Claims made by forensics companies, their capabilities, and how GrapheneOS fares

GrapheneOS

They're successfully bypassing the secure element throttling on 2nd through 5th generation Pixels. Titan M2 has held up so well that it appears they didn't have a working exploit for it at any point, so they can't even brute force a random 6 digit PIN on a Pixel 6 with the initial release of the OS shipping with the device. They're likely only trying to attack the latest firmware version, so unless they succeed at some point they won't end up with the capability even for older devices. It would be a waste of their resources to develop exploits which only work against older OS/firmware versions. These companies are likely quite unhappy with the recent improvements we got done upstream for Pixel firmware in the April release but they still haven't added enough OS level hardening to defeat their reliable AFU OS exploits even temporarily. You can see the latest iOS has made changes which require them to make adjustments, which they'll likely get done pretty quickly, but they appear to have an easier time stock Pixel OS.

GrapheneOS does far more hardening than iOS against these attacks so the results make sense. We also have auto-reboot so even if they do develop a successful exploit, their window of opportunity to use it to get data from user profiles is 18 hours from when it was locked, or significantly less if users lowered the value which can go as low as 10 minutes. Our new USB-C port control feature is also a really big deal for this. We became aware of them specifically targeting GrapheneOS and have been focusing on improving things as much as we can as one of our highest priorities. Duress PIN/password was delayed since we focused on anti-exploitation approaches benefiting everyone first, but it'll ship soon, as will the 2-factor fingerprint unlock feature which surprisingly is close to done due to a new contributor we plan to hire.

DeletedUser370

An interesting and useful read. Sending you massive thanks for your hard work. 😊

GrapheneOS a new contributor we plan to hire.

Congratulations, fredu!

stereo3441

I'm very excited for the prospect of a secure diceware passphrase generation UI for user lock screen. Do you have any information on what wordlists will be used, minimum passphrase size, or a simplified entry screen. Where if GrapheneOS knows it generated a secure passphrase for the user it might search the list as letters are typed and autofill the word or offer suggestions for words that match the entered prefix?
Endless thanks for all the hard work and careful thought you put into GrapheneOS.

VAULT

Best read of the day :] We the users of GOS are so grateful!!

stereo3441

Hathaway_Noa Thank you for your contributions to the community and the enlightening info you provided. Do you know how supersonic BF differs from regular BF on iOS?

final

stereo3441 Cellebrite says Supersonic Brute Force is about 40x faster than the traditional brute force speed.

[deleted]

Is the google pixel tablet safe too?

matchboxbananasynergy

[deleted] The Pixel Tablet is essentially a 7th generation Pixel device. What applies to other 7th gen products like 7, 7 Pro, 7a and Pixel Fold should more or less apply to the tablet as well.

[deleted]

matchboxbananasynergy thank you! So should be good to go then

FiscalPixel

matchboxbananasynergy
Says pixel 6 and later, does this include 6a as it's not as powerful as the pixel 6?

Thanks

DeletedUser29

matchboxbananasynergy XRY and Cellebrite say they can do consent-based full filesystem extraction with iOS, Android and GrapheneOS. It means they can extract data from the device once the user provides the lock method, which should always be expected. They unlock, enable developer options and use ADB.

So this feels like a dumb question. But I fail to see -- probably due to my lack of technical understanding -- how that is supposed to be noteworthy (by XRY and Cellebrite)? It just sounds like the equivalent of "we have the key to the door so we're able to enter and look around". Like no shit Sherlock. Am I missing something vital here or is this just marketing fluff?

de0u

DeletedUser29 How that is supposed to be noteworthy (by XRY and Cellebrite)?

It's one thing for somebody to have a way to extract data from a phone. For the data to be used in court proceedings it is important to claim a chain of custody from the device as obtained by law enforcement to the screen shot (or other evidence) appearing in testimony. If an officer testifies that a generally-accepted tool was used, that helps.

GrapheneOS

DeletedUser29 They can extract more data than you're meant to be able to extract via ADB by escalating privileges there, but having the lock method already gives them nearly all the data directly by design unless there's no backup service included to get app data. They can access everything you can access once they have your lock method which at least indirectly gives them nearly all the data even without a backup service. Regardless, once they have the lock method, the attack surface is enormous and it's not very realistic to stop them at that point. They can install whatever apps they want, grant any permissions they want including special access permissions, accessibility services, etc. and a few development permissions only available via ADB. It isn't at all realistic to prevent an exploit by someone with that control over the device already. Secondary users that are at rest have their data safe from them based on the security of the lock method similarly to Owner when the device is at rest since their encryption keys are separate.

Panda-na

This is very fascinating! Since the graphic shows a list of phones with stock OS, and a table with GrapheneOS specifically, does this mean that GrapheneOS is the only alternative OS that can be a match against XRY and Cellebrite? I know very well that the GrapheneOS team is doing amazing security work, but to see it like this? It seems like XRY/Cellebrite is threatened by the existence of GrapheneOS 😄

GrapheneOS

Panda-na Other alternate operating systems aren't hardened and largely roll back security rather than improving it. DivestOS applies a portion of our privacy/security patches, but on top of LineageOS which rolls back security and DivestOS is focused on insecure devices. Cellebrite may still need to do some work in order to support them but it would generally be much easier for them compared to exploiting a stock OS device, not harder.

neel

This news makes me glad I swapped my SIM back to my Pixel 8 running GrapheneOS.

OnePlus does a really good job with hardware but OxygenOS is kinda gimmicky and OnePlus phones are too big anyways.

CatPaw

Great read and thanks for sharing.

I know you stated that mitigating full filesystem extraction via (most likeky) ADB is not planned nor in focus right now, but wouldnt locking developer options (or at least ADB) behind a seperate, secure element protected, password be a viable option.

This would protect people in a scenario where either Pin was snoopped or the Phone snatched unlocked.

GrapheneOS

CatPaw Enabling developer options on Android is already gated by the main lock method. That's part of why it shouldn't be enabled in production, so that it's still gated behind the password. We also put configuring system backups behind the password in the same way with a downstream change.

JayJay It does do full backups. Turn on device-to-device backup mode.

JayJay

If these companies can make a full extraction of the devices when having access to the password why isnt it possible for us/seedvault to have a built a full backup solution that can do the same for us users also that includes full backup of apps and settings which is flagging against that?

Kira902

Awesome as always

upstage4186

Wow. Thank you so much for all of the amazing work that goes into this project, seriously!

Not just on the technical side, but the clear and concise communication of best practices, exploit updates, changelogs, community involvement, etc.

I'm constantly blown away by the holistic approach you take and how well its all communicated. I don't know of many projects that are as consistent, and of high quality as GrapheneOS in this department.

I need to get around to setting up Monero so I can begin donating.👌