Posibility of device compro/steps to clean?

Curious

Hi folks,

first I want to appologize for paranoia topic... I am not claiming, I am just assuming.

please can someone help me, what steps to take for peace in mind?
What happend, well I bought a USB-C headphones that were listed as OOB (bulk) and decided to use them recently, but then I realized that if there were no seal, box (they came in plastic bag with accessories) they could be not legitimate or something else, so I contacted a seller and asked about source of supply and the person told me that they do not know the source.
So... I can assume (but probably it is really, really low chance but still) that the device I have could be compromised over USB. (USB-C, integrated DAC)

Setup of GOS was not changed how it came from installation.
The most recent build with security preview.

What steps should I take to make sure that the device is clean and safe?
Thank you for your help and sorry again for this topic

de0u

Curious What steps should I take to make sure that the device is clean and safe?

It depends on your threat model. For example, if you believe it's important to defend against the very-remote possibility that a nation-state actor infected the headphones with a tightly-focused anti-GrapheneOS exploit chain that corrupted the bootloader, it might be best to grind the 9a up or melt it down.

Luckily, there is a range of things that can be done (presented in order of least-disruptive to most-disruptive):

Reboot the device, check the signing-key hash versus the installation web page,
Run Auditor and see what it says,
Back up your data and "factory reset" the device, then restore your data,
Back up your data, unlock the bootloader, re-flash GrapheneOS, then restore your data,
Back up your data, unlock the bootloader, flash back to Google's stock OS, sell the device on eBay, get a new device,
Melt the device down and purchase another device.

Honestly I suspect that #1 + #2 is plenty.

CGG

de0u good one

CGG

Well actually I understand your paranoia. I have been hacked in almost known forms that i have knowledge of. And i have been a CTO, Businessman for more than 20 years... So its something i deal with a long ago. What i learned basically is: dont use anything you dont need if you have the sensation of being constantly watched. I used to wear earbuds, photos in mobile, vídeos, etc... But nota anymore. So, in doubt dont use it. Simple as that. Sure, take a venlafaxin or quetiapin tab and keep going because u are much more important than a ear bud.