• GeneralPixel 7a

  • Hardening GrapheneOS for Anonymity After Flipper Zero IMEI/EID Takeove

I’m seeking guidance on how to best secure my Pixel 7a after it was compromised via a Flipper Zero attack targeting my IMEI and EID. The attackers now have access to my information, and I need to understand the steps I can take to regain control of my privacy and security.
Background:

Device: Pixel 7a
Compromise: The device was compromised via a Flipper Zero takeover, with the attackers exploiting the IMEI and EID to gain access.
Current Situation: Due to financial constraints, I cannot replace the phone at this time.

Questions/Concerns:

GrapheneOS Hardening:
    Will hardening GrapheneOS (GOS) improve my anonymity and security, given the Flipper Zero takeover? Specifically, can it mitigate any residual risks from the IMEI/EID exploit, or would the attackers still have access via these vectors after the GOS hardening?
    What are the best practices for securing my device with GOS given the situation?

Wi-Fi Access via Phone:
    I have a data-only SIM which will be used only when I cannot access a reliable and trusted Wi-Fi network (e.g., when out and about or for ~4 hours per day).
    Should I obtain Wi-Fi access from a Wi-Fi-dedicated source (e.g., a dedicated hotspot phone) instead of relying on the compromised Pixel 7a for internet access? How can I securely set up my Wi-Fi access to further protect my privacy?

I would greatly appreciate any insights or suggestions on how to proceed to harden the device while also ensuring my anonymity remains intact.

Thank you for your help.

    Attack_Dolphins I think the best way to prevent such "attacks" will be to leave Bluetooth, WLAN and NFC switched off and only switch them on when necessary. I don't know to what extent reading the IMEI is a security-relevant attack

      GrapheneOS Then please assist me in properly diagnosing exactly what happened when my non-GOS Pixel 7a was taken over. My pursuer had complete access to my accounts via the phone that was removed from me. I attempted a factory reset via Google and reported the IMEI to my carrier. I received a replacement Pixel 7a and it was taken over within days. What combination of the device and the accounts allowed for the takeover and how do I now use the once compromised Pixel 7a? Will installation and hardening of the GOS environment be sufficient? Will the pursuer be able to locate the phone via IMEI tracking?

          GrapheneOS My ESET communicated a stolen SIM which was a e-SIM at the time; the find the music app was listing music I hadn't heard; there were search results that we not relevant to me; the Google Takeout yielded a 2 separate Device ID's where DEVICE ID#1 listed one of my IMEI's; DEVICE ID#2 listed both of my IMEI's. This account was 4 days old when it was taken over. I know that my pursuer owns and uses a Flipper Zero with ease. That might be biasing my perspective, however.

              Attack_Dolphins This doesn't add up to your device being exploited and a Flipper Zero doesn't give someone the ability to do advanced remote exploits.

                  Attack_Dolphins The device which seems to have been taken over was not GOS. I am recently coming to understand the availability of custom ROM's for mobile devices which is a result of many months of issues with account takeovers. I am a "newbie" to say the least.

                      GrapheneOS Can you help me understand what the 2 separate Device ID's with the same IMEI's does tell me where it's for the same Google account? I want to understand the vulnerabilities I consistently have in order to regain my security. Will Graphene provide me with the security if my IMEI is known to my pursuer?