On-Device Investigative Tool

Kudipandaka

How safe is grapheneOS from ODIT?

Also what are some ways of safeguarding from it?

Kudipandaka

0xsigsev fair enough

So far what i've learnt is that using a sim card (wireless carrier) is how they get to you, so I turn off cell use on my graphene and use wifi only, with a mobile router.

I pop a sim in the mobile router, it has built in firewall as well in it and tor guard.

But other than that, was wondering what other people know about this ODIT.

Thanks for the reply.

pxlkng

Kudipandaka So far what i've learnt is that using a sim card (wireless carrier) is how they get to you

Could you elaborate how you think this is the case?

Kudipandaka so I turn off cell use on my graphene and use wifi only, with a mobile router.

I pop a sim in the mobile router, it has built in firewall as well in it and tor guard.

This is not a good idea. Mobile routers have worse security than your GOS phone and provide no privacy benefit, you should put the SIM into your GOS phone. Android also has a built-in firewall. You can additionally use a VPN per-profile, many providers also have DNS blocking features.
The project generally recommends against using mobile routers due to those reasons.

Onlyfun

Kudipandaka this seems to be the right setup, in addition to adequate software and browsing hygiene, I guess.
But can I expand this convo with what is evidence of ODIT (or other alike software) presence to begin with? And to round up, what is the best way/tool to count and cut losses after an incident in gos case? What manipulations with subject gos device(s) would provide strong enough confidence to use them? Or should they be disposed and replaced?

Onlyfun

Kudipandaka So far what i've learnt is that using a sim card (wireless carrier) is how they get to you

Kudipandaka installed on a target phone through their wireless transceiver.

Are there technically based requirements fpr the target device. Like in your 1st statement vs 2nd. Sim card wireless carrier = active cellular plan.VS target with only a transceiver, requires notedly more effort from attacker to contact the target. And my questions is if the second case realistic?

Kudipandaka

pxlkng yes forgot about my VPN as well, and thanks that sounds good.

And I learnt that about them using the wireless carrier just from what I read in a few articles about it being used.

Kudipandaka

pxlkng
Also on wiki it says pegasus (the ODIT they use) is installed on a target phone through their wireless transceiver.
(Other way is physical access to the device)

Kudipandaka

pxlkng I'm guessing GOS is safe from this. Thanks for the reply.

NetRunner88

pxlkng

Wrong advice about sim card..

pxlkng

NetRunner88

Its not. Having your SIM in a less secure device makes no sense. If you use a SIM, put it in your GrapheneOS phone that is properly hardened, has an isolated baseband, doesn't allow invasive carrier access and has a properly implemented airplane mode. That's the safest place where you can put it.

Its best to avoid the carrier network completely if you can.

Nuttso

pxlkng using a mudi router with Ethernet connection to the pixel is safer, than having the sim in your pixel. Ofc it depends on how the mudi is configured. But when you can remove the transmitter and route the traffic through a mudi you're able to shield the phone completely from the network.

NetRunner88

pxlkng

You are plain wrong.

Except for the fact of not using sim at all.

Kudipandaka

Nuttso yes this makes sense. Mudi works great. Shielding the phone from the wireless carrier and using protected wifi Hotspot or ethernet was what I have learnt so far is best.

Nuttso

Kudipandaka i would advice against using wifi. The firmware is a complete mess.

other8026

Here's a thread by the official project account about identifiers while using cellular networks and mobile hotspots: https://grapheneos.social/@GrapheneOS/113319956422621755.

Nuttso

other8026 while this is an interesting read. A mudi with blue merle in a big city with a sim that you change after every reset of the mudi looks just like a new device with a new sim to the network. Slabs know their stuff.

pxlkng

NetRunner88

See here:
other8026

Specifically:

Similarly, using a very niche hardware device to connect to the network such as a standalone hotspot device stands out. Those devices are also far less secure than simply using a Pixel with GrapheneOS. They typically don't get proper updates and lack basic security measures.

and

To summarize:

1) IMEI randomization is a poor way to improve privacy and will draw attention to yourself in practice.
2) Dedicated Hotspot devices aren't good for privacy/security.
3) Use airplane mode + Wi-Fi with our default per-connection MAC randomization for better privacy.

and

Also, bear in mind that carrying around a Wi-Fi access point (AP) is the opposite of private. An AP has a persistent MAC even if it's random upon creating the AP such as making a hotspot with a phone. Wi-Fi does not have MAC rotation like Bluetooth Low Energy privacy extensions.

Links:
https://grapheneos.social/@GrapheneOS/113319957634670284
https://grapheneos.social/@GrapheneOS/113319972968903603
https://grapheneos.social/@GrapheneOS/113321788575432923

Pavestone2734

Nuttso i would advice against using wifi. The firmware is a complete mess.

Source? The WiFi is considered reasonably safe but definitely safer than cellular on GOS.

Brothe3r_max

pxlkng
To summarize:

1) IMEI randomization is a poor way to improve privacy and will draw attention to yourself in practice.
2) Dedicated Hotspot devices aren't good for privacy/security.
3) Use airplane mode + Wi-Fi with our default per-connection MAC randomization for better privacy.

My response

Poin no. 1 Agreed, If you make IMEI randomization, it will draw more attention. So you have to change your IMEI only whenever you put in new simcard. It will make your IMEI and IMSI always match.

I think poin no 2 and no. 3 does not inline,
Poin no. 2 if I use dedicated Hotspot device aren't good for privacy/security.
Poin no. 3 it mean using airplane mode + Wi-Fi with default per-connection MAC randomization also aren't privacy/security. if I use random public wifi network.

Brothe3r_max

Brothe3r_max my bad , I don't see "privacy only" for poin no. 3.
So, poin no. 3 correct

I think the easy way, using another dedicated pixel GOS device as a hotspot to achieve both of privacy and security

Nuttso

Pavestone2734 No it's definitely not. Source is Daniel Micay

pxlkng

Nuttso

Provide your source.

GrapheneOS

Nuttso It's better than it used to be and it switched from Atheros to Broadcom other than the Pixel 7a.