- Edited
Hi @angela.
The last month or two there have been reports from multiple users on the internet of microphone-in-use dot randomly turning on, and staying on, and that "Unknown" app is using the microphone. These reports come from GrapheneOS, stock Android, and even iOS which doesn't share code with Android at all, and from all sorts of users. Tor Browser certainly isn't installed at all in most cases. What it is that is happening, no one seem to know yet. It might be hacks, the coincidences with iOS leads to me now slowly starting to suspect this. It might also be bugs. It seems the Android case actually might have been a bug.
Either way, I want to clearly state, that the vast majority of users, including those of us with actual threat models, have not experienced this. It is also not clear to me how an attacker is able to get access to the microphone, but cannot prevent the microphone-in-use dot from turning on.
Tor Browser app runs in the Android app sandbox like all other apps you install. An attacker would need to have an exploit against Android app sandbox, in addition to an exploit against Tor Browser, to be able to get microphone access that way. The sandboxing others talk about in this thread, that is lacking, is yet another layer of defense some other browsers specifically implements. But Tor Browser is properly sandboxed like any other app would be.
If you suspect you have been hacked, here is what to do:
Hold power button for at least 30 seconds until phone hard reboots. This is to make sure an attacker cannot fake the reboot. During boot screen, hold volume down button, to enter fastboot screen. Choose recovery using volume buttons and power button to confirm. If I remember correctly, you will now reach a screen that is blank. I think you need to press power button and volume up button simultaneously to get a menu. Select factory reset and perform it. This will ensure all data not verified using verified boot gets deleted, even cryptographically destroyed.
During next boot, compare the boot hash shown with the one from GrapheneOS website, using a device you trust not to have been hacked, or from multiple devices just to be sure.
Your device will now be clean. Only proper non-compromised GrapheneOS code can run now.
How to prevent getting hacked again:
Be considerate about what apps you install, and from what sources, and what websites you visit in the web browser. Prefer to only install highly trusted and reputable apps, and only from official sources, and only visit reputable websites where you trust the website operator to do their best to keep the website clean from malicious code.