Vision: Amnesty International Security Lab MVT in GrapheneOS?

proBro

After trying out the Mobile Verification Toolkit, provided by Amnesty International Security Lab, to find indications of compromise with Pegasus and similar spyware on the phone I got this bedtime vision:

What if known indicators of compromise could be found within GrapheneOS per default?

I live in Sweden and authorities now gets permission to tap and collect information electronically without direct suspicion of crime. In other words you can know, be related to or work with someone that is a suspect and be targeted because of that. It used to be regulated to suspicion of a crime giving 2 or more years prison penalty for compromising the microphone and 5 or more years for compromising camera and microphone (if I remember the exact figures correct).
Source: https://www.svt.se/nyheter/inrikes/rikspolischefen-over-30-gripna-med-hjalp-av-ny-avlyssningslag

This whole topic is very scary in regards to personal integrity and human rights. The process to check your phone is a bit complicated for a non technical person, hence this whole idea.

Forensic indicators for Pegasus and other zero clicks identified on Android and iOS can be found here:
https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/

Mobile Verification Toolkit and other tools and guides can be found here:
https://securitylab.amnesty.org/tools-and-guides/

The GitHub project with MVT, Android Quick Forensics and known indicators can be found here:
https://github.com/mvt-project/

I have been trying MVT in Debian on a Pixel 6 Pro with GOS "for fun". I came out clean :)

Thoughts?

GrapheneOS

GrapheneOS focuses on preventing the exploits from working in the first place. It doesn't make sense to hard-wire detection for legacy exploits which didn't work with GrapheneOS. They'd almost certainly need to specifically target GrapheneOS, in which case they would work around any standard detection included in the OS. The only value it can offer is detecting leftover signs of past exploits which weren't done in a stealthy way avoiding evidence to find. The companies which made the exploit payloads are certainly aware of these detection tools and aren't going to keep doing it in a way that they know how to detect. They'll only ever be able to add detection for new payloads after they've been used and analyzed. Hard-wiring checks for specific well known, legacy exploit payloads is not an approach we're going to use. Our approach is primarily securing the device against attacks and to a lesser extent defending against persistence including generic detection for unknown payloads rather than hard-wired checks for legacy payloads that are not being actively used.