Carrier pings with WiFi Calling disabled + other questions about how that works

vividsquirrel

23Sha-ger they have a much more detailed location about you
other than just a broad "IP geolocation" of your WiFi router you are connected to.

This is very true. I'm not really worried about that kind of IP geolocation. It's more about the idea that I want to be able to dissapear from the cell network by turning on airplane mode. If (for example) I am somewhere and I turn on airplane mode and then go home, then maybe some other places and back home, then that activity would normally not be known to the cell network, however with these connections, the network can still see whether I'm coming from my home IP, or the IP associated with work or school. Sure, it's not a semiprecise geolocation, but it could still paints a picture of my activity. Since most people just leave WiFi and cellular on all the time, would it not be really easy for them to correlate IP addresses with geolocations?

23Sha-ger Your phone will still connect to a local carrier that is partnered with silent.link when using data. The only difference is that the carrier cann't associate this connection to your actual identity.

I'm more asking about whether these kind of WiFi connections are made with silent.link. I do not see anything on DNS query logs but that's also not a very sophistocated analysis. I do know that when you set it up, it has to download the ESIM (i think from silent.link's European provider Plus.pl) and i'm not sure if this connection bypasses the VPN (This is kind of unrelated but I am still curious)

23Sha-ger You can disable VoLTE/VoNR/Wi-Fi calling in the override menu to prevent the phone from trying to register to
the carrier's IMS services which provide the above functions. Which is probably what you see in the router logs.

When I go to the override settings, I can only choose between forcing it to be available or the default which is still "available". Unfortunately there doesn't seem to be a way to block these features from the carrier override settings.

Ilgar

vividsquirrel I think even if cellular provider supports volte and vowifi via provided config it must be enabled in sim settings first, to make it work, just like if you forced volte and vowifi via grapheneos option to force enable it, so my understanding it shouldn't leak if you didn't enable vowifi

vividsquirrel

Ilgar That would be my assumption about how that works too but in my testing, my phone is resolving WiFi calling domains with the WiFi calling toggle disabled in sim settings.

Ilgar

vividsquirrel yes, there mustn't be a leak with wovifi not enabled, and especially in airplane mode. period

if this happens with any cellular provider I better not use esim and install sim only when needed.

de0u

vividsquirrel That would be my assumption about how that works too but in my testing, my phone is resolving WiFi calling domains with the WiFi calling toggle disabled in sim settings.

Is the SIM itself disabled?

vividsquirrel

My larger concern is that the sim is a computer in itself which runs proprietary carrier software that can be installed and controlled remotely because the sim has a direct connection to the baseband that is completely seperate and invisible to the OS.

My previous understanding is that this certainly eye-opening but has limited relevance to privacy because the sim/baseband can't really do anything to the OS with GrapheneOS since it doesn't allow carriers to install apps on the device. (https://grapheneos.org/faq#cellular-tracking) In addition, enabling airplane mode fully disables transmit/recieve on the modem, so it should theoretically cut the sim and baseband from being able to do any kind of tracking or any other weird thing.

My concern is that it would seem that even enabling airplane mode does not prevent the sim and its proprietary and potentially compromised software from being able to communicate, especially outside th protection of the OS VPN.

I don't really know if this kind of thing is possible because I don't fully understand how it works. I know of keywords like IMS and ePDG but I'm not very knowledgeble of what these things are and how they're used. I want to better understand how these things work and if they can be used maliciously.

de0u

vividsquirrel My larger concern is that the sim is a computer in itself which runs proprietary carrier software that can be installed and controlled remotely because the sim has a direct connection to the baseband that is completely seperate and invisible to the OS.

I can imagine that the SIM has a "direct connection" to the baseband, but I can also imagine that it doesn't. Is it possible to cite a source for this?

vividsquirrel

de0u I've heard this mentioned sometimes in various Defcon presentations as well as a Naomi Brockwell interview with David Allan Burgess (This specific info is found at 3:38 but a more broad explanation from him starts earlier). I think it's mostly a carry over from old days when cell phones were mostly based around the sim card and applications were hosted on the sim (STK applications which are still supported in android via the SIM Toolkit app which is built in). This connection was mainly to allow the sim to send SMS messages itself to allow these built in apps to communicate, as well as alowing updates over the cell network. This architecture has seemingly stuck around for legacy purposes.

vividsquirrel

de0u No, the SIM itself is still enabled. I imagine this problem would go away if you disable the sim, but that's a lot more of a pain then just switching on/off airplane mode.

de0u

vividsquirrel My understanding is that airplane mode is expected to turn off the cellular modem (and sometimes the Wi-Fi interface but not always).

Various people have various expectations about whether various carrier functions (Wi-Fi calling, text messages, voicemail alerts) should or should not work while the cellular modem is off. I agree that the exact operation of carrier functions while the cellular modem is turned off is complicated and I can imagine it's different by carrier.

But if what is wanted is disabling all carrier functions for a specific carrier account, and there is a toggle that does that, it's not clear how bad it is if some other toggle doesn't do that also (especially since some people would be unhappy if that other toggle did do that).

vividsquirrel

For anyone wondering, I've solved this by using custom dns on the device with a custom blocklist. Based on my logs the domains that need to be blocked to have this effect on Verizon or a Verizon MVNO are*.vzw.com and *.vzwwo.com

23Sha-ger

de0u
Disabling the SIM/eSIM with the slider menu achieves the same, no IMS communication to the carrier.
When the SIM is active, it will try to connect to the carrier over WiFi even on airplane mode, which is the
intended way of it to function. A DNS block is a valid solution as well but requires more maintanence.

vividsquirrel

de0u

de0u Various people have various expectations about whether various carrier functions (Wi-Fi calling, text messages, voicemail alerts) should or should not work while the cellular modem is off.

100% agree with you there. There are lots of reasons you might want WiFi calling to work with airplane mode on because if you still have to use carrier texts/calls, then it still protects you from triangulation while still allowing you to use it.

What I think nobody would really be upset by is disabling the carrier's WiFi connection when WiFi Calling is disabled since it has no reason to connect. It seems there are github issues about this but they appear to be pretty old and/or pretty dead, for example #887

de0u

vividsquirrel What I think nobody would really be upset by is disabling the carrier's WiFi connection when WiFi Calling is disabled since it has no reason to connect.

That might reduce surprise... but the name "Wi-Fi calling" includes calling as part of the name. It's not called "Wi-Fi calling and text messages and voicemail alerts". Meanwhile, again, there is already a toggle that disables all calling and text messages and voicemail alerts for a given carrier account. The desired effect can already be accomplished, at the cost of a few extra taps.

vividsquirrel It seems there are github issues about this but they appear to be pretty old and/or pretty dead, for example [#887](https:///github.com/GrapheneOS/os-issue-tracker/issues/887).

There has been a lot of water under the bridge since then. For example, several changes by Google have made it much harder to keep up with AOSP. A feature that might have been "interesting but not urgent" in 2022 might be somewhat reduced in priority in 2025.

If it's easy to fork that repository and bring it up to date with A16 QPR1 that might increase the interest of the developers in reviewing and then perhaps testing and maintaining the code. I would point out that this seems to me much less critical than VoLTE forcing, and that had been stalled for a while, until it became an urgent need for a large number of users.