Is there a security issue happening with my 6a?

gosenjoying

Thanks to everyone who clicked on the discussion, any suggestions or replies are welcome.
My phone is 6a and all OS updates are up to date.

(1) In the morning of November 19th, I was browsing Reddit with TorBrowser, I felt tired and closed my eyes while holding the phone to rest. Suddenly, I felt my phone getting a little bit hot, and I opened my eyes to find that the antivirus in the background had been shut down, the VPN had been disconnected, and the connection to the website with TorBrowser had failed. Since all these apps rely on Play Service to function, I wasn't surprised, but I only have Play Store and GmsCompat and GmsCompatConfig set to update automatically, GPS from Play Store, and the latter two from Apps, and GSF and GMS I update manually from Apps. I immediately went to check the app info for the 5 apps and GPS was updated Nov. 12, GMS was updated Nov. 13, GSF was updated Oct. 11, and GmsCompat and GmsCompatConfig were already installed in 2009. I'm starting to panic because it's not Google related service updates that are causing the apps to go wrong, and what's causing me to have to reboot to get the antivirus and VPN and TorBrowser to work?

(2) After rebooting I scanned the whole phone using Bitdefender and Sophos and found no problems.

(3) After I updated GMS manually on October 9, I found that an empty "Nearby Share" folder was created in the Download folder. I refer to @Goseur7 and @W1zardK1ng and @[deleted] 's discussion, and I know that it was created automatically after GMS update. I didn't delete that empty folder. But the Nearby Share folder disappeared automatically after November 19th. I confirmed that GMS was not updated, so why did the folder disappear automatically? For those of you who have installed GMS, is there still a Nearby Share folder inside the download folder?

matchboxbananasynergy

Hi there!

As discussed in the chats as well, this really doesn't sound like a case of anything being "compromised", or there being a security issue. On a surface level, do keep in mind that if you'd been compromised, that kind of sophisticated attack really isn't the kind of leave behind blatant evidence of itself, but I digress.

What is most likely to have occurred here is that your VPN disconnected (due to a crash or some other reason - unclear) and because block connections without VPN is enabled by default in GrapheneOS, Tor Browser stopped being able to access the Internet, and therefore couldn't load the page. It's hard to tell what happened with the "antivirus" app, since I don't know what app you use, but if it also relies on the Internet in some way, that may also explain that.

As I touched upon in the chat rooms as well, I hope you reconsider whatever "antivirus" app you're using. They're worse than useless on AOSP and often require outrageous permissions like the accessibility permission to "work".

gosenjoying

matchboxbananasynergy
Thank you for your help, I have uninstalled my antivirus app. I've been speculating for two days over this strange situation, and if it's just a chain reaction caused by a VPN crash, this answer will give me some peace of mind.
Also, after the GMS update on October 9, an empty Nearby Share folder appeared in my Download folder (I never used the Nearby Share feature), and I never deleted it, but on November 19, I noticed that the empty folder had disappeared. If you have GMS installed, can you think of a reason why that empty folder disappeared for me? Do you still have the Nearby Share folder inside your Download folder that automatically appears due to the GMS update?
https://discuss.grapheneos.org/d/7667-nearby-share

gosenjoying

icarious
Thank you for your reply and sharing your experience, I immediately uninstalled the antivirus apps shortly after matchboxbananasynergy reply and will not install it on my device again.
But, after uninstalling my Bitdefender (based in Romania) and Sophos (based in the UK) I found that the former uses an average of 100KB of network data per day the latter uses an average of 1MB of network data per day. One of them scans online and the other has to update its virus database daily. Either way, they are not using much data traffic, can they upload my files because they have file access? Nowadays a photo is at least 1.5MB and a video is 50MB or more, is it possible?

icarious

One thing I would touch upon is that, the way most modern Mobile Operating Systems like iOS or Android (Specially what matchboxbananasynergy has said about AOSP), you don't need third party Anti-Virus software anymore. The way those Mobile Operating Systems have been designed to ensure integrity and just run on a read-only state once installed, with verified boot and the bootloader being locked, you would not need an Anti-Virus software. Minor exceptions like user file system level compromise may exist if you install vulnerable apps or download malware, but they can be salvaged by either deleting the specific compromised user profile, or just performing a simple factory reset. Those specific malwares would cease to persist and they are always limited by scope. As long as you use either using apps by sticking to trusted sources like github sources or playstore, don't download suspicious files and use Vanadium as your default browser with its immense security advantage, you do not need an antivirus.

icarious

Even for Desktop Operating Systems like the Immutable Linuxes like Fedora Silverblue / OpenSUSE Microos where most (if not all) of the rootfs runs on read-only, I have secureboot on, and I just stick to using Flatpaks for apps with heavily restricted permissions, using distrobox / toolbox containers for the cli stuff and rarely touch upon os-tree to make random overlays, I wouldn't install an Antivirus like Clamav and keep on using non-privileged user accounts without root or sudo access and and separate my workflow and just having Flatpak Repos for those accounts set to --user. That's the closest think to security in Desktop I have seen to AOSP/ Grapheneos and ChromeOS. No need for antiviruses.

[deleted]

gosenjoying Either way, they are not using much data traffic, can they upload my files because they have file access?

Yes, and it depends on how you have configured their file access.

Dumdum

gosenjoying Either way, they are not using much data traffic, can they upload my files because they have file access? Nowadays a photo is at least 1.5MB and a video is 50MB or more, is it possible?

I mean, if an antivirus app is running all the time, there's nothing stopping them from just slowly trickling small pieces of your data at a time to slip under the radar of suspicion. It's not like there's some kind of time limit rushing them or anything.

gosenjoying

[deleted]
I only give them full access to the files, nothing else at all. But they are both in Europe, Bitdefender is in Romania and Sophos is in the UK, also both industry leaders, would they be so unruly?

gosenjoying

Dumdum
It's really scary, I didn't think antivirus could be this unruly, even though I know they can legitimately access files and use network data.
But they are both in Europe, Bitdefender is in Romania and Sophos is in the UK, also both industry leaders, would they be so unruly?

[deleted]

gosenjoying would they be so unruly?

You said that "can they upload my files because they have file access?", Its pretty obvious that if you grant files access to an app, It can upload your files somewhere; Whether It will or not, depends on the app.

Dumdum

gosenjoying
Unfortunately, antivirus programs suffer from the issue of proprietary software in general, which is that you can't truly be certain what exactly is happening in these apps (at least not without proper software/network analysis, I'm not really knowledgeable on more technical stuff so I could be wrong).

Either way, antivirus programs generally work by having deeper access than normal programs (this could be different between desktop and mobile) as described here, meaning that even hackers (and not just the antivirus themselves) could get access to your data by deliberately targeting and taking advantage of the antivirus program.

Xtreix

Dumdum

Unfortunately, antivirus programs suffer from the issue of proprietary software in general, which is that you can't truly be certain what exactly is happening in these apps

That's not really the problem, proprietary software can be analyzed and verified, for example with retro engineering, it's just that the Antivirus application blocks threats according to a list of known and signed threats, it's enough for a threat not to be present in the database for it to infect you, enumerating badness isn't viable, on Android it doesn't have the necessary privileges to do anything useful anyway, and an elevation of privileges for this application, for example root access, means a considerable reduction in Android's security model.