Potential appearances of GrapheneOS in mobile forensic reports

[deleted]

In the phone there are 11 contacts that may be of value to the investigation, they go to Benzema Balance, Benzema 9, bumbel, Rarry, Roma, Z, Graphene0s Support, Real Graphene0s Support.

This creates an impression that the whole thing was preinstalled by some some boutique "super encrypted phone" vendor or individual that sells Pixels with GrapheneOS preinstalled and provides "support".

[deleted]

Cantseeleft Obligatory https://xkcd.com/538/

GrapheneOS

quepasabebe This is a good reason to use multiple users. Data in secondary users that are at rest will be safe if access to the main user was obtained if they aren't currently logged in. If they are logged in, then exploiting the device would obtain access to the data. You can disable users running in the background if you want to avoid forgetting to use end session. Using a secondary user as your main user is mentioned in https://grapheneos.org/faq#encryption as a useful approach for high threat model use cases.

GrapheneOS

Relaks GrapheneOS has support solely through our discussion forum and chat rooms. It's explicitly stated on the site that contact@grapheneos.org shouldn't be used for support and we have no public company phone number yet, which won't be usable for support when we do. It's very questionable if this is actually GrapheneOS. It would be good to know which vendor is selling phones potentially misleading people about what they're getting and directing them to our email account or somewhere else for support.

quepasabebe

GrapheneOS

The guy which called himself "grapheneos support" has also been arrested for drugs and money laundry. He used to sell sky phones and encro, apparently.

"The reasons for the district court's decision
The criminal suspicion
*akob *unc is, on probable grounds, suspected of particularly serious drug crime and serious
money laundering offense during the period May 2021 to June 8, 2023 in Stockholm.
The special grounds for detention
There is a risk that *akob *unc deviates or evades prosecution in some other way
or punishment
There is a risk that *akob *unc by eliminating evidence or in some other way
complicates the investigation of the matter. This risk is such that the prosecutor's request for a continuance
restrictions must be accepted."

final

quepasabebe says that an undercover police grabbed the phone from the suspect while it was unlocked.

With a lot of high-security systems with forensic tool resistance or even anti-forensic features, investigators will adapt and make different procedures if they expect you are using something of the sort. While you should expect companies who sell exploits for mobiles like digital forensics companies likely have Pixels or GrapheneOS on their sights, in most cases you shouldn't expect them to take the same process as an ordinary smartphone with stock Android. While there is no evidence there is an exploit of a supported new Pixel with GrapheneOS, you should expect the procedure to be different even if there was one - since the users of the OS would be inclined to behave very differently compared to ordinary people or unqualified criminals with lackluster knowledge in computer security or digital forensics.

Police are likely to expect GrapheneOS to be trouble, so them going to attempt to seize the phone just to acquire evidence it through a toolkit like Cellebrite is likely out of the question. They'd likely conduct surveillance on the suspect to acquire the phone while it is unlocked or to discover the PIN/password as mentioned in this example. Doing this allows them to turn off unlock methods and enable USB debugging to perform basic extractions and display capture. For cases where they think plugging the device in would trigger a kill switch, they have dedicated cameras to take pictures of the screen without connecting it to anything. Devices would also be placed in faraday cages or in any other signals blocking setup to prevent remote erasure.

If any device is completely unlocked and with the security measures turned off then any extraction tool would work. You shouldn't expect this 'TekPro' to be special to other tools, mobile forensics toolkits are often chosen out of investigator preference unless another is needed for a certain device or app. You'll find investigators use a variety like Cellebrite Physical Analyser, Oxygen Forensics, Magnet AXIOM etc. to perform their evidence processing. Cellebrite is a gold standard since they do both evidence acquisition (UFED) and processing (Physical Analyser, Investigator, etc.)

When relying on digital forensics questions on this forum you need to constantly remind yourself many information is speculative as companies try their best to black box their systems and not disclose unique capabilities that their enhanced plans for law enforcement and government may have. I also personally have my doubts they'd even mention if they had any unique capabilities with GrapheneOS devices in public, considering how many of their users sleuth around the Internet and are interested in anti-forensics. Having any sort of knowledge like that in public would be a tip-off and probably cause users to suggest more anti-forensics.

Also @quepasabebe The file you sent has an invalid URL, would you be kind to upload it again? I would love to read this report. It would be the first report I've seen with GrapheneOS in the wild that has been public.

quepasabebe

final

I know that swedish police now can use trojans and install them on peoples devices, these months a lot of iphone users have been caught during weird circumstances and which all suspects have had iphones...

https://easyupload.io/xnmz82 There you go mate.
She has been chatting to someone who calls himself "GrapheneOs Support" on signal. Just found out that he has been caught also and is waiting for a trial. Ill be back with his files later when they get rdy. Its also drugs and money laundering.

spiral

final

"When relying on digital forensics questions on this forum..."

What? Can you please clarify for me what you meant here?

ev6x

quepasabebe Would you mind linking this one too?

ev6x

spiral It is in the interest of the developers and users of digital forensic tools to never confirm what it can or can't do. So any information you read about them should almost always be presumed to be speculation.

final

@quepasabebe Thanks. Reading the report I am inclined to believe they used Cellebrite. Page 26 is a screenshot from Cellebrite Physical Analyser reports, and 275 is a screenshot from the Cellebrite Physical Analyser app.

Things like this is why you never trust retailers who sell GrapheneOS devices or people trying to sell you support. Most of them are just people trying to make bucks from criminals or take advantage of them, or worse, they are in illicit trade as well. When you see people going out to sell something like this and they aren't a transparent company with directors, you should just assume they are sketchy. The market for secure smartphones are a swamp of snake oil, criminal run businesses.

spiral Basically what ev6x said. I imagine a lot of people choose to read questions on the forums to get answers on questions they want, including about mobile forensics against GrapheneOS. The answers people will get on questions are limited, or at best speculative based on informed judgement from leaked materials or news articles other people have read which often miss out the details. People shouldn't rely entirely on answers people give as companies in the mobile forensics market will never write everything down in public. They could be able to do a lot less or a lot more on pixels, its hard to tell.

Many device extractions are possible by failure from the subject whose phone was seized, not a failure in the device's security. Extraction via exploitation definitely happens but on a much smaller scale than people like to put out.

PoppyGrunfeld

I'd like to start selling phones with GrapheneOS pre-installed. I understand there is a dim view of that around here:

https://discuss.grapheneos.org/d/7658-seized-graph-phone-swe-police/18

final Things like this is why you never trust retailers who sell GrapheneOS devices or people trying to sell you support. Most of them are just people trying to make bucks from criminals or take advantage of them, or worse, they are in illicit trade as well. When you see people going out to sell something like this and they aren't a transparent company with directors, you should just assume they are sketchy. The market for secure smartphones are a swamp of snake oil, criminal run businesses.

https://discuss.grapheneos.org/d/6268-using-grapheneos-as-a-base-for-a-consumer-product/38

I have been using GrapheneOS for about four years already, when I stopped maintaining my own AOSP builds for Sony devices (which prior to Google's change of heart with recent Pixels, had the longest driver support period, and decent open source community support). I have technical abilities but am not yet a contributor to the OS project.

I recognize also this is a terrible business as far as making money. The only thing people replace less than phones seems to be cars and appliances.

https://discuss.grapheneos.org/d/8160-thoughts-on-selling-of-pixels-with-preinstalled-grapheneos/9

Max-Zorin After all the work I did to set this up, it would of been better for me to to get a second job delivering pizzas in the evening. With the profit I made and the hours I put in, it was maybe $1.25 / hr.

I want to sell phones with GrapheneOS, because I would like to buy them, and I know others as well who would.

I will be installing the stock OS and not making my own build, so unless I am mistaken the boot screen hash will match the official posted hashcodes, and will OTA update.

I will be contributing back 20% of profits to GrapheneOS, and some other percent for escape-surveillance-capitalism supporting projects, ie DAVx5, F-Droid, Signal, Syncthing, etc.

Is this sufficient to build confidence that this would be safe to buy? Is this still not good enough? What would leave you confident in a new device with GrapheneOS preinstalled?

I am fine if the answers here are respectful, but not kind. I am very interested in feedback in any form.

JayJay

On page 237 we can see many apps saying
"not installed for user". Among them signal, telegram and other apps.

There could be an additional profile which they have not investigated.

Both phones where taken from her hands and both was in unlocked state when they was taken.
The iPhone was forensically investigated.
But the pixel 6 they only managed to take video recordings of opened apps.

I suspect since the girl had low knowledge on how to switch profiles she used the apps in her account. Regardless of that if phone was snatched in open state then they would be able to check that open profile also.

The app data sizes reveals that those apps though were all unused.

Om page 355 the report says that the phone has not been mirrored ( connected through usb) . Which could also mean they attempted but failed.

Overall the police acted in a hurry and had to do the best of the situation to collect any evidence. Specially since messages had timers for auto deletion.

shadowman1

@quepasabebe
Any chance you can upload the report again ? it was deleted from the second link, I really want to read it.

Thanks.

Blastoidea

shadowman1
This.

I got “File not Found”.

Croak3114

shadowman1

Here is another one: https://fup.link/data/files/tr/attunda/b-7380-22/Attunda_TR_B_7380-22_Aktbil_84.pdf

There isnt much to read about, phone was seized in BFU state turned off in suspects bag. Search the document for "pixel" and you can find all mentions.

Seems like they werent able to extract anything at all because there are no extraction reports, all there is "PM" or "prememoria" and the closest i can compare it to is an affidavit saying that the device is heavily encrypted.

shadowman1

Croak3114
Thanks.

Where do you find all those files? can you send link(s) to the resources? seems interesting.

dc32f0cfe84def651e0e

Croak3114 Page 72:

The Google Pixel phone is very heavily encrypted and there is no legal use for such a phone.
Based on this, the Google Pixel phone should be considered a criminal tool.

Croak3114

dc32f0cfe84def651e0e Yea that's the statement from the officer, complete BS if you ask me. But since there is no extraction report and no data that has been added to the investigation it is pretty safe to say that they didnt manage to extract anything.

shadowman1 You can request any publicly available data, tax reports, income statements, court cases and outcomes through the "offentlighetsprincipen" you need to know the case number and which instance its being handled at and you can request it free of charge. They are not all published as per default sadly.

Clark

dc32f0cfe84def651e0e

Does this mean GOS is illegal in SE??

The Google Pixel phone is very heavily encrypted and there is no legal use for such a phone. Based on this, the Google Pixel phone should be considered a criminal tool.

[deleted]

Croak3114
How to get case numbers of such interesting cases?

matchboxbananasynergy

We are letting this thread stay up so that folks in the forum can discuss these topics on a technical level with factual accuracy.

Political commentary beyond that is unnecessary. Stick to the technical. Thank you.

(This is in reference to a now deleted comment).