Unsubstantiated claims about Sweden exploiting GrapheneOS with no evidence

argante

Crazy8 I was previously under the impression that only certain three letter agencies deployed Pegasus level tools that are needed to remotely activate iPhone microphones but clearly I was wrong.

This is possible if the target is the baseband processor (BBP). The firmware is never open source here, and vulnerabilities have been found in BBP before. I previously provided a link that Samsung was installing spyware on phones. Here is an example. However, this requires cooperation with the phone manufacturer. The best thing someone can do is no SIM + AirPlane mode and physically disconnect the cellular antenna.

locked

Crazy8 locked Yes, I understand. I just wanted to show that the swedish police have some very sophisticated tools at their disposal. I was previously under the impression that only certain three letter agencies deployed Pegasus level tools that are needed to remotely activate iPhone microphones but clearly I was wrong.

Again the document I linked makes NO mention of GrapheneOS and until such a document exists, I will assume that GrapheneOS is immune to this kind of exploit.

One thing worth mentioning though, Apple’s Lockdown Mode is specifically built to defend against that class of exploit zero click attacks, spyware, etc.... It seriously cuts down the attack surface, especially for iMessage and WebKit, which are common targets, and would likely thwart the attacks you mention by Swedish Authorities.

And now with Android 16, Google’s rolling out a similar feature, basically their own “lockdown” profile. It brings stronger network restrictions, memory protections, designed to prevent these types of attacks from being successful to start with.

So, if those protections are enabled, it’s a lot harder for something like Pegasus to succeed.

Blastoidea

locked

This is a very important distinction, which many seem to miss.

Blastoidea

Thank goodness I’m not important enough to need Google’s Advanced Protection.

It strikes me as a howling pain in the ass, and seems to be a one-way street. Flip the toggle, and live with it forever.

matchboxbananasynergy

Blastoidea You're basically getting what that offers on GrapheneOS by default.

GrapheneOS

Blastoidea GrapheneOS provides far better exploit protections than the tiny improvements in the Android 16 Advanced Protection feature. You can use Advanced Protection with your Google account while using GrapheneOS and it essentially won't have any impact on using the OS because sandboxed Google Play is unable to do things like blocking installing apps from outside of the Play Store as it normally does when using Advanced Protection.

Everyone should use Advanced Protection with any important Google accounts they have. It just means being forced to use hardware security keys including the phone's secure element. It disables easy account recovery (and hijacking) via customer support so make sure to have proper password management and backup security keys. GrapheneOS avoids the problematic part of it forcing getting apps from the Play Store.

userofgos

GrapheneOS what exactly is Android 16's Advanced Protection feature actually acheiving/protecting on GrapheneOS? Since there are already exploit protections on GOS.

GrapheneOS

userofgos That's not really relevant to GrapheneOS. We're talking about the Google account Advanced Protection being useful for protecting Google accounts from takeover via customer support or weak 2-factor authentication methods.

userofgos

GrapheneOS oh gotcha, I misunderstood that those are two completely different things. Thanks for clarifying.

JayJay

I've taken the time to actually read through most parts of the documents that the TS provided.

According to the file in the zip he provided (363-1.pdf)
Below phones was installed with GrapheneOS
Page 252 PW Protected Pixel 7A - Extracted through videorecording
Page 319 No PW Pixel 6A - Fully extracted
Page 325 PW Protected 6A - Fully extracted
Page 345 PW Protected Pixel 7A - Fully extracted
Page 357 PW Pixel 6A - Fully extracted
Page 370 PW Protected Pixel 7A through videorecording

The USB ports were disabled on some and therefor they were videorecorded.
Some had foreign simcards installed, or was connecting to internet through another device.
Police never mentions any firmwares but you can assume that they were updated until 2024-07-01.

One of the extracted phone (Pixel 6A) was pw protected and switched off. It was fully extracted.
Others were turned on but in a locked state, the Pixel 6As were fully extracted the 7A video recorded (probably turned off USB). Which concludes they had atleast the firmware of when the USB disable functionality was launched.

The phones that were fully extracted, the extraction was done latest on 2024-11-21.
Considering that one of the phones was switched off and pw protected yet fully extracted it means that an exploit was available for them to use between 2024-07-01 and 2024-11-21.

When the phones are under video recording the police turns on airplane mode first to disconnect it from internet and then afterwards starts the videorecording through an external camera.

edit:
No finger unlock was used. They were pw protected.
However we do not know if the password was written anywhere close, if they were shoulder surfed (I doubt this happened though as no evidence pictures provided was so upclose), we also do not know the complexity of the passwords. The phones was collected from someone in Stockholm with preinstalled GrapheneOS, we do not know if this person was undercover to infiltrate or wrote down the passwords somewhere and got raided. There are many questions to how however we can conclude that the phones security were actually bypassed.

dc32f0cfe84def651e0e

JayJay Considering that one of the phones was switched off and pw protected yet fully extracted it means that an exploit was available for them to use between 2024-07-01 and 2024-11-21.

Or the passphrase had been snooped beforehand. Like with video surveillance.

That's why I often change the password for my main profile and set the old one as duress. Which won't protect me in a case they take my phone immediately after having snooped over :(

dc32f0cfe84def651e0e

JayJay we do not know if the password was written anywhere close

Let's write down a duress one then :)

matchboxbananasynergy

JayJay No finger unlock was used. They were pw protected.
However we do not know if the password was written anywhere close, if they were shoulder surfed (I doubt this happened though as no evidence pictures provided was so upclose), we also do not know the complexity of the passwords. The phones was collected from someone in Stockholm with preinstalled GrapheneOS, we do not know if this person was undercover to infiltrate or wrote down the passwords somewhere and got raided. There are many questions to how however we can conclude that the phones security were actually bypassed.

Do we know if the people involved gave up their passwords? it's not clear whether this is mentioned. The fact that we're jumping to complex exploits being deployed before considering very simple and easy things doesn't make a lot of sense.

JayJay An exploit has been used here to bypass. Not so long ago there was a simcard switch exploit that bypassed the password.
We know for a fact that such exploits has occurred before
https://discuss.grapheneos.org/d/11860-vulnerabilities-exploited-in-the-wild-fixed-based-on-grapheneos-reports
From 2022 https://www.youtube.com/watch?v=B6q0nJnltsk (simcard switch exploit).

This did nothing on a BFU device, you can't just bypass encryption like that.

Byku

JayJay Finally some actual source on this topic. It's too bad it doesn't specify if they actually managed to exploit GrapheneOS or if the password was obtained through other means.

JayJay

dc32f0cfe84def651e0e
I highly doubt it, because if it was they would disable the password and be able to do full extract by switching on all USB. However this was not done, they had to do manual extract.
Also if it was, there would have been evidence with more upclose photographs, this was not provided as evidence either.
And remember one of the phones was switched off in the home.
An exploit has been used here to bypass. Not so long ago there was a simcard switch exploit that bypassed the password.
We know for a fact that such exploits has occurred before
https://discuss.grapheneos.org/d/11860-vulnerabilities-exploited-in-the-wild-fixed-based-on-grapheneos-reports
From 2022 https://www.youtube.com/watch?v=B6q0nJnltsk (simcard switch exploit).
While I am not so updated on the CVS between 2024 until 2024-11-21 one cannot fully protect himself. A complex password+auto reboot timer+USB disabled can only protect you until you are being shoulder surfed.

To be able to configure timebased complex password would protect you even further however it depends on what you are defending yourself against.
Or to be able to have some protection against airplane mode toggle, what-a-heck maybe even a configuration airplanemode toggle =autoreboot first. I mean there are of course more protection one can do but it will come at a cost of convenience.

GrapheneOS

dc32f0cfe84def651e0e Exactly, they may have recorded the password being entered. It may have been a terrible password and may have been used across all of the devices and other devices. It's entirely possible the password was also used for websites, etc. People commonly reuse passwords.

dc32f0cfe84def651e0e

JayJay I highly doubt it, because if it was they would disable the password and be able to do full extract by switching on all USB.

Not the case with a secondary profile. Switching USB settings is only available in Owner.

dc32f0cfe84def651e0e

JayJay To be able to configure timebased complex password would protect you even further

https://discuss.grapheneos.org/d/23652-one-time-passphrases

locked

JayJay Just because a phone was extracted while powered off doesn’t automatically mean a current 0 day exploit was used. The SIM switch issue was patched and documented, thanks in part to GrapheneOS's own reporting, from what I understand.

If a new exploit chain was used here, where’s the technical breakdown? The lack of detailed info about extraction methods, password complexity, or handling of seized devices leaves a ton of open questions. That’s not enough to conclude a live exploit was used in 2024. The fact is, most extractions result from bad opsec, reused passwords, short PINs, or shoulder surfing.

GrapheneOS

dc32f0cfe84def651e0e USB-C port control is also enabled by default and there are other reasons to avoid interacting with the device/OS if they have the password. There can be apps set up to auto-wipe on various conditions. Having the password doesn't mean they would want to simply unlock it via the UI and go through developer options to extract. If they have a lower level way to do it while having the password, they'd probably want to do that to avoid wipe being triggered.

GrapheneOS

matchboxbananasynergy A password protected device in Before First Unlock state (turned off) having all of the data extracted heavily implies that the passwords were obtained from the people rather than this being a bunch of devices which got exploited. Titan M2 exploit could bypass brute force protection but a decent password would still hold up quite well and would be impossible to break if it was a strong one.

GrapheneOS

Byku There's no indication of an exploit of locked devices and in fact it indicates otherwise, contrary to the conclusions in that post.

locked

JayJay If a real exploit was used, especially against a locked, powered off GrapheneOS phone, you would expect the report to document that clearly, what condition the phone was in, how access was gained, what tools or techniques were used, etc.

Instead, the reports just say things like “fully extracted” without explaining how that happened. No mention of bypassing verified boot, secure lockscreen, or exploit chains. , especially when dealing with a hardened OS like GrapheneOS.

Without those details, it leaves room for other explanations, like weak passwords, prior access, or even just user error. The lack of technical specificity really matters. If there was a true 0 day exploit, this isn’t the kind of writeup you’d expect

DeletedUser299

locked
Instead, the reports just say things like “fully extracted” without explaining how that happened.

"Fully extracted" is smoke and mirrors speak,
If the password was voluntarily given over, the phone would be fully extracted,
if the password was written down and found, the phone would be fully extracted.
if the password was shoulder surfed the phone would be fully extracted.
if the phone was snatched whilst open and unlocked, the phone would be fully extracted.
the term "fully extracted" gives the impression that the Agency has the ability to search your device, when in reality they don't and they would rather keep that vulnerability to themselves.

GrapheneOS

locked A powered off phone with a password having all data extracted in fact largely implies that the password was known. They'd need to brute force or already know it, implying exploiting the Titan M2. Exploiting devices in After First Unlock state wouldn't give them the password. It's heavily implied they got password(s) elsewhere.

That’s not enough to conclude a live exploit was used in 2024.

The actual evidence even indicates otherwise.

« Previous Page Next Page »