Does verify boot show a different ID if the OS is modified by malware?

GrapheneGem

Additionally if someone managed to install malware on the phone would restarting the device remove it or is the only purpose of verified boot to show that it wasn't modified during installation?

Its possible my OS got breached that is why I ask. What would one do in this scenario?

GrapheneGem

Is there anyway to verify I am not infected with malware? Perhaps by viewing network activity or something?

The keyboard is behaving bizzarely, like when I was attacked by my threat actor in the past.

matchboxbananasynergy

Hi there, https://grapheneos.org/install/web#verified-boot-key-hash is relevant here and should answer your question. Check that it matches with the respective device.

People should also be leveraging hardware-based attestation via our Auditor app: https://grapheneos.org/install/web#hardware-based-attestation

You will also need to provide information about what "the keyboard is behaving bizarrely" means.

GrapheneGem

matchboxbananasynergy

Essentially it becomes really hard to type on almost as if its intentionally missing keys causing text to come out all jumbled up if I don't type slow and precisely.

Furthermore I was typing "Or people who honestly are so used to u talking they filter u out I hate those people" however those corrected to this after I put the letter p which in my mind makes no sense, why would it correct to that? An incorrect word from a grammatically correct one, unless it is my threat actor who caused that to happen.

It could be paranoia but I heavily doubt it, my threat model has hacked a few of my devices in the past to facilitate harassment towards me (ios and android devices) and also has been stalking me in person. When they hacked my device they would make the keyboard very hard to type on and then type as I was typing and say horrible things and give me threats.

The code does match my device btw and I have the phone set to auto reboot every one hour.

GrapheneGem

matchboxbananasynergy

Sorry I am still confused, the malware shouldn't be able to stay persistent given the hash matches correct? It will be wiped upon rebooting?

Blastoidea

I’d be very interested in how a third party can make one’s keyboard “very hard to type on”.

GrapheneGem

Blastoidea

Imagine when you type on a keyboard it hits the surrounding keys rather than the one you intended to hit:
So if you wanted to type "HELLO WORLD"
It would come out as "JRKKP QITKF" as an example if you typed really fast though it doesn't come out exactly like that but similar.

Blastoidea

GrapheneGem
My question was how can a third party do that, not what happens.

What would they have to gain remote access to?

GrapheneGem

Blastoidea

I see, I just thought it would be useful to provide more context. They were able to enable a persistent state of the malware that existed despite factory reset on ios and android so I assume they had access to more or less the whole device.

Blastoidea

I think this discussion is beyond my level of understanding.

de0u

GrapheneGem Sorry I am still confused, the malware shouldn't be able to stay persistent given the hash matches correct?

In a sense it depends. If you downloaded an "unofficial" version of a game, which includes a crypto miner, then no part of GrapheneOS can detect or suppress that.

Non-expert explanation follows.

If you get the yellow boot screen, it shows you a fingerprint of the OS signing key, which you can check vs. the GrapheneOS web site.
Before it shows you the yellow screen it checks that the OS image is signed by the OS signing key that is installed (or else it shows the red screen).
Before showing the yellow screen it also checks signatures on key system files - the apps that came with the system, apps installed by the Apps app, and key config files. This is done via "dm-verity". GrapheneOS does more of this than other Android variants.
If you don't get a red screen, it is genuinely very likely that all of the files that the GrapheneOS developers signed are correct. Files that you personally installed are not checked. The good news is that you can examine those files with a trusted copy of the Settings app, for example.

Overall, nothing is perfect. But a yellow screen tells you that a lot of things are almost certainly OK.

Please note that I do not speak for the GrapheneOS project.

88dotorg

I can't answer your question about being hacked or not, come from many years iPhone now on GrapheneOS I can say this. With my iPhone I type like a rollercoaster and iOS automatic "write what I want" meaning autocorrect, now with GrapheneOS typing combinated with autocorrect is not one, but many steps back. Can't type fast, need to correct many mistyped as well.
I remember a topic about this, so far not have the solution. It's kinda ******* for stress and without patent people like me, but until going in the rollercoaster again, this time the one by GrapheneOS, I accept how it is because of the outstanding + sides/ futures we get. Every day more news about Apple come to us about not being so "clean" like they said they are comparing to Google.

raccoondad

Assuming your devices bootloader is locked and the key hash matches what is shown on the GrapheneOS website then yes, most likely, your operating system is fine and a factory reset will remove any software, including malware, that's not apart of the signed GrapheneOS image. All user data is destroyed during a factory reset as soon as the security chip drops the encryption keys.

Most likely its not an attack, your phones behavior is most likely a software issue related to processing touch or a hardware issue

Factory reset it, install another operating system like the official google OS and try typing, if its still behaving problematically then contact Google for a repair because 99% chance at that point its a hardware issue you should fix.

If it works fine on other operating systems but not on GrapheneOS, write it here so the devs can assist you in a bug report.