My GrapheneOS was cracked by Belgian police

Divby0

I can't find any evidence regarding any "crack". Am I missing something?

raccoondad

Divby0 I can't find any evidence regarding any "crack"

GOS responded saying the situation was probably based on an "easily guessable lock method, biometrics without 2FA, or not updated device" :v

They also mentioned they can't make promises on commercial device cracking tools, which is fair.

n3t_admin

Divby0 no, this is just a normal hearing invitation, I guess for court? Translation isn't very good for legal documents. There is 0 evidence GrapheneOS was cracked, especially since it isn't mentioned in court documents (if there even are any) and most likely some other form of evidence has led to the arrest.

I smell a nothing burger. Or bait, which, considering the user joined 20 minutes ago, is a very real possibility.

b8r2

Divby0 i don't have the pdf as only my lawyer can view the case files. But he said very clearly that the device was cracked

b8r2

raccoondad I replied to them.

raccoondad

n3t_admin I smell a nothing burger. Or bait, which, considering the user joined 20 minutes ago, is a very real possibility.

Lots of bait recently

b8r2

n3t_admin I'm trying to find clarification on how the device was cracked even though i had all security measures. Whatever you think does not matter

r134a

n3t_admin It is indeed a request to go to the police station at one of the given dates, to be interogated about murder with premiditation which he/she might be charged with.

I'm not entirely sure it is bait, the document request for interrogation seems legit. That person might believe his phone was cracked, however indeed no indication in that request to motivate claim.

It might indeed be likely a weak pin was used or something along those lines, or CCTV might have captured the person entering his pin/pass or whatever. Unclear at the moment.

However the person claims to have proof and perhaps that person might be willing to exchange that proof? I don't think the person really cares given the sharing of that request stating Antwerp zone, and 2 specific dates with time, combined with the possible charges.
It atleast indicates the person isn't trying to conceal to Belgian police he is sharing this.

gta3

b8r2 just becuase your lawyer said the device was "cracked" doesn't make it true.

Many people including your lawyer use terminology they don't know the meaning of.

Cracked / hacked / bypassed / decoded all mean diffetent things in diff contexts and also in diff people

Go ask your lawyer what exactly was "cracked"

I don't believe this thread tbh, smells fake__

Nuttso

b8r2 Then release your lawyer from his duty of confidentiality and let him publish the passage stating that it was cracked. He can redact your sensitive data beforehand. If a Pixel, even without grapheneos in BFU mode with an alphanumeric PIN, is actually cracked in Europe, then there is reliable documentation for the court. I assume that your lawyer cannot distinguish between simple terms.

b8r2

raccoondad My lawyer forwarded that mail, and i can prove it.

n3t_admin

b8r2 I'm trying to find clarification on how the device was cracked even though i had all security measures. Whatever you think does not matter

Okay, first off: there are no "all security measures". This is not how OpSec works. There are so many attack vectors, that even the slightest misstep might lead to fatal consequences.
For example: they could shoulder surf your password/pin in a public place or from security cameras. They could pull your fingerprints from their database and try to 3D-print them. They might install some sort of trojan via a 0-day that is only available for intelligence agencies or trick you into installing it. Unless we know what type of evidence they even got out of the phone, it is pointless debating a breach of GrapheneOS. If they are really stupid, they will try to use location data as evidence, in which case the OS doesn't really matter, since they pull if from the carrier.

There are way too many questions and unless we know the full details about the setup used, throwing out insane claims like these is disingenuous and does a great disservice to the project.

Maketrades

b8r2

What pixel was it and you didn't use same unlock code as your private phone I geuss? There are loads of gos devices confiscated and impossible to enter and I doubt the Belgian cops who are not the smarters to have a way to crack them so I geuss they have found a way to geuss your code...

hemingway

b8r2 My OS was seized, i had all security features enabled

What were these security features specifically? What model phone?

hemingway

n3t_admin throwing out insane claims like these

I dunno I see it as useful to consider as a sort of thought experiment. Greasy fingers + lack of pin scrambling + short pin with no repeated digits? It helps me think about how to create difficult to guess pins, consider whether long passwords are worth the inconvenience, etc.

n3t_admin

SkynetPrime Then your admitting that you must be guilty.

Not necessarily. It might actually be the opposite and they might be framed for a crime they didn't commit. This might be based on the wrong conclusion, that the police found something on the phone just by telling them that they found evidence. The post is not written in an incriminating manner anyway. But having the phone seized plus the warrant might lead you to assume, that the reason for the warrant is the phone. Correlation and causation, yada yada, you know the drill.

hemingway It helps me think about how to create difficult to guess pins, consider whether long passwords are worth the inconvenience, etc.

If murder charges are on your bingo card, I would strongly suggest that and 2FA unlock, that much is for sure.

r134a However the person claims to have proof and perhaps that person might be willing to exchange that proof? I don't think the person really cares given the sharing of that request stating Antwerp zone, and 2 specific dates with time, combined with the possible charges.
It atleast indicates the person isn't trying to conceal to Belgian police he is sharing this.

I hope so, at least. This forum has lately seen all sorts of ridiculous to outright batshit crazy claims and in basically every case so far, they accusers have failed to provide definitive evidence. I really do hope OP is willing to share something to back up those claims.

b8r2

r134a The daita pin & password on the phone for it to activate and format itself but the functionality didnt work as intended wich resulted in a decryption of the files on the phone

SkynetPrime

So here's the thing.. If, and a big if that 0.00000001% your statement here and on x is true, and your saying..

b8r2 My OS was seized, i had all security features enabled. Now i got a call from my lawyer saying i have a warrant for my arrest for a Murder that was planned, the warrant was sent out by the INTEL department of the federal police.

Then your admitting that you must be guilty.

Let me explain.. Only you know what's on your phone, so if your claiming that "a warrant for my arrest for a Murder that was planned" and claiming they have cracked your phone, you must be guilty or you wouldn't be making this claim.
Because, if "a warrant for my arrest for a Murder that was planned" wasn't on your phone. You would know that they haven't cracked your phone.. You get me..?

hemingway

SkynetPrime Then your admitting that you must be guilty.

Not until the courts decide this imo.

SkynetPrime

starglider

starglider If this is real (which, honestly, probably not), this guy is basically live-tweeting his guilty plea on Twitter.

Yep..This is exactly what I'm trying to say.

SkynetPrime So here's the thing.. If, and a big if that 0.00000001% your statement here and on x is true, and your saying..

b8r2 My OS was seized, i had all security features enabled. Now i got a call from my lawyer saying i have a warrant for my arrest for a Murder that was planned, the warrant was sent out by the INTEL department of the federal police.

Then your admitting that you must be guilty.

Let me explain.. Only you know what's on your phone, so if your claiming that "a warrant for my arrest for a Murder that was planned" and claiming they have cracked your phone, you must be guilty or you wouldn't be making this claim.
Because, if "a warrant for my arrest for a Murder that was planned" wasn't on your phone. You would know that they haven't cracked your phone.. You get me..?

All makes no sense atal.

r134a

n3t_admin

n3t_admin I hope so, at least. This forum has lately seen all sorts of ridiculous to outright batshit crazy claims and in basically every case so far, they accusers have failed to provide definitive evidence. I really do hope OP is willing to share something to back up those claims.

True, i'm not sure either though. But the document request for interrogation seems legit. Which leans me towards believing that that person believes his phone got cracked, given the origin of that letter (police district Antwerp - digital forensics & analyse). So i don't believe at the moment that person is trying to bait. More than likely not really techy, bad opsec, and now angry because 'caught?'

Edit: but then again, made me wonder, Belgium is next to France..?

SkynetPrime

n3t_admin Not necessarily. It might actually be the opposite and they might be framed for a crime they didn't commit. This might be based on the wrong conclusion, that the police found something on the phone just by telling them that they found evidence. The post is not written in an incriminating manner anyway. But having the phone seized plus the warrant might lead you to assume, that the reason for the warrant is the phone. Correlation and causation, yada yada, you know the drill.

I think what I'm trying to say is that the op knows what's not or what is on there phone. So the only thing the op has to go on is a phone call from there lawyer claiming the phone has been cracked. So putting everything else aside, the op can only make the claim here and on x that the phone has been hacked if the op knows there is information to make this claim on there phone. As if there was no information on the phone, the op would know that the claim from the ops lawyer was BS and would not make the statement here and on x that the phone was hacked. So by making the claim if makes the op look guilty.

I'm explaining in this way as this too me is total BS IMO as these claims make no sense

r134a

Also with the limited data as of now, the document request for interogation indeed originates from Police district Antwerp, digital forensics & analysing.

This might aswell indicate this doesn't necessarly mean the phone itself got 'cracked', but perhaps rather communications of that person got obtained from email, whatsapp, facebook, whatever, or something similar.

Perhaps a pin/password was thought being strong but was being reused at multiple services, and got obtained from another service en tried on the phone.

All speculation ofcourse, but with the limited data available only speculation is possible.

starglider

My dude . . . you have an arrest warrant out for murder, and you're posting about evidence-related issues on a public forum? Obviously, I'm sure the community would greatly appreciate any info on how the device was compromised (if it was via some vuln vs. the countless possible side-channels that exist¹), but you've effectively and publicly admitted that there was stuff on your phone that implicated you.

¹As just one example, if you unlocked your phone in view of a security camera, forensics could pull the tape and discover the passcode but virtually shoulder-surfing you. That's a lot of work, and if you're some rando protestor who's been rounded up to "send a message," they'll probably just confiscate your phone and be done with it. But for murder . . . yeah, they'll dig.

dc32f0cfe84def651e0e

starglider if you unlocked your phone in view of a security camera, forensics could pull the tape and discover the passcode but virtually shoulder-surfing you

Great point to change the passcode often an to set the previous one as duress.

starglider

SkynetPrime Also, and I'm not sure about other countries, but in the US, investigators can and do lie. An investigator could absolutely say "we cracked your phone and know what you did; cooperate now and plea out" even if the phone is sitting in an evidence locker happily fortified in BFU. They don't have to share their actual evidence until the criminal trial begins (again, at least in the US).