Unsubstantiated claims about Sweden exploiting GrapheneOS with no evidence

Byku

JayJay Finally some actual source on this topic. It's too bad it doesn't specify if they actually managed to exploit GrapheneOS or if the password was obtained through other means.

GrapheneOS

Byku There's no indication of an exploit of locked devices and in fact it indicates otherwise, contrary to the conclusions in that post.

locked

JayJay If a real exploit was used, especially against a locked, powered off GrapheneOS phone, you would expect the report to document that clearly, what condition the phone was in, how access was gained, what tools or techniques were used, etc.

Instead, the reports just say things like “fully extracted” without explaining how that happened. No mention of bypassing verified boot, secure lockscreen, or exploit chains. , especially when dealing with a hardened OS like GrapheneOS.

Without those details, it leaves room for other explanations, like weak passwords, prior access, or even just user error. The lack of technical specificity really matters. If there was a true 0 day exploit, this isn’t the kind of writeup you’d expect

DeletedUser299

locked
Instead, the reports just say things like “fully extracted” without explaining how that happened.

"Fully extracted" is smoke and mirrors speak,
If the password was voluntarily given over, the phone would be fully extracted,
if the password was written down and found, the phone would be fully extracted.
if the password was shoulder surfed the phone would be fully extracted.
if the phone was snatched whilst open and unlocked, the phone would be fully extracted.
the term "fully extracted" gives the impression that the Agency has the ability to search your device, when in reality they don't and they would rather keep that vulnerability to themselves.

locked

JayJay Just because a phone was extracted while powered off doesn’t automatically mean a current 0 day exploit was used. The SIM switch issue was patched and documented, thanks in part to GrapheneOS's own reporting, from what I understand.

If a new exploit chain was used here, where’s the technical breakdown? The lack of detailed info about extraction methods, password complexity, or handling of seized devices leaves a ton of open questions. That’s not enough to conclude a live exploit was used in 2024. The fact is, most extractions result from bad opsec, reused passwords, short PINs, or shoulder surfing.

GrapheneOS

locked A powered off phone with a password having all data extracted in fact largely implies that the password was known. They'd need to brute force or already know it, implying exploiting the Titan M2. Exploiting devices in After First Unlock state wouldn't give them the password. It's heavily implied they got password(s) elsewhere.

That’s not enough to conclude a live exploit was used in 2024.

The actual evidence even indicates otherwise.

ryrona

JayJay One of the extracted phone (Pixel 6A) was pw protected and switched off. It was fully extracted.

Okay. That just means they did not use any exploits against that one. No exploit can access encrypted data on a BFU device in any way at all other than by inputting the correct passphrase. So they did guess, know or was given the correct passphrase.

JayJay The USB ports were disabled on some and therefor they were videorecorded.

JayJay [All others except the turned off one] were turned on but in a locked state

You mean USB port was "charging only" or complete off as opposed to "charging only when locked"? If they guessed, know or were given the passphrase, they would just be able to enable USB fully. So this might actually imply the possibility they have a cellular based exploit that kills the lock screen, but isn't able to enter passphrase needed to change security settings.

Is there any other possible explanation of why they would have gotten access to the unlocked user interface on a locked phone, but not able to do USB extraction?

GrapheneOS

ryrona

Okay. That just means they did not use any exploits against that one. No exploit can access encrypted data on a BFU device in any way at all other than by inputting the correct passphrase. So they did guess, know or was given the correct passphrase.

Yes, exactly. It shows that it was not based on GrapheneOS exploits for at least that phone, and heavily implies it for the other devices too.

Even if was a very weak password, they would have still had to exploit the Titan M2 to bypass brute force protection. If it was even a mediocre password, it would be very hard to brute force with brute force protection bypassed. We talk about using 6-8 diceware words because it outright prevents brute forcing even with massive compute power, but a much weaker password still provides substantial protection.

You mean USB port was "charging only" or complete off as opposed to "charging only when locked"? If they guessed, know or were given the passphrase, they would just be able to enable USB fully. So this might actually imply the possibility they have a cellular based exploit that kills the lock screen, but isn't able to enter passphrase needed to change security settings.

That would be extraordinarily unlikely. The lockscreen can't be killed like an X11 lockscreen but rather is a mode of the SystemUI. The SIM card exploit from 2022 which we discovered long before the public disclosure involved SystemUI wrongly entering an unlocked UI mode which is now protected against much better. It could still be hardened more, but it's about SystemUI logic. SystemUI crashing or anything like that would not do it. The device would just soft reboot back to the lockscreen

Is there any other possible explanation of why they would have gotten access to the unlocked user interface on a locked phone, but not able to do USB extraction?

If they didn't want to interact with the phone and have a way to extract data based on having the password provided to them without it. However, a whole lot of assumptions are being made about what they did and we don't think it makes sense to theorize based on a bunch of assumptions.

gwr

Hi, can someone who downloaded the catbox files upload it here? The link doesn't work for me anymore.

JayJay

Too many posts to quote, but to followup on the subject.
In these type of reports you can also read the whole police interrogation, the passwords were NOT handed over or it would have been noted in the interrogation otherwise. Also fingerprint was not used.
They do not mention in these reports how the access was. However it was not through cellebrite for the Pixels as they usually mention it otherwise.

If they had password access they would have made a full extraction and not phone in airplane mode.
Some more random info collected from the PDF files, just pasting below in random sequence

Malmö TR B 11984-24 Aktbil 363-1.pdf
Page 362
Samsung SM-S901B
"Telefonen har extraherats utan kod och en omfattande datamängd har anträffats." which translates "The phone has been extracted without code and an extensive amount of data has been found."

Page 305
Xiaomi 12t pro
fully extracted without code same as Samsung above.

Page 367
"Sören Recht, 1 September 2024" arrested
Google Pixel 7A.
IMEI 354487201175140

"The device was powered on and password protected.
The available content of the mobile phone has been extracted and a manual review of the
mobile phone has been conducted."

Page 382
Emil Berling arrested 1st sept 2024
"The mobile phone has been extracted and examined manually by filming the screen."

Page 262
30 Sept 2024
GrapheneOS Google Pixel- 6a IMEI 35950275382472
Found in his apartment at a later stage - Fully extracted with software

Kent Kjellgren
Page 319
Google Pixel 6A with GrapheneOS
The device was turned on and NOT password protected. Found on desktop at home. IMEI 358385582080647

Page 324
Google Pixel 6A with GrapheneOS 1st Sept 2024 IMEI 358385589319923 From Kjellgren, Kent Sven Olof
The device was turned on AND password protected.
"The available content of the mobile phone has been extracted and a manual review of the mobile phone has been carried out."

Page 344
Google Pixel 7A IMEI 354487205182232
"The device was password protected, but the available content of the mobile phone has been extracted and is available in its entirety in the accompanying material."

Page 455
During a search of Firat Akgün's home at Stamgatan 37, Älvsjö, on 30 September 2024, a Google Pixel mobile phone was found.73 The device was found in a closet in the hall and was turned off.
The mobile phone has been identified (IMEI:35950275382472) and has been examined. The contents have been
extracted. The mobile phone appears to be an anonymized, encrypted mobile phone and had the GrapheneOS operating system installed.
The contents state that the device has not been used since February 2024.

Page 590
"The Google Pixel mobile phone has been extracted and Signal chats have been found.3 4
The chats themselves have not been extracted due to technical obstacles as the mobile phone was heavily
encrypted.
Instead, investigators have manually examined and documented available Signal chats by
photographing and filming the mobile phone screen. The full content of the chats is compiled in
reports divided by who was the participant."

Page 760
Pixel IMEI 352493420613342 found in compartment in car.

And some more random info:

Page 252
Google Pixel 7A. IMEI 352493420613342
"The device was turned on and password protected.
The available content of the mobile phone has been extracted and a manual review of the mobile phone has been carried out. The extraction and manual review of the device are available in their entirety in the accompanying material."

Page 319
Google Pixel 6A IMEI 358385582080647
"The device was turned on and not password protected.
The available content of the mobile phone has been extracted and a manual review of the mobile phone has been carried out. The extraction and manual review of the device are in their entirety in the accompanying material. For your information, the extraction and manual review have generated different materials."

DeletedUser299

JayJay Page 252
Google Pixel 7A. IMEI 352493420613342
"The device was turned on and password protected.
The available content of the mobile phone has been extracted and a manual review of the mobile phone has been carried out. The extraction and manual review of the device are available in their entirety in the accompanying material."

I just picked this at random. there are others...

the "available content" of the mobile phone is, and this is my opinion...
whats on the lock screen, your mobile carrier, and any notifications you have entitled to be displayed, including signal if you have been carless enough to allow it and any that still come through whilst the phone is seized and powered on
also if you scroll down from the top it shows the quick action tiles you have, and whats active.
this to me is the "available content" anything in a passworded unopened device is unavailable content.
However the available content might be enough to prove links to others and get you in bother.
Nothing in this script proves conclusivley to me any breach of a properly passworded and locked official GrapheneOS enabled phone has taken place. the documents if real inferres that "available content" is infact all the phones content in its entirety and to me its not, and thats a big F@*king difference.
A "manual review", so they picked it up and looked at it, marvelous..

locked

JayJay Appreciate you compiling all this, really useful, but honestly, it kind of reinforces the issue, the language in these reports is incredibly vague.

“Content has been extracted” could mean anything from basic metadata to screen recordings or partial user data, it doesn’t tell us if verified boot was bypassed, if a full filesystem was accessed, or what method was used. In fact, in several cases, manual filming was required, which suggests no real exploit access at all, and it's highly likely that the Swedish Authorities got their hands on the phone unlocked, and filmed only the information that was not encrypted they were able to get up on screen, and may include some Signal conversations (but not the entire history do to encryption) as stated by your own commentary above. It appears to me that GrapheneOS held it's ground here when you look at this closely.

Also, no forensic tooling logs, and no technical explanation of how password protected GrapheneOS devices were supposedly accessed. That kind of absence is telling, if a real exploit had been used, especially against a locked device, you’d expect way more documentation.

So far, nothing here points to a compromise of GrapheneOS itself. It just confirms that some devices were accessed, but we don’t know how. Speculation isn’t the same as evidence.

I honestly don't mean to give you a hard time. I know that you are being genuine about the info you are finding and posting here, however, If you happen to come across anything more detailed like forensic logs, tooling reports, or technical notes about the actual access methods, definitely share it. That would go a long way in helping clear up what really happened here.

ryrona

JayJay Samsung SM-S901B
"Telefonen har extraherats utan kod och en omfattande datamängd har anträffats." which translates "The phone has been extracted without code and an extensive amount of data has been found."

Likely Cellebrite.

JayJay Xiaomi 12t pro
fully extracted without code same as Samsung above.

Likely Cellebrite.

JayJay Google Pixel 7A.
IMEI 354487201175140

"The device was powered on and password protected.
The available content of the mobile phone has been extracted and a manual review of the
mobile phone has been conducted."

"Available content" meaning everything visible on lock screen? Doesn't sound like they got into that phone.

JayJay Emil Berling arrested 1st sept 2024
"The mobile phone has been extracted and examined manually by filming the screen."

Was it locked? Forced fingerprint unlocked? What phone?

JayJay GrapheneOS Google Pixel- 6a IMEI 35950275382472
Found in his apartment at a later stage - Fully extracted with software

Potentially interesting. Was it passphrase protected?

JayJay Google Pixel 6A with GrapheneOS
The device was turned on and NOT password protected. Found on desktop at home. IMEI 358385582080647

Well, this phone was not passphrase protected, so some use GrapheneOS but with security intentionally disabled (or only fingerprint to unlock).

JayJay Google Pixel 6A with GrapheneOS 1st Sept 2024 IMEI 358385589319923 From Kjellgren, Kent Sven Olof
The device was turned on AND password protected.
"The available content of the mobile phone has been extracted and a manual review of the mobile phone has been carried out."

Another "available content", so only what was on lock screen.

JayJay Google Pixel 7A IMEI 354487205182232
"The device was password protected, but the available content of the mobile phone has been extracted and is available in its entirety in the accompanying material."

Another one. Should be easy to verify it is only info on lock screen by looking in that accompanying material.

JayJay During a search of Firat Akgün's home at Stamgatan 37, Älvsjö, on 30 September 2024, a Google Pixel mobile phone was found.73 The device was found in a closet in the hall and was turned off.
The mobile phone has been identified (IMEI:35950275382472) and has been examined. The contents have been
extracted

If this if extraction of credential encrypted content, which is vague from that phrasing, this is not done by exploit, but knowing, guessing or being given the passphrase. Exploits would not help for BFU devices.

JayJay "The Google Pixel mobile phone has been extracted and Signal chats have been found.3 4
The chats themselves have not been extracted due to technical obstacles as the mobile phone was heavily
encrypted.

No information about how they got into the device, but maybe no passphrase or only fingerprint. This at least shows my theory is wrong, as the only reason they couldn't extract messages is because of Signal's ability to encrypt its messages in another layer at rest. Nothing indicates exploitation.

JayJay Google Pixel 7A. IMEI 352493420613342
"The device was turned on and password protected.
The available content of the mobile phone has been extracted and a manual review of the mobile phone has been carried out. The extraction and manual review of the device are available in their entirety in the accompanying material."

Another one "available content".

JayJay Google Pixel 6A IMEI 358385582080647
"The device was turned on and not password protected.
The available content of the mobile phone has been extracted and a manual review of the mobile phone has been carried out. The extraction and manual review of the device are in their entirety in the accompanying material. For your information, the extraction and manual review have generated different materials."

Not passphrase protected.

So, summary, no signs of any exploitation of vulnerabilities in GrapheneOS in any of these cases. Non-Pixels might have been victims to Cellebrite, but we know already they are vulnerable at that point of time and likely still.

Thank you a lot @JayJay for compiling this list. It saved me a lot of work.

Claimspro

JayJay

Thanks for the clearing things out.
I have not read this FUP since it is in zip.

If you see in the FUP where it say the phones has been extracted usually there would be pictures of what they extracted or like a page with pictures taken/saved on the phone or other stuff extracted text messages or even phone calls after each phone.

Did you find anything useful that shows the content they "extracted" the swedish police often shows what they extracted.

Bimmy

Thanks for any attempts to bring light into this matter.

Questions:

Is there evidence that the cited text is from authentic, official documents?
What evidence do we have that the events described truly happened? (In contrast to describing partially or wholly fictional events -- maybe as a scare campaign -- as users suspected above.)
(If 1 or 2 can't be answered yet, I wonder:) Specifically with the precisely cited numbers for alleged cases, mobile equipment, and even names -- is this consistent with evidence from "outside the bubble"?

Note: Question 3 is a weaker question since even consistency wouldn't necessarily equal truth. It might be easier to answer, though, particularly for persons with deeper insight into the Swedish legal system. Or in case of the chance we learned from someone actually involved in the purported cases.

GrapheneOS

Bimmy

Is there evidence that the cited text is from authentic, official documents?

It has not been verified, but there isn't much reason to doubt the authenticity. The documents do not make any claim that GrapheneOS has been exploited but rather that is entirely the assumption of several people in this thread and elsewhere. Therefore, the documents being authentic or not has little relevance.

What evidence do we have that the events described truly happened? (In contrast to describing partially or wholly fictional events -- maybe as a scare campaign -- as users suspected above.)

If the documents were a scare campaign, they'd probably claim that GrapheneOS had been exploited which they don't appear to claim anywhere.

(If 1 or 2 can't be answered yet, I wonder:) Specifically with the precisely cited numbers for alleged cases, mobile equipment, and even names -- is this consistent with evidence from "outside the bubble"?

There's no indication in the documents of any exploits of GrapheneOS or the Titan M2. Many aspects of it indicate that did not happen. That doesn't mean there aren't exploits of GrapheneOS elsewhere but it does not appear to be happening in these cases. It's not clear why a few people are so convinced it is when the documents do not claim it or even imply it. You can see there are a whole bunch of stated assumptions about supposedly passwords not being handed over due to it not being stated, so they draw the conclusion that the devices are exploits despite it not being stated. It's strange to assume many things didn't happen due to not being stated explicitly but that exploiting the devices did when it's not claimed either. It is confirmation bias.

matchboxbananasynergy

Another question to pose is - what assurances are there that the devices being discussed here are actually unmodified devices running official GrapheneOS.

In order to confirm that, you'd need to check the boothash or use Auditor. We are aware of groups taking our code and adding a bunch of ineffective and insecure "features" to it, sometimes even removing existing security features. They do that because those misguided features which we wouldn't implement due to them not working properly are attractive to specific groups who aren't very technical.

The icons looking like GrapheneOS' isn't actually enough to conclude that it's official GrapheneOS. It could be one of those dodgy forks, and if you want to take it a step further, if I've got an OS I can't deal with, I might "set up shop" and supply people of interest with phones running an OS that is secretly compromised while callling it "GrapheneOS".

All this to say, we haven't really seen any conclusive indications that remote or physical exploits that can get into an up-to-date GrapheneOS device exist - there are a lot of parameters to consider.

Blastoidea

The trouble with a thread like this is my not knowing enough to distinguish the good information from the bullshit, or the misinformation from the under-informed.

argante

JayJay Samsung has been accused in the past of building bugs into its modems - I provided links in my previous posts. Even now, Samsung is still accused of collaborating with government agencies. And it is Samsung's modems that are in the Pixels.

https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html

Masterlord

argante

argante Samsung has been accused in the past of building bugs into its modems - I provided links in my previous posts. Even now, Samsung is still accused of collaborating with government agencies. And it is Samsung's modems that are in the Pixels.

https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html

Interesting, of 18 vurnabilities 4 was completely remote and 9 required mobile operator network or local access.

This is interesting because in Sweden the police can mandate mobile operators to perform malicious activity to end users (lawfully).

So instead of "only" 4 ways in, they have 13 at their disposal. Just as an example, most of these are probably patched by now.

But who knows about current or future CVEs in Samsung Modems....?

Since the mobile operators have to follow police instructions (even malicious actions), just being in this country opens up alot more attack surface.

cuckflared

argante I wonder how vulnerable GrapheneOS is to these kinds of base-band exploits. Can the attackers take control over the entire phone by exploting bugs in the modem firmware? If this is the case then using a separate device that provides cellular connectivity could offer some protection.

GrapheneOS

argante

Samsung has been accused in the past of building bugs into its modems

Not credible allegations.

Even now, Samsung is still accused of collaborating with government agencies.

Not credible and hardly relevant.

https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html

This does not provide control over the OS without OS exploits.

Masterlord

Not sure what more people needs?

They do not need passcode, pin or fingerprint. It is stated in the court documents. My guess (not validated) is they do it remotely and hijack the screen. Thus "manually reviewed".

This is just ONE case shared in the thread. There are more cases in this country, where they have broken into GrapheneOS.

They do not need to disclose the technical aspects of how they got the evidence in court. They do not share this, to keep the exploit effective longer.

DeletedUser370

Masterlord This is just ONE case shared in the thread. There are more cases in this country, where they have broken into GrapheneOS.

Citation needed.

GrapheneOS

Masterlord

Not sure what more people needs?

Actual evidence of exploits. There aren't even statements indicating any exploits of GrapheneOS devices were done in unverified documents. It's not even an indication of it.

They do not need passcode, pin or fingerprint.

No, those are unsubstantiated claims based on confirmation bias.

It is stated in the court documents. My guess (not validated) is they do it remotely and hijack the screen. Thus "manually reviewed".

No evidence of this or claims of it.

This is just ONE case shared in the thread. There are more cases in this country, where they have broken into GrapheneOS.

0 examples of law enforcement even claiming to have exploited GrapheneOS have been provided. It is currently not even a claim that's being made which can be evaluated. It is an assumption several people are making for unclear reasons.

They do not need to disclose the technical aspects of how they got the evidence in court. They do not share this, to keep the exploit effective longer.

There is no claim of the devices being exploited in anything that has been shown/reviewed. We aren't talking about any details of exploitation being provided but rather the fact that it was not even claimed anything was exploited.

GrapheneOS

Masterlord Exploiting the cellular radio does not give access to the OS without OS exploits. Those exploit chains have been demonstrated, but it's significantly harder and GrapheneOS would provide extra protection against it. There's also no evidence indicating they're doing this for GrapheneOS or non-GrapheneOS devices. The claims that are being made don't even hold up for the non-GrapheneOS devices. What people are claiming they must be doing is not backed by statements in these documents or other evidence.

userofgos

DeletedUser299 any notifications you have entitled to be displayed, including signal if you have been carless enough to allow it and any that still come through whilst the phone is seized and powered on

True, but wouldn't someone with access to a locked pixel device with GOS only have access to viewing the icons of the apps and infer which they are?

I can only read the content of the notifications when have either used my fingerprint or unlocked via pin/passphrase to make them viewable.

ryrona

cuckflared I wonder how vulnerable GrapheneOS is to these kinds of base-band exploits. Can the attackers take control over the entire phone by exploting bugs in the modem firmware?

My impression from earlier communication with GrapheneOS team members is that the baseband is fully isolated from all other hardware and RAM memory not allocated to it. But I would like to get confirmation of this.

So it would require further exploiting a kernel driver or other low level operating system component. GrapheneOS has some hardening of kernel drivers and operating system components, but it is regular Linux kernel, so all drivers run in privileged kernel space, so exploitation would allow what was speculated about earlier in this thread but not supported by any evidence.

I like the suggestion of option that disables cellular when screen is locked. We don't know of any exploitation using cellular, and the court reports presented in this thread does not support that, but that would probably be easy to implement and similar to the USB protection feature in what security it provides. Many of us do not need cellular when phone is locked.

Nomood

Question for those who knows where they talk about.. If having gos on flightmode and connected with a mobile router with VPN is there a possibility to infect your phone by entering in the router? I know that they not just use pegasus or other likely Trojans to people but is it possible?

yore

Nomood If having gos on flightmode and connected with a mobile router with VPN is there a possibility to infect your phone by entering in the router?

Technically, yes. The possibility of an exploit always exists for most things, especially when you have a device that connects to the internet. However, in practice, the average user is probably not going to be targeted by such an attack.

Having said that, you're more likely to be compromised by a malicious app or a dangerous website than by simply connecting to a router. Although by enabling Airplane mode you do reduce your attack surface, it's probably not worth it as a strong security feature unless you're being targeted or your goal is to avoid cell tower triangulation. In any case, GrapheneOS has made improvements to Wi-Fi.

See below sources:
https://grapheneos.org/usage#wifi-privacy
https://grapheneos.org/features#wifi-privacy

« Previous Page Next Page »