Pegasus and Predator spyware

RandomEireTom

Hi folks,

Have been reading up on these and wondering how vulnerable Graphene is to infection and if there wad information on how to detect or mitigate the access they provide?

de0u

RandomEireTom The information situation is inherently asymmetric: the authors of those can experiment with GrapheneOS, but GrapheneOS developers can't experiment with those tools.

Meanwhile, how you use your device matters!

Use a long passphrase
Configure USB and other settings carefully
Disable Wi-Fi calling
Stay off of shady web sites
Don't install shady apps (or lots of apps, period)
Use a security-focused browser instead of a privacy-focused browser (should be fine if you are careful about web sites!)
Et cetera

If you want truly heightened security, there will be fun/convenience costs.

Edit: no adb debugging, esp. no wireless adb debugging LOL.

0xC4aE1e5

de0u A lot of times a website (typically a WordPress website which the admin installed a cracked plugin) gets hacked, which then inserts some redirect, which tries to get you to install some silly APK.

akc3n

RandomEireTom

Pegasus

Pegasus was primarily using iOS exploits and there's no indication of them having exploits targeting GrapheneOS which isn't implied by targeting Android.

Pegasus only targeted high profile individuals
Pegasus only exploited zero click iMessage exploit in iOS devices
GrapheneOS is not immune to malware, but it is very difficult and will likely require a lot of investments into actually exploiting it.

Please read: https://twitter.com/GrapheneOS/status/1416852028605747203

... wondering how vulnerable

Exploit vendors often target unpatched vulnerabilities, including n-days and 0-days. GrapheneOS has extra exploit mitigations to prevent these vulnerabilities from being exploited (as easily).

Pixel devices, even with their Stock OS, possess some of the most best defenses against the targeted use of exploit chains. GrapheneOS further builds upon these defenses by incorporating features like hardened_malloc and our industry first support for ARMv9 MTE (memory tagging) in 8th generation Pixel devices.

Titan_M2

akc3n Pegasus was primarily using iOS exploits

They actually target Android too, but it has fewer forensic artifacts compared to iOS.

akc3n Pegasus only exploited zero click iMessage exploit in iOS devices

Pegasus also exploited Apple Music, Photos app, VoWiFi, Home app, Find My app, WhatsApp (on Android too), all for zero-click.

https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/

Phead

Titan_M2

Thank you for the linked article. Very informative.

MoonshineMidnight

I would expect the only way someone *should get targeted with Pegasus is if a foreign nation state is after them. In the U.S., cops/FBI will just get a search warrant to track a person real-time over E911 GPS combined with cell tower triangulation. Once they have enough evidence to arrest you or probable cause to take your phone, they go after your phone with at-rest forensics. I'm sure the NSA has their own version of Pegasus (how else did they hack Angela Merkle's cell phone?), but there is no evidence it has ever been used on a U.S. citizen. They don't want that coming out in court with discovery, unless they use parallel construction and get you with a Pegasus-like attack and then make up another way they busted you to cover for the Pegasus-style attack. I could see the FBI saying they got someone with E911 tracking that gave them probable cause to seize the phone and got the evidence through Cellebrite when they really hacked your phone with a Pegasus-type attack. Even then they will be cautious doing that, because if you are wealthy enough your own forensics team in defense could uncover their secret remote attack and how it works by going over your phone. The guv does not want anybody to have an idea how to defend against their remote attacks so they will be used cautiously, and ideally only on foreign targets as the U.S. guv has banned the use of Pegasus in the U.S. - not that that exempts coppers....

gos_user11

de0u no adb debugging, esp. no wireless adb debugging LOL.

Thank you for the suggestions. I am using ADB with Tasker(automation app) to run certain commands such as clearing apps' data.
This is off topic but can you please share your knowledge or some reference links for study about why wireless debugging would be bad?
Assuming my case where only one app(Tasker) has ADB access on a particular port? (usb debugging ON, wireless debugging OFF after allowing ADB access to Tasker through it)

Thank you in advance.

[deleted]

gos_user11 can you please share your knowledge or some reference links for study about why wireless debugging would be bad?

Both Wireless and USB debugging provide access to the same thing, that is ADB.

E24

From what I understand, yes Pegasus can break IOS and normal android, but because GOS code is different and better for secuirty, NSO would likely have to change Pegasus in order for it to work, and the amount of time and resources that would take them just isn't worth it

gos_user11

[deleted]
Okay. I have disallowed new USB peripherals. Given Tasker ADB access upon reboot using Termux. Turned wireless debugging OFF after that. and left only USB debugging option ON so that Tasker can run ADB commands.
My main use cases for ADB are:

Custom lock screens made using Tasker that trigger clearing of apps' data upon incorrect input etc. Since I do not want apps to have data even if the device reboots. I want my data erased if something happens to me.
Killing background apps using Tasker. To save battery and kill non-important apps automatically in general.

In my mind deleting the data is better than having it locked behind an impenetrable security screen(data at rest upon reboot etc.). But I am afraid ADB access might be leaving my device more vulnerable.

Kottonballs

Wifi calling was suggested earlier as an attack vector. Is this mostly for wifi systems where I don't control the network or is all wifi calling vulnerable?

[deleted]

gos_user11 I am afraid ADB access might be leaving my device more vulnerable.

You're trusting Tasker not to abuse Shell (ADB) privileges, or have an bug/vulnurebility hat allows some other app to execute tasks as Shell (ADB) user (via Tasker ofc); If you're fine with this, you can keep Tasker having Shell (ADB) privileges. Also, Do not underestimate how powerful Shell (ADB) is, Its not as powerful as much as Root, but its still quite powerful.

akc3n

Titan_M2 thanks for the link.

de0u

Kottonballs Wifi calling was suggested earlier as an attack vector. Is this mostly for wifi systems where I don't control the network or is all wifi calling vulnerable?

Earlier this year there were exciting Wi-Fi calling vulnerabilities. And I believe by design it bypasses VPNs. There are a lot moving parts, plenty of opportunity for increased attack surface.

The OP was asking about resistance to being individually targeted by powerful spyware. People facing that sort of situation need to reduce attack surface. Lots and lots of fun/convenient features increase attack surface. Those things may be fine for people who aren't specific targets, who just want to step back a bit from being tracked 24x7 by Facebook.

Kottonballs

de0u This is great info, thank you very much!!!!! I'm always looking to improve across my device usage. Will try keeping Wifi calling off and see how it goes.

gos_user11

[deleted]
Thank you.
I think Tasker isn't the only app that can access ADB while it is enabled as I have enabled it on 127.0.0.1 for a specific port which Tasker happens to use for ADB as well. Nothing in my ADB access procedure specifies that only Tasker has access to it.
Hence, I will try to remove ADB usage if possible. This is getting off topic for this thread so I will create another thread or use some relevant one if/when I have more questions @[deleted]
Thanks!

Titan_M2

de0u Earlier this year there were exciting Wi-Fi calling vulnerabilities. And I believe by design it bypasses VPNs. There are a lot moving parts, plenty of opportunity for increased attack surface.

Well I wouldn't call a vulnerability exciting lol. Note that Wi-Fi calling is basically VoLTE routed through the connected Wi-Fi network so VoLTE is equally vulnerable too.

Arnauld

de0u Disable Wi-Fi calling

How to disable it?

Thank you.