Exploit - Device Setup

Roadwork

If the device setup is not fully completed the owner configuration file must be deleted after a reboot or power cycle. Failure to do so permits the device to be pre-configured with a malicious WiFi network.
This is not unique to GrapheneOS.

de0u

Roadwork Can you provide steps for reproducing? How would the Wi-Fi network be pre-specified?

phnx

de0u Can you provide steps for reproducing? How would the Wi-Fi network be pre-specified?

I assume they mean progressing partially through the setup wizard and configuring a WiFi network? Even then it's unclear how this would be a vulnerability.

Roadwork

It would be helpful if you could provide more extensive justification for your claims.

Roadwork

de0u
This exploit is a potential issue if the device was provided by a party with malicious intent.

To replicate:

Using either a factory reset device or a device that has just had the firmware flashed. Power on the device.
Select the Language and tap next.
Turn on WiFi.
The WiFi network referenced in this step is a portable malicious WiFi network. Connect the device to the malicious WiFi network.
Once the device has connected to the WiFi network power the device off.

The malicious WiFi network has now been saved to the device and will remain saved to the device when the device is setup. The issue is the device is now vulnerable to a proximity based WiFi man-in-the-middle attack.

This exploit will survive a power cycle and will not be detected by Auditor or Secure Boot.
It will not survive a factory reset.

The WiFi networks saved to a device can be checked by navigating to Settings > Network and internet > Internet > Saved networks

This exploit has been reported to Google. My understanding is Google have elected not to patch it.

dasaint100

Is this recommended and how would you know about the different WiFi?

de0u

Roadwork I think you're indicating that somebody could prepare a GrapheneOS device in such a way that when handed to me it might appear to be freshly reset, but it might not be completely freshly reset, because a previous partial run of the setup app might have stored a Wi-Fi network.

It sounds as if there is a simple workaround, namely that if somebody hands me a device which in theory has a fresh GrapheneOS install I should factory-reset it to ensure that it is completely fresh.

Roadwork This exploit has been reported to Google. My understanding is Google have elected not to patch it.

Is there a bug i.d.?

I am not a security expert and I don't speak for the GrapheneOS team. But if a potential exploit requires physical access and if the resultant risk is low and easy to work around, I can imagine that it might not seem to be a high-priority matter. That said, you can file an issue on the GrapheneOS issue tracker.

SgtSurehand

As @de0u said, this would not persist through another factory reset. Also any such preconfiguration would be easily discoverable in saved WiFi networks.

Settings > Network and Internet > Internet > Saved networks

Steps to mitigate: Remove unrecognized networks. Factory reset not necessary.

If any such preconfiguration is suspected, I would worry about other things and go through Settings item by item.