Linux community had a reality check

Bismark

Given the close call with the recent bad actor putting some code into a package he was maintaining (this is not the first), are there any thoughts about how grapheneOS updates. I myself think its risky when a update hits, I assume most GOS phones download and install instantly if the two toggles are off (require battery above % and require device to be plugged in).

Maybe you may have only a couple devs with access to the update server, but still all it takes it one of the many maintainers of packages to sneak somthing in, the host of the vps to backdoor, or a few other ways and change a update to rm -rf /something. I am certainly no expert, but maybe this recent event should entertain a slower roll out of instant updates, imo maybe a msg that a update is available and to download it at your liesure? I am sure the bad actors out there know exactly who they need comprimise to get access to the updates server. It could be they see GOS as competition, or pherhaps they are to good at their job? I often think about too when you update Linux, pherahps a bad state actor takes your servers static IP4 address and when you update the packages your server gets routed to a compromised special package (just for your IP only) on the update server.

It just seems so risky to me to have everyones phone on seek and destroy, I mean seek and update immediatly. I myself usually keep the the updater app disabled, but that is a few clicks to accomplish. I really want the best for GOS, I think its very very nice. I dont mean to be rude just maybe the rockstars of coding could give their 2 cents.

de0u

Bismark I often think about too when you update Linux, pherahps a bad state actor takes your servers static IP4 address and when you update the packages your server gets routed to a compromised special package (just for your IP only) on the update server.

Every GrapheneOS release is signed, and the signature is checked by the old GrapheneOS before it installs the new one. If the update server were compromised, or your device were redirected to an alternate server, your device would still check whatever it downloaded against the GrapheneOS signing key for your device type. I believe all Debian packages are signed in a similar fashion.

The XZ attack was so alarming because it was deliberate action by an insider (a developer with the ability to sign releases).

tornsail-smllwng

Bismark

My take on this, little worth that it has, short version:

I knew I needed to move to Android in some form but I wanted to control and limit what Google was doing in the background on my phone's OS.

I read the GOS documentation at https://grapheneos.org/features and https://grapheneos.org/usage and https://grapheneos.org/faq and I just knew that I could trust the thoughtful person behind that documentation more than anyone else ... (or any of the 'ROMs') ... to deliver me a mobile OS that I would be using every day for email and banking.

long version, continued:

Okay, this doesn't protect me from nation state actors, but I'm fortunate that that is not in my threat model. With GOS and its transparent, well defined documentation ... I just have the great feeling that I have some understanding and control over how my phone works and what background processes are running; much better than with Pixel Android or other AOSP derivatives.

Why would a nation state waste a valuable exploit on insignificant me? Reading the docs, I trust the GOS devs to do a better job than anyone else to protect me from lesser threats. The big threat to worry about is always third party apps ... that is where GOS really shines in being able to reason about how to install third party apps for safety - secondary profiles, storage scopes, vpn, private dns etc. I suggest this is where you should focus your energies.

And don't forget that GOS is built on Android/AOSP and the security model (SElinux policy) underpinning AOSP is probably the best you will find on any readily available client computing device anywhere, ever.

Where else can one go anyway?

This is why donating to GOS is really important for those of us lucky enough to be able to afford to do so and hence helping those less fortunate as well. It is also why GOS' generous 'extended support for harm reduction' is so good because second hand Pixels can become more affordable, even in developing economies, after two or three years.

tornsail-smllwng

Bismark Sorry but I'm going to repeat this as a shorter message:

I trust the GOS devs to do a better job than anyone else to protect me from lesser threats. The big threat to worry about is always third party apps ... that is where GOS really shines in being able to reason about how to install third party apps for safety - secondary profiles, storage scopes, vpn, private dns etc. I suggest this is where you should focus your energies. GOS does a fantastic job of making this power accessible.

Bismark

de0u
I get how that part works, it does a checksum, like the bitcoin blockchain.
I had in mind other scenarios.

bookreader

Reality check, huh? In terms of what exactly? That the compromise was detected? That the hostile code was reverted almost immediately? That basically NOBODY actually installed the hostile code?

Bismark

bookreader
Well I uderstand it was barely caught.

matchboxbananasynergy

It's not quite clear what you're asking, and how the proposed solution helps.

As @de0u correctly stated, all updates are signed and have downgrade protection. Someone compromising the infrastructure cannot push out valid updates. This is documented in part here:

https://grapheneos.org/usage#updates-security

If the threat you're trying to defend against is different in nature, it would help to make that clear so that it can be responded to. I will say that I don't consider delaying updates to be the correct approach, though.

raccoondad

Bismark

No, it doesn't just do a checksum. It does a signature check...These are two different concepts.

What scenario would even apply here? If a bad actor had access to the GOS signing key it really doesn't matter when they push an update out.

Also I imagine not many people have access to the GOS signing key, so this threat is kind of mute...

graphie

It's always a potential threat. But that threat isn't isolated to Linux or GrapheneOS or any other open source software. The speculation in this case is that it may have been an actor from a nation state agency due to the sophistication of actually being incredibly patient and building trust.

I would much rather trust open source software over any proprietary software. We know from the Snowden leaks that 3-letter agencies like the NSA work with all the big names; Microsoft, Google, Apple, etc. It's almost a guarantee that there are backdoors built into all large proprietary operating systems. So of course they're attempting the same with open source software. At least with open source software we have the ability to catch it before it's used.

Beyond that there are likely backdoors written to the proprietary firmwares outside of the OS on your phone and computer (think Intel ME). That's the world we live in. :/

matchboxbananasynergy

graphie Let's be careful to not let this thread devolve into conspiracy theories or misinformation.

I'm happy to let the discussion happen as I consider it important, but if the thread is overrun with unfounded claims and speculation, it won't be productive.

graphie

Sorry to bump a dying thread. But a reminder of history is important. I'll just put this decade old article here and won't add any further 'unfounded claims' or speculation:

https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data

Xtreix

graphie Sorry to bump a dying thread. But a reminder of history is important. I'll just put this decade old article here and won't add any further 'unfounded claims' or speculation:

https://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data

Many other similar programs exist in many Internet backbones, and many of them are no named because they're secret, it doesn't really matter if you use E2EE and don't share your whole life on the Internet, this 10-year-old article is no longer relevant when 96% of the web is encrypted and authenticated by HTTPS.

de0u

graphie I believe the original post was about a specific (hypothetical) threat, namely somebody capturing control of the GrapheneOS update server and causing it to send fake versions of GrapheneOS to users. That could be done! But GrapheneOS devices would reject those updates unless they were signed by the GrapheneOS signing key for the appropriate device type.

The original post was not about either (a) PRISM, meaning governments using laws and/or intelligence courts to require service providers to disclose data they may possess in unencrypted form or (b) large tech companies deliberately sneaking backdoors into closed-source device firmware. So discussing PRISM and/or firmware backdoors in this thread might qualify as off-topic.

Meanwhile, unless I missed it in the linked Guardian article (or elsewhere), PRISM was/is not about firmware backdoors, so an article about PRISM would not provide evidence about firmware backdoors. If there is evidence for the proposition that "there are likely backdoors written to the proprietary firmwares outside of the OS on your phone", I suspect people here would be interested in that evidence. If not, then I can imagine that the moderators might classify the claim as unfounded.

It is one thing to be unhappy about PRISM. But being unhappy about PRISM is not evidence about the existence of firmware backdoors in Pixel devices, and is also not relevant to whether or not capturing the GrapheneOS update server would enable a party to ship malicious updates to GrapheneOS users.

graphie

de0u
You're right, I portrayed some of my original response as a matter of fact, while it certainly is not. And I have brought this discussion a bit offtopic. However, remembering history and understanding the goals of certain agencies in the past is key to understanding what may be their natural progression and best target today (proprietary firmware, in my opinion).

Just like before the Snowden leaks we speculated much of what became fact. However, it turned out to be far more overreaching than most imagined. Before the leaks, like today, people would disregard such speculation as unsubstantiated.

Which will remain true until another whistleblower steps forward in 30 years (if we're lucky), and then maybe we'll recognize how naive we were while disregarding claims of 2054 Mars satellites reading our thoughts. 🤣

For me, I'd rather learn from history and assume we're being spied on much more heavily than can be confirmed as fact at the time. That way I can at least attempt to mitigate the potential threat to my privacy. If we only mitigate against what is confirmed with absolute certainty, we will always be behind agencies (and mega corporations) who progress forward in the shadows.

I see this forum isn't the correct place for such a dialog though. That's fine. I'll end with another loosely related decade old article:
https://www.digitaltrends.com/web/nsa-has-cracked-the-encryption-protecting-your-bank-account-gmail-and-more/