dubious file with the name "home-security" found in files

OrangeMamba

The file has no file extension, does not tell me how big it is, cannot be deleted or opened.

Is there any way to find out what it could be? Are there any logs that tell me if it was created by an app and what function it has?

I have found it in "Downloads" in the file explorer but only in the Downloads shortcut, but not in the folder itself.

OrangeMamba

Here are some logs:

type: logcat
osVersion: google/tegu/tegu:16/BP3A.251105.015/2025112101:user/release-keys
buffers: main,system,crash,events,kernel
level: verbose
filterRegex: home-security

--------- beginning of main
11-25 15:16:28.156 10165  3675 14707 W ModernMediaScanner: Failed to visit /storage/emulated/0/Download/.pending-1764279801-home-security: java.nio.file.NoSuchFileException: /storage/emulated/0/Download/.pending-1764279801-home-security
11-25 15:16:53.454 10081 15037 15037 D LogcatActivity: command: logcat --buffer=main,system,crash,events,kernel -d --dividers --format=UTC,printable,descriptive --regex=home-security *:V --uid=10066
11-25 15:17:17.776 10081 15037 15037 D LogcatActivity: command: logcat --buffer=main,system,crash,events,kernel -d --dividers --format=UTC,printable,descriptive --regex=home-security *:D --uid=10066
11-25 15:17:26.633 10081 15037 15037 D LogcatActivity: command: logcat --buffer=main,system,crash,events,kernel -d --dividers --format=UTC,printable,descriptive --regex=home-security *:I --uid=10066
11-25 15:17:30.450 10081 15037 15037 D LogcatActivity: command: logcat --buffer=main,system,crash,events,kernel -d --dividers --format=UTC,printable,descriptive --regex=home-security *:W --uid=10066
11-25 15:17:35.368 10081 15037 15037 D LogcatActivity: command: logcat --buffer=main,system,crash,events,kernel -d --dividers --format=UTC,printable,descriptive --regex=home-security *:A --uid=10066
11-25 15:17:38.760 10081 15037 15037 D LogcatActivity: command: logcat --buffer=main,system,crash,events,kernel -d --dividers --format=UTC,printable,descriptive --regex=home-security *:V --uid=10066
11-25 15:17:43.596 10081 15037 15037 D LogcatActivity: command: logcat --buffer=main,system,crash,events,kernel -d --dividers --format=UTC,printable,descriptive --regex=home-security *:V --uid=10066
11-25 15:18:21.696 10081 15378 15378 D LogcatActivity: command: logcat --buffer=main,system,crash,events,kernel -d --dividers --format=UTC,printable,uid,descriptive --regex=home-security *:V
11-25 15:19:45.355 10081 15378 15378 D LogcatActivity: command: logcat --buffer=main,system,crash,events,kernel -d --dividers --format=UTC,printable,uid,descriptive --regex=home-security *:D
11-25 15:19:49.251 10081 15378 15378 D LogcatActivity: command: logcat --buffer=main,system,crash,events,kernel -d --dividers --format=UTC,printable,uid,descriptive --regex=home-security *:I
11-25 15:19:57.195 10081 15378 15378 D LogcatActivity: command: logcat --buffer=main,system,crash,events,kernel -d --dividers --format=UTC,printable,uid,descriptive --regex=home-security *:W
11-25 15:20:03.279 10081 15378 15378 D LogcatActivity: command: logcat --buffer=main,system,crash,events,kernel -d --dividers --format=UTC,printable,uid,descriptive --regex=home-security *:E
11-25 15:20:08.436 10081 15378 15378 D LogcatActivity: command: logcat --buffer=main,system,crash,events,kernel -d --dividers --format=UTC,printable,uid,descriptive --regex=home-security *:A
11-25 15:20:11.185 10081 15378 15378 D LogcatActivity: command: logcat --buffer=main,system,crash,events,kernel -d --dividers --format=UTC,printable,uid,descriptive --regex=home-security *:V

MetropleX

OrangeMamba pending implies you've tried to download something in your browser to the downloads folder that didn't complete and as such the browser is retaining control of the file awaiting for the download to be resumed or cancelled in it. Open Vanadium or your third party browser and downloads to see if anything is incomplete there.

OrangeMamba

No, nothing in the downloads tab of any browser on my phone.

MetropleX

OrangeMamba if it isn't in there, then there is another app that generated the file and you need to find which one it is so that it can be removed. Apps that create files control them. Something has either started to download or upload. It is nothing to be concerned about in and of the file itself by the way. The only issue you have is finding the relevant app to remove it.

A quick web search about .pending files reveals people with similar issues. It's not GrapheneOS specific or anything targeting you. It's from an app you trusted to install.

23Sha-ger

OrangeMamba
Those "home security" apps are horrible, I did a research on them with my previous employer.
Generally speaking, they upload so much telemetry, you will have to ask twice if you want that.
We discovered that 8/10 of those "security" products, upload personal data to the cloud of the OEM.
Avoid, or firewall them when possible. I firewalled my pet camera monitor to only access my vLAN, which
is part of my zerotier wireguard LAN.

ejns

23Sha-ger This is the way. I probably don't have it set up 100% properly but I have a subnet that is firewalled from my 'trusted' main LAN. That's where my security cameras and other crapware IoT devices go. These devices can talk to my pihole for DNS purposes but are otherwise blind to anything else.

MetropleX

avalynn11 Removed the adb suggestion, we do not support or provide support for devices where adb has been enabled, adb should not be enabled on production devices.

If you have ADB access, you can enable perf events, but there's a lot more attack surface via ADB than that and it's as close as it gets to having root access without an exploit. A userdebug build provides root access via ADB.