Unsubstantiated claims about Sweden exploiting GrapheneOS with no evidence

GrapheneOS

locked A powered off phone with a password having all data extracted in fact largely implies that the password was known. They'd need to brute force or already know it, implying exploiting the Titan M2. Exploiting devices in After First Unlock state wouldn't give them the password. It's heavily implied they got password(s) elsewhere.

That’s not enough to conclude a live exploit was used in 2024.

The actual evidence even indicates otherwise.

GrapheneOS

ryrona

Okay. That just means they did not use any exploits against that one. No exploit can access encrypted data on a BFU device in any way at all other than by inputting the correct passphrase. So they did guess, know or was given the correct passphrase.

Yes, exactly. It shows that it was not based on GrapheneOS exploits for at least that phone, and heavily implies it for the other devices too.

Even if was a very weak password, they would have still had to exploit the Titan M2 to bypass brute force protection. If it was even a mediocre password, it would be very hard to brute force with brute force protection bypassed. We talk about using 6-8 diceware words because it outright prevents brute forcing even with massive compute power, but a much weaker password still provides substantial protection.

You mean USB port was "charging only" or complete off as opposed to "charging only when locked"? If they guessed, know or were given the passphrase, they would just be able to enable USB fully. So this might actually imply the possibility they have a cellular based exploit that kills the lock screen, but isn't able to enter passphrase needed to change security settings.

That would be extraordinarily unlikely. The lockscreen can't be killed like an X11 lockscreen but rather is a mode of the SystemUI. The SIM card exploit from 2022 which we discovered long before the public disclosure involved SystemUI wrongly entering an unlocked UI mode which is now protected against much better. It could still be hardened more, but it's about SystemUI logic. SystemUI crashing or anything like that would not do it. The device would just soft reboot back to the lockscreen

Is there any other possible explanation of why they would have gotten access to the unlocked user interface on a locked phone, but not able to do USB extraction?

If they didn't want to interact with the phone and have a way to extract data based on having the password provided to them without it. However, a whole lot of assumptions are being made about what they did and we don't think it makes sense to theorize based on a bunch of assumptions.

GrapheneOS

JayJay

In these type of reports you can also read the whole police interrogation, the passwords were NOT handed over or it would have been noted in the interrogation otherwise. Also fingerprint was not used.

It's wrong to assume the passwords not being in notes for interrogation means it wasn't turned over. They would have interacted with the police beyond that and there is also the possibility of the password being reused across many devices/services, etc. It may also have been written down, stored on unencrypted storage such as a password manager on a Windows machine, etc. You're assuming something about what happened based on what isn't stated. That's unsubstantiated.

They do not mention in these reports how the access was. However it was not through cellebrite for the Pixels as they usually mention it otherwise.

Not stating something doesn't mean it isn't what was done. We know Cellebrite Premium was only able to exploit GrapheneOS releases from mid 2022. It's possible that changed in the past month or so but we have documentation from 2025 for Cellebrite Premium. If they could exploit releases from 2024 with it, we would know. We also have similar documentation from several other forensic tool vendors and they only appear to be able to extract Before First Unlock data at best, if even that. It's less clear since they don't specifically cover GrapheneOS.

If they had password access they would have made a full extraction and not phone in airplane mode.

Emergency call takes a phone out of airplane mode. A feature for blocking that has been planned for a long time but not implemented yet due to time constraints. We can't implement everything we have planned.

Malmö TR B 11984-24 Aktbil 363-1.pdf

None of this indicates any exploits. In fact, what it shows is that they're likely getting people to hand over their password or getting it another way, followed by performing an extraction if possible or otherwise just recording browsing through the device. Are there even clear indications of exploiting non-GrapheneOS devices? Why is that being assumed when it's not stated?

GrapheneOS

Bimmy

Is there evidence that the cited text is from authentic, official documents?

It has not been verified, but there isn't much reason to doubt the authenticity. The documents do not make any claim that GrapheneOS has been exploited but rather that is entirely the assumption of several people in this thread and elsewhere. Therefore, the documents being authentic or not has little relevance.

What evidence do we have that the events described truly happened? (In contrast to describing partially or wholly fictional events -- maybe as a scare campaign -- as users suspected above.)

If the documents were a scare campaign, they'd probably claim that GrapheneOS had been exploited which they don't appear to claim anywhere.

(If 1 or 2 can't be answered yet, I wonder:) Specifically with the precisely cited numbers for alleged cases, mobile equipment, and even names -- is this consistent with evidence from "outside the bubble"?

There's no indication in the documents of any exploits of GrapheneOS or the Titan M2. Many aspects of it indicate that did not happen. That doesn't mean there aren't exploits of GrapheneOS elsewhere but it does not appear to be happening in these cases. It's not clear why a few people are so convinced it is when the documents do not claim it or even imply it. You can see there are a whole bunch of stated assumptions about supposedly passwords not being handed over due to it not being stated, so they draw the conclusion that the devices are exploits despite it not being stated. It's strange to assume many things didn't happen due to not being stated explicitly but that exploiting the devices did when it's not claimed either. It is confirmation bias.

GrapheneOS

argante

Samsung has been accused in the past of building bugs into its modems

Not credible allegations.

Even now, Samsung is still accused of collaborating with government agencies.

Not credible and hardly relevant.

https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html

This does not provide control over the OS without OS exploits.

GrapheneOS

Masterlord

Not sure what more people needs?

Actual evidence of exploits. There aren't even statements indicating any exploits of GrapheneOS devices were done in unverified documents. It's not even an indication of it.

They do not need passcode, pin or fingerprint.

No, those are unsubstantiated claims based on confirmation bias.

It is stated in the court documents. My guess (not validated) is they do it remotely and hijack the screen. Thus "manually reviewed".

No evidence of this or claims of it.

This is just ONE case shared in the thread. There are more cases in this country, where they have broken into GrapheneOS.

0 examples of law enforcement even claiming to have exploited GrapheneOS have been provided. It is currently not even a claim that's being made which can be evaluated. It is an assumption several people are making for unclear reasons.

They do not need to disclose the technical aspects of how they got the evidence in court. They do not share this, to keep the exploit effective longer.

There is no claim of the devices being exploited in anything that has been shown/reviewed. We aren't talking about any details of exploitation being provided but rather the fact that it was not even claimed anything was exploited.

GrapheneOS

Masterlord Exploiting the cellular radio does not give access to the OS without OS exploits. Those exploit chains have been demonstrated, but it's significantly harder and GrapheneOS would provide extra protection against it. There's also no evidence indicating they're doing this for GrapheneOS or non-GrapheneOS devices. The claims that are being made don't even hold up for the non-GrapheneOS devices. What people are claiming they must be doing is not backed by statements in these documents or other evidence.

GrapheneOS

foxkurdisssh Which is why it's completely wrong for people to be claiming that lack of any indication of how they got into devices means they exploited them. There are many people who cooperate with police once faced with that situation. There are also other ways to get the password. It's not clear why people are claiming that these documents indicate exploitation when they do not claim to have done that, do not imply it was done and even have parts which imply it wasn't what they did. If they had OS exploits they wouldn't need to do a lot of what it's indicated they did and OS exploits would not work to get data in several situations presented where it's Before First Unlock with a password. It's largely implied they got the password another way...

foxkurdisssh RAM is not fully encrypted on the supported devices but there's a locked device auto-reboot feature on GrapheneOS kicking in 18 hours after the device is locked by default. GrapheneOS clears freed memory in the kernel including when rebooting or shutting down, which wipes most memory. It also wipes all the free memory when booting the OS. Since April 2024, fastboot mode on Pixels wipes memory on boot before USB is activated. Encrypted RAM would be nice but the SoC can still be tampered with even with encrypted RAM. Encrypted RAM raises the difficulty of that kind of approach to extracting data. It's highly unlikely with GrapheneOS especially for a non-extreme case due to locked device auto-reboot. The passphrase is also not in the memory.

foxkurdisssh

GrapheneOS

Yes, strong password, right settings. You are 99% safe if you are not a terroroist. Gos is the safest mobile you can have in the market right now, also its a big diffrence between the GOS from 2023 to today because of major updates.

de0u

foxkurdisssh I see that many people complain that it does not say how, where, when the police entered the GOS in the FUP. What you need to understand is that the police in Sweden do not have to show how they entered, they do not have to report anything, it is enough that they know the contents of the phone and it is enough to say that it was fully extracted, etc.

Then no "fully extracted" report counts as evidence that an exploit was used unless somehow there is an explicit statement that an exploit was used.

If any of the proffered police reports does say an exploit was used, it would be great for somebody to say which page of which document.

Otherwise it doesn't matter if there are 500 or 5000 or 50000 police reports that say "fully extracted".

Claimspro

foxkurdisssh

Not true 9/10 times in FUP the police will state what they used to gain access to the phone in the case or the evidence they have used.
For example; It would say cellebrite or HAK or HDA or HÖK have been used on Iphone 11 to gain this and that and after the FUP will show the extracted information.

This statement is also not true:
In Sweden you can be detained with full isolation for a crime you did not commit for over a year or 2 and then be free in court, this is very common. The police can basically do whatever they want.

The person of interest needs to be suspected with evidence to be in isolation.
https://sv.m.wikipedia.org/wiki/Misstankegrad

And if set free due to the evidence not strong enough it is because sweden follows something called,
"Hellre fria än fälla" with other words meaning "rather to set free than sentence someone innocent.

I dont know why people keep claiming the police can do what they want in Sweden. Sweden still sends phones abroad to get help so I dont know where you guys get all this info that FRA and SAPO helps the police.

In the worst year in Swedens criminal history, FRA and SAPO did not step in and help. Stop scaring people and spreading fake rumours. For 2 weeks now GrapheneOS have been a subject among people in Sweden just spreading fake things who started it and where everyone gets the info they have is a mystery.

I know cases high profiled murder cases in Sweden from middle of 2024 and one in 2023 that the police admitted they could not break the encryption and did get no access to the information on the phone.

If the case is that the police had methods to crack the encryption it would be over every newspaper in Sweden like the Swedish police always do celebrate every major thing that could stop the ongoing violence in sweden.
I did send a podcast with forensics in the swedish police who clearly states it all depends on the circumstances if they can gain access. Is it unlocked? Do they have the password? Is there no password? Have the suspect given the password?

Answers no one in sweden can answer but the police. These rumours has to stop.

HecticHector

Its a shame GrapheneOS get so defensive and abrasive, so much so that I didn't even want to post this, especially without any evidence of my experience. Australia has just passed draconian laws with back dooring phones. Including being able to act as you and post on your social media. Our Gov's online security chief is an American WEF nutter woman.
A few months ago I was using GrapheneOS on Pixel 6 Pro. I am not a criminal, a small business owner protecting clients sensitive data. One glorious day I became surrounded by 30 undercover officers, one of whom was looking at my phone data via his phone in real time. He stated "I'm having a hard time seeing what he's writing" as I was texting someone letting know the situation.
I've skipped a lot of fine details and I won't be providing evidence of my experience. I have made official complaints to LECC Australia, governing agency who investigate police corruption, abuse of power, etc.
With an easy Google search you can find the laws passed here.
I appreciate GrapheneOS team so much for all your efforts. I understand getting defensive, I do to when I get a bad review.
We only want to be safe and not treated like we're all criminals in our houses by our government in Oz. It's become ridiculous here and we need GrapheneOS. It's growing here, people are even starting business' selling preloaded GrapheneOS on new devices. Controversial I know but we need this. And so do GrapheneOS for exposure. Fingers crossed they do righty and donate to Graphene.
Hearing "I'm having a hard time seein" was music to my ears, but they were still seeing something, what? No idea.

Nuttso

In this entire thread, I've noticed there's quite a bit of misinformation floating around, and I'd like to clarify a few things based on actual experience and factual knowledge. I've personally been dealing extensively with law enforcement and relevant authorities who closely monitor these issues. I'm also involved with a privately established committee under a legal group in Germany that collaborates with organizations like the Chaos Computer Club and German Association of Criminal Defense Lawyers.

One significant shift we're seeing is that law enforcement is moving away from traditional forensic extraction methods. Instead, they're increasingly focusing on exploiting vulnerabilities in systems directly. Why this change? Because when security measures against forensic extraction are implemented correctly and truly understood by users, they become virtually impossible to bypass. On the other hand, attacking the software itself (exploiting drivers, firmware bugs, or other software weaknesses)often provides a much easier pathway.

The claim made here that Swedish authorities can effortlessly extract live Signal messages and screenshots from GrapheneOS devices is very questionable and, frankly, sounds exaggerated. From my direct experience and insight, I can confidently say such feats would require extremely specific conditions and vulnerabilities that, as far as we know, currently aren't present in GrapheneOS.

Additionally, it's worth mentioning that in Germany, an entire governmental authority named ZITiS (Central Office for Information Technology in the Security Sector) has been specifically established to facilitate precisely this kind of infiltration. Similar entities exist in other countries, and these efforts aren't exactly hidden from public view. In fact, there is a clear trend towards changing legislation throughout Europe to explicitly support and enable these kinds of methods in the near future.

DeletedUser622

GrapheneOS If you reuse the password, the weakest security machine where it's used can be targeted. It's also entirely possible someone reused it for a website or other service.

Poisoning the well by reusing duress password elsewhere would make sense then. Imagine: lawdogs take your phone, enter an assumed password which turns out a duress one :)

Nomood

Can people who know where they talking about please ho a bit deeper in the possibility if it is possible to enter a gos device with a pegasus like trojan.. I am very curious if that's a easy job for that kind of sophisticated trojan or still very dificult. Also please if using in combination with flightmode and mobile WiFi router with VPN.. Reason why I curious is that I know for sure that very recent it was impossible to open some gos devices from a group of people but the fact that the Swedish authorities have there own developed pegasus like trojan is 100% true and that they are using it at the moment very easy by people who are not high profile or terrorist is very scary so we know iPhone is a piece of cake for them just please go a bit deeper in to it how far it is possible with a gos with and without a mobile router thanks in advance

Nuttso

Nomood it was stated several times already. Gos is no magic and also not bulletproof. Baseband and kernel architecture isn't 100% safe

locked

HecticHector Fascinating story, 30 undercover officers, real time surveillance, live commentary on your texts... it’s got everything. Tom Clancy, anyone?

If something like that actually happened, especially on ANY device, it would be a landmark case, complete with technical disclosures, forensic reports, and, you know.... evidence.

Until then, We’ll stick to verifiable and reproducible methods, not theatrical anecdotes that leave out details and just happen to support the idea that ANY OS can be magically compromised.

tango

Nuttso

With the baseband being isolated on GOS it makes it a lot more difficult though! The baseband and the OS would both need to be compromised. Things like LTE only make that even more difficult!

Bimmy

GrapheneOS It's not clear why a few people are so convinced it is when the documents do not claim it or even imply it. You can see there are a whole bunch of stated assumptions about supposedly passwords not being handed over due to it not being stated, so they draw the conclusion that the devices are exploits despite it not being stated. It's strange to assume many things didn't happen due to not being stated explicitly but that exploiting the devices did when it's not claimed either. It is confirmation bias.

Thank you for the reply.

If you allow me to add my own interpretation and to slightly drift into offtopic philosophy: Our brains have some wonderful attributes -- and imagination can be a fantastic quality -- while, as already implied, being deeply biased by default. Sentential calculus is not our default mode of operation and it has a high cost of chemical energy and experienced effort to invoke and keep consciousness doing that calculus. Its the imperfections of that biology that provoke our rash conclusions.

Getting somewhat back to documents, and the incomplete information we have, it could generally be helpful to call an old saying to mind: That absence of evidence is not evidence of absence (s. https://quoteinvestigator.com/2019/09/17/absence/ ). Our uncertainty and our emotions can make it very hard to infer truthful statements, and it will take continuous effort from all participants to turn the uncertainty we all started with into something more positive.

cuckflared

locked I think HecticHector's post was actually supportive to GrapheneOS security. According to him the officer said "I'm having a hard time seeing what he's writing", meaning they were not able to decrypt his communication. Whether this actually happened, I don't know. But given that law enforcement has relatively easy access to ISP data, watching someone's SMSes in real-time by authorized personnel doesn't seem impossible. If they can do it sitting in the office, they could do it in the mobile app using HTTP to connect to the server in the ISP.

« Previous Page Next Page »