options.. Might be safer than setting up mudi right actually

GrapheneOS

N1b It's highly insecure and shouldn't be used for anything with the radios enabled or internet access enabled. You'll still be missing all the firmware security patches and nearly all driver security patches if you use DivestOS. There's no OS you can put on it where it will have full security patches. Strongly recommend putting it permanently into airplane mode with all radios disabled and the toggles removed from quick settings to use it solely as an offline device updated via USB. Doesn't really matter what you run on it.

N1b

X43 yes the device came from Google directly and I installed GOS via web install from another GOS device. Not sure how much more legit it can get.

missing-root

A router "only" connects you to the Internet afaik. It does not contain private data, and especially when using a VPN only encrypted data travels through it.

It is permanently online, just like most phones, no open ports etc.

There are for sure attack vectors just like for your phone itself. And I am sure a hacked router would still cause problems.

But it is way better than a

hacked phone
hacked DNS server
hacked webserver

[deleted]

I would strongly advise against using a Pixel 3a, as its support ended over 2 years ago, leaving the device vulnerable to numerous unpatched vulnerabilities. This poses significant security risks that should be taken into consideration.

DivestOS is a harm reduction project aimed at minimizing risks, and it is not foolproof either. Additionally, it is worth noting that neither DivestOS nor GrapheneOS can provide firmware updates for the Pixel 3a, as Google no longer releases them for this device.

https://endoflife.date/pixel Click Show more unmaintained releases to see Pixel 3a

N1b

To add to my original post: I think that using a 3a which doesn't receive firmware/kernel updates is not a good idea for an always online route compared to a new, maintained Pixel running GOS. I just wonder how it compares to the MUDI security-wise (given the many security features of AOSP in general and GOS specifically).

My best bet for now would be to just use a MUDI router and forget about the 3a as a useful device, which is sad as it's in perfectly usable condition and would work for 5 or more years to come if I wasn't for the lack of OEM support...

GrapheneOS

@nulandroid Both of those operating systems are missing half of the privacy/security patches. It's a highly insecure device and shouldn't be used anymore. Please stop promoting things on our forum. Thanks.

N1b

GrapheneOS thanks for taking the time to reply to this old question of mine. It's exactly what I ended up doing and now I have an overpowered MP3 player for situations I want to listen to audio books but not take my phone around.