releases.grapheneos.org possibly with unkown ip address

noradx

I installed RethinkDNS on my Pixel8 to intercept all DNS queries and resolve them through a trusted DNS-server, which is Mullvad by the way. Today I discovered a strange behaviour when the System Updater tries to resolve releases.grapheneos.org. It resolves to the IP 91.246.30.2 . RethinkDNS says the IP is from Russia, but I don't know how RethinkDNS looks this up.
I'm a little bit nervous now, so I looked up the IP addresses published on https://grapheneos.org/articles/grapheneos-servers#releases.grapheneos.org and I couldn't find it there.

Could this be a possible attack? Would it be possible that I have a malicous software installed? Or does Mullvad publish the wrong IP address?

Thanks in advance.

de0u

noradx According to ARIN, that IP address belongs to the GrapheneOS Foundation: https://mxtoolbox.com/SuperTool.aspx?action=arin%3a91.246.30.2&run=toolpage

de0u

noradx Would it be possible that I have a malicous software installed?

The system updater signature-checks each release, so it doesn't matter which server a valid release comes from (this is why it's safe to sideload releases via adb). So a hypothetical compromise of a GrapheneOS update server will not result in devices running fake versions of GrapheneOS.

wizoatk

noradx IP 91.246.30.2

A traceroute to that address shows that it's currently in/near Toronto Canada.

Novalissoide

noradx this may have some relation to this:

https://github.com/celzero/rethink-app/issues/2499

gristle-cause

I can confirm that my device also resolves 91.246.30.2 as apps.grapheneos.org from app.grapheneos.apps & app.vanadium.browser, as monitored from RethinkDNS

At the very least, this implies to me that you are not a victim of a targeted attack. It is, however, interesting that this IP is not listed on the GOS site as an endpoint

Running this IP through an independent lookup tool, it appears to be Canadian, and officially associated with GOS

I suspect (1) the docs are simply outdated, and this IP is officially associated with the update servers, and (2) some bug in RDNS is erroneously labelling it as a Russian server. I do not have the expertise nor conviction to verify

noradx

Thanks everyone. Don't know why RethinkDNS keeps telling me that this IP is from Russia. Clearly not the case. I'm more confident now to update. Thanks.

GrapheneOS

The page wasn't updated after switching to AS40806 announced IP subnets for the Xenyth server in Toronto. We also temporarily don't have any update servers in Europe so a lot of the world is temporarily using the server in Toronto.

GeoIP data is never reliable but there's something wrong with the implementation in RethinkDNS combined with it being a year out-of-date. The IP subnet we're using for IPv4 for the Toronto server has been loaned to us by a Romanian LIR and would previously geolocate to Romania despite not being deployed there. It now geolocates to Toronto because we provided a geofeed with the actual deployed location and most GeoIP providers have fetched that and updated their databases. We filed an issue with RethinkDNS about the incorrect GeoIP data which has something more wrong with it than being out-of-date as it should say Romania if that was the only issue.