Attestation error, or stupidity, please help

Carbonprotoss

Hi, ill try to be brief. I switched over to grapheneOS about a year ago after i believe my phone got compromised, my device was sending out calls and there were drafts of texts that i had not written. My gmail accounts kept getting recovery numbers that i did not recognise even after i would delete them and change the password and authentication option etc. Because im poor and used my phone as a hotspot for internet for my main computer, there was a fear that theyd gotten into that as well.

Long story short this stressed me the hell out and a friend helped me move a laptop to linux and flash graphene onto my phone, which helped to stop all this from occurring. However when we went to authenticate it on their phone to make sure graphene had installed correctly, they scanned the QR code, their screen went black and they had to restart their phone. After it restarted, audited it via the authenticator app and the report said it was genuine graphene so no worries. Friend said it was a bug, and theyre far more tech savvy than i am and the whole ordeal was stressful on them dealing with me so i just left it at that. However my linux device is showing signs of being infected now (login screen will require me to login twice if i dont hit enter, cannot timeshift it back to copy of the OS i made when i flashed linux there) and after a general look around the website (im sorry if there has been something that ive missed) i cant find any mention of someone authenticating their phone, scanning the qr code the screen going black and having to restart it, then it going forward. So the fear is that both devices (laptop and phone) are compromised on some level, and that me and my friend are running faulty versions of graphene because i infected their phone like a dumbass.

I dont believe im being paranoid, given the proof, so what do i do? Find another ( hopefully clean) computer and just reinstall grapheneOS?

NoahRaketic

Carbonprotoss Boot your phone and press the power button when you see the yellow triangle. Verify this hash against what you see on the website (from a trustworthy device) for your phone model. If they match, the installation is genuine, and there's no need to reinstall.

While you're at it, it is advisable to set up remote attestation if you can't use attestation with another Android device frequently. After that, you'll want to monitor this from a separate device.

Carbonprotoss login screen will require me to login twice if i dont hit enter, cannot timeshift it back to copy of the OS i made when i flashed linux there

These aren't signs of malware; it's most likely that what you're seeing is a bug. You can reinstall your desktop OS if that would make you more comfortable, though. It may also fix stability issues if you have made modifications to your system.

Johnnyloans

Carbonprotoss

Make sure to have backups of any important data. You can research the "3-2-1 data backup rule" and decide what you want to do. You shouldn't follow it 100% to perfection unless you have money burning a hole in your pocket.

My gmail accounts kept getting recovery numbers that i did not recognise ...

Reset your passwords, check recovery emails and phone numbers, or any keys/authenticator-apps are yours.

my device was sending out calls and there were drafts of texts that i had not written.

Check Settings > security & privacy > privacy controls > permission manager and double check what apps have access to phone, location, SMS, contacts, etc
Do other weird things happen in your life? Early adulthood is a common time for mental health issues to manifest.

Friend said it was a bug

Yes or hardware/software issue if the phone reboots, shuts-down by itself. (There is the auto reboot feature in the OS)

my linux device is showing signs of being infected now (login screen will require me to login twice if i dont hit enter, cannot timeshift it back to copy of the OS i made when i flashed linux there)

No one would amass resources to make an advanced virus to simply get carbonprotoss to type in their password twice. Where's the money in this? Why would the virus make itself known so obviously? it's better to hide.

Anyway, repair packages or reinstall the OS. See backup comment above. Try to be less paranoid. Save for the government wants to silence you, you aren't being targeted.

dhhdjbd ... hacking does not [work like that.] We do not live in a movie..

This is correct.

thmf

NoahRaketic Verify this hash against what you see on the website (from a trustworthy device) for your phone model.

Here's the link.

Carbonprotoss

@"NoahRaketic"

Thanks for the reply, i followed the instructions and the hash key matched, but im still unsure given the fact that i flashed it roughly a year ago and that my friends phone, when it audited mine, had the screen turn black and had to restart to give a positive report.
We still audit each others phones and it gives a positive report without that occuring, but its in the back of my mind and i cant shake the feeling that its not the genuine OS. Given that im not really tech savvy, it would have been a year running a compromised device which is ample time to get into it, even if i updated it regular and tried not to use apps that are security risks.

Im going to try something else, give me a week roughly and ill get back to this thread, hopefully I'm just paranoid. Thanks for the help guys.

dhhdjbd

Carbonprotoss that my friends phone, when it audited mine, had the screen turn black and had to restart to give a positive report.

yeah you do not need to worry about this. Audit does not work that way, and hacking does not either.
We do not live in a movie..

Also you can do remote attestation (in the audit app)

Carbonprotoss

@"Johnnyloans"

"Do other weird things happen in your life? Early adulthood is a common time for mental health issues to manifest."

Dude dont be a dick. I might be paranoid but not im schizophrenic.

As for what happens on my linux laptop, what happened was it would show the log in screen, id type in my password, hit enter, and then it would go back to the log in screen as if i didnt hit enter it in the first place. I know its absurd to think that anyones doing this to me, but given everything with google accounts and all i went through, it seemed like a way to get sudo access because i wasnt dumb enough to type it into a normal authentication request that wasnt a popup.

The old phone that i had prior to this graphene one is turned off and buried and im not digging it up to check through settings on it, this was all a year ago, and in my mind its still probably infected.

I got someone trustworthy to flash linux on the laptop again on a separate usb so hopefully its fine now. I wasnt able to find someone else with grapheneos on their phone to authenticate with. QR codes can be fanged so that was my paranoia there .im still paranoid about that to tell the truth, most likely will be reinstalling graphene and the pain in the ass that entails.

im going to leave this up for a day and then close the thread because im tired and cant be fucked doing it now. Thanks to everyone that replied without taking potshots at my mental health.

Johnnyloans

Carbonprotoss Dude dont be a dick. I might be paranoid but not im schizophrenic.

Apologies, that was insensitive how I phrased it.