According to an article published by cybernews.com:
(https://cybernews.com/security/google-pixel-9-phone-beams-data-and-awaits-commands/)
"You can’t say no to Google’s surveillance"
Researchers analyzed network traffic and found that Pixel 9s are phoning home to google every few minutes including sending personal identifiable information.
From the article:
"The device shares location, email address, phone number, network status, and other telemetry. Even more concerning, the phone periodically attempts to download and run new code, potentially opening up security risks,"
How much, if anything, can installing GrapheneOS protect device owners from this?
For example the article mentions several connection attempts but does not mention which services or apps are generating these requests:
Every 15 minutes, the device sends a regular authentication request to an endpoint called ‘auth.’
The phone also requests a ‘check-in’ endpoint around every 40 minutes, listing low-level features enabled on the phone, such as the firmware version, whether connected to WiFi or using mobile data, the SIM card Carrier, and the user’s email address.
The location data is included in the request even when the GPS is disabled – the phone then relies on nearby Wi-Fi networks to estimate the location.
The article also mentions a few specific services that are leaking data:
CloudDPC: Most Android phones have a “CloudDPC” package built in. It is used to manage enterprise devices, such as changing security policies, remotely distributing apps, wiping data, etc.
enterprise-staging.sandbox: Moreover the Pixel device periodically calls out to a Staging environment service (‘enterprise-staging.sandbox’) and attempts to download assets that do not yet exist.
experiments and configurations endpoint: The Pixel phone also maintained a nearly constant connection to the experiments and configurations endpoint.
scam-related phone numbers Also, the phone continuously requested Google’s servers for updates on known scam-related phone numbers, presumably for its call-screening feature. Every 24 hours, the device would rotate cryptographic keys.
It would be reasonable to assume that some of this is related to Google play services which can be mitigated by not installing it however it is also likely that some of these leaks may be related to specific pixel system apps or code in blobs that GrapheneOS retains. Which of these leaks is GrapheneOS susceptible to?
Have anyone tested GrapheneOS on a pixel 9 device and analyzed all outgoing attempts to phone home to Google's servers?