Before I begin, I would like to extend my sincere gratitude to the developers of GrapheneOS. Thank you for creating an environment where users can use their mobile devices with peace of mind.
I am writing to seek advice regarding a severe privacy issue I have been facing for several years. I have been subjected to persistent screen monitoring by what appears to be a highly sophisticated hacking group (possibly an APT). It seems they have managed to install spyware on my PC, legacy smartphones (Samsung Galaxy), and tablets to monitor my screen activity in real-time.
While I understand that extraordinary claims require extraordinary proof, I am unable to provide logs at this moment. However, I ask that you please hear out my situation.
The attackers monitor everything: my purchase history, YouTube viewing habits, and web browsing. For instance, even when I am outdoors using only a cellular connection and typing into a note-taking app, they frequently post text or photos related to that specific topic on their social media within five minutes of my activity.
To mitigate this, I have taken the following extreme measures:
PC: Flashed the BIOS firmware via USB, performed a secure erase on the SSD, and reinstalled Windows.
Mobile: Performed factory resets and only installed apps from the official Play Store.
Despite these efforts, the monitoring continued. Although I lack deep expertise in computer engineering, I suspect compromises at a level lower than the OS, such as firmware or baseband hacking. Unfortunately, when I requested a forensic analysis from the police, I was informed that an investigation could not be initiated without proof of direct financial damage.
To escape these issues, I switched to a Pixel device running GrapheneOS. My security hygiene since the switch has been as follows:
Network: I have never connected to Wi-Fi; I rely solely on the mobile network (4G LTE).
App Source: I created a brand-new Google account and only downloaded applications from the Play Store.
Settings: Apart from banking apps, I did not disable any exploit mitigations (such as hardened_malloc or MTE).
Hygiene: I have never received or clicked on SMS links. I set the USB port to "charging only" to prevent physical extraction.
However, the group still appears to be monitoring my screen and is aware of my search history.
I realize this post might seem unusual or discouraging, but I assure you that is not my intention. I believe it is valuable to discuss how a threat actor might still breach a device despite a user maintaining maximum security measures.
My technical question is this:
I understand that cellular modems can theoretically be compromised via fake base stations or manipulated packets. However, since the main OS and the baseband modem are isolated, and considering the IOMMU protection on the Pixel (Exynos 5300 modem), I assumed that even if the modem were compromised, it would not grant the attacker the ability to view the screen or access memory directly.
If my screen is indeed being watched despite these protections, where could the potential breach be occurring? I would appreciate any technical insights.