Question About the Importance of Updating GrapheneOS

dj5

I've made custom modifications to GrapheneOS and am running it on my phone. Because of these changes, I no longer receive official updates. My question is: How safe is it to run my phone without these updates? Have there been any critical updates in the last year or two that addressed major security vulnerabilities, like 0-day Remote Access or anything serious? Is the OS not secure enough by default?

DeletedUser127

dj5 it is not about what has been done in the past but by modifying OS and not being able to update it you have effectively EOLed your device and made it vulnerable to any future threats.

other8026

dj5 How safe is it to run my phone without these updates?

It isn't

dj5 Have there been any critical updates in the last year or two that addressed major security vulnerabilities, like 0-day Remote Access or anything serious?

I'd suggest you take a look at https://source.android.com/docs/security/bulletin

GrapheneOS

dj5 Serious vulnerabilities are fixed all the time. Look at the steady stream of vulnerability fixes for the Linux kernel and the Android Security Bulletins.

ryrona

dj5 Have there been any critical updates in the last year or two that addressed major security vulnerabilities, like 0-day Remote Access or anything serious?

Yes. There have been serious security vulnerabilities that have been fixed in most monthly updates. I am keeping track of that. That is also why the GrapheneOS project is so keen on getting those security fixes out so fast, and even does extra kernel updates in between.

dj5 Is the OS not secure enough by default?

No, unfortunately not. While the design of Android itself should be among the best from a security point of view, there is an enormous attack surface, partly because of all Android APIs where apps can interface with system components, partly because of the security foundation resting on the Linux kernel. Both of these often have security vulnerabilities of very serious kinds.

Some operating systems like QubesOS are specifically designed to have an as small attack surface as possible, but even then there seem to be 2-3 serious security vulnerabilities found each year.

Installing security updates are important, as when patches have been made, the vulnerability also becomes public knowledge and can be used by all hackers in the world, not just the lucky one who found the vulnerability. The patch will reveal what the issue is. So known vulnerabilities are far more dangerous than unknown vulnerabilities.

dj5

DeletedUser127 No, I just changed a few files, and I can easily run rsync with the exclude flag for those modified files to get the latest update. After that, I can use fastboot flashall. However, my question is whether there have been any serious updates in the past, and if those updates are really important—such as preventing something critical like remote access to my device.

DeletedUser127

dj5 the OS is always most effective and up to date at the time of the update and choosing not to update it you are with time further diverging from official release with all changes (feature improvement and threat mitigations) it brings and like I said are vulnerable to any future threats that emerge.

Look at the changelog to see what changes have been made (too many to list in a brief post), many are related to remote access:

https://grapheneos.org/releases#changelog

GrapheneOS

dj5 Based on what you're describing, you aren't using a secure production build of GrapheneOS and have a bunch of the security disabled. You're combining that with not patching vulnerabilities.

angela

This is so risky.

A good hacker often goes after what's easy. If they can figure out you don't have updates, and there's a clear exploit that has been patched, and you don't have it patched, it's easy for them to break in because they just follow the published info about the exploit.

That's why hackers and governments pay so much for zero day exploits (not yet published) because it allows exploiting a fully patched device. If you have any sort of threat model, your device is easily hackable by someone good. Even with a fully patched OS, a nation-state may still be able to hack you with a zero day exploit.

So it depends on your threat model. If your threat isn't being remotely hacked, but having your phone seized, and your usually is BFU, it's possibly less of a bad idea, but really it's partly defeating the purpose of GOS. You'll still get per App firewalls?

Let's say a server is unpatched and doesn't have "December patch" which protects against a newly discovered type of buffer overflow attack. There is a publication out about "December patch" and it actually shows the commands to gain control of the server. A shitty hacker can follow that publication if they know the server isn't patched. It's a blueprint. A phone OS isn't that different. It's possible some systems in GOS could protect you, but I don't think developers for GOS waste time on "Can unpatched GOS be hacked with published hacks that we've patched?"

Just save your data and start over, then update regularly.

GrapheneOS

ryrona

Some operating systems like QubesOS are specifically designed to have an as small attack surface as possible, but even then there seem to be 2-3 serious security vulnerabilities found each year.

It has non-hardened operating systems with massive attack surface, lack of modern exploit mitigations, little use of memory safe languages and lack of basic sandboxing in each of the virtual machines along with non-hardened applications running on top of those. They have all the usual Linux TCP/IP attack surface exposed. You're talking about the attack surface from the virtual machines to getting control over the hypervisor while ignoring the security of those operating systems and applications.

ryrona

GrapheneOS It has non-hardened operating systems with massive attack surface, lack of modern exploit mitigations, little use of memory safe languages and lack of basic sandboxing in each of the virtual machines along with non-hardened applications running on top of those. They have all the usual Linux TCP/IP attack surface exposed. You're talking about the attack surface from the virtual machines to getting control over the hypervisor while ignoring the security of those operating systems and applications.

True. QubesOS is not designed to prevent attacks within each qube, just between qubes. It is purely an OS for compartmentalization into security domains, not a general hardened system in the sense GrapheneOS is. My point was only to say that even for the parts where QubesOS is designed to actually be secure and have an as small attack surface as possible, which is far smaller than for GrapheneOS' counterparts, serious security vulnerabilities are still found. That was my point.

angela

ryrona except most people using Qubes with a real threat model will use minimal templates and kicksecure templates and harden Qubes to reduce attack surface and use disposable templates for tasks with larger attack surface. Does anyone using Qubes just stick to the defaults? No users believe Qubes is hardened by default.