Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

arstechnica.com

Post reply on HN
Print view View original

121–130 of 372 posts

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#121

Post by brendyn »

overfeed wrote: post #89
markus_zhang wrote: post #38

Earlier quoted context omitted.

I read from an old HN post that three letter agencies hate graphen OS. The author heard it from defcon or some similar conference. I couldn’t find the post anyway :/ I think it is buried under one of the posts that discuss Defcon and Blackhat.

Wouldn't it be a total mindfuck if it turns out that Graphene is less secure[1] than stock Pixel, and this is all part of an ANOM-style honeypot operation that has Feds hyping it up, to trick interesting targets into adopting a less-effective security posture. 1. Such as via slower 0-day responses, for instance. This is a thought experiment, I'm nor alleging that this is what it is.

Now in grapheneosin the updates settings it allows you to apply Google's upstream security patches, but grapheneos is forbidden from releasing the source code for these until a certain time later. You can read more about it on their blog. I have them enabled. At least I can rest easy knowing the Grapheneos Devs are able to inspect the code on users behalf even if they can't yet release it.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#122

Post by Scrubbed4426 »

andrepd wrote: post #71
vbezhenar wrote: post #65

Earlier quoted context omitted.

You can configure USB port for charging only in the developer options.

On Lineage this is the default behaviour: charging only until I tap on a notification to change it.

It is not the same feature as present on GrapheneOS. That is done through the OS while GrapheneOS makes kernel changes to physically shut it down.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#123

Post by duskdozer »

j1elo wrote: post #48

> Notably, the Pixel 10 series is moving away from physical SIM cards. Is it? I hadn't followed news of the new Pixels. I don't like the idea of modernizing this and going full eSIM. It will introduce a lot of new friction, somehow I don't doubt it. Just now arrived to Mexico for a quick trip and grabbed a prepaid SIM from a 7-11 in the airport. All quick and simple. I doubt things would be so seamless when not havin…

The process for migrating eSIMs for me has never been easy and has always taken 1-2 days and repeated contacts with customer service agents to actually work. Compared to the 10 seconds of swapping a physical SIM. I'm sure there isn't an inherent technical reason why eSIM couldn't be just as easy if not more, but I assume it's another case of enshittification.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#124

Post by tranq_cassowary »

vbezhenar wrote: post #65
fph wrote: post #60

Earlier quoted context omitted.

Two fixes that would be trivial to backport to mainline Android.

You can configure USB port for charging only in the developer options.

That only turns it of on the OS level. GrapheneOS also turns it off on the level of the USB controller.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#125

Post by gonzalohm »

LoganDark wrote: post #108
zb3 wrote: post #80

Earlier quoted context omitted.

Which particular thing you consider inconvenient or even annoying? You can even install Google Play there. I see just one minor tradeoff - no face unlock.

Google OS-level integration is absent, and while Google Play Services can be installed, you're still missing things like Chromecast. Also, there's more manual configuration (although I don't remember exactly what, I've never used GrapheneOS). A lot of stuff you do get for free, but not all of it, and stuff that's been removed as a "feature" isn't always stuff that nobody wants.

Is it really missing Chromecast? I read that it works if you have Play services (but haven't tried)

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#126

Post by tranq_cassowary »

LoganDark wrote: post #108
zb3 wrote: post #80

Earlier quoted context omitted.

Which particular thing you consider inconvenient or even annoying? You can even install Google Play there. I see just one minor tradeoff - no face unlock.

Google OS-level integration is absent, and while Google Play Services can be installed, you're still missing things like Chromecast. Also, there's more manual configuration (although I don't remember exactly what, I've never used GrapheneOS). A lot of stuff you do get for free, but not all of it, and stuff that's been removed as a "feature" isn't always stuff that nobody wants.

That's because the OS integration is priviliged and that's problematic. On GrapheneOS Play runs sandboxed, like any other user-installed app.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#127

Post by ranger_danger »

GeekyBear wrote: post #17
bigyabai wrote: post #4

Earlier quoted context omitted.

Short answer: Google is a business that can be compelled by the federal government in ways that nonprofits are resistant to. Ron Wyden identified one of these weaknesses in 2023: https://arstechnica.com/tech-policy/2023/12/apple-admits-to-...

No American company has a choice when the Feds want data stored on a company's server. That doesn't stop Apple or any other company from designing devices that attempt to keep prying eyes out of the data stored on your device.

They can choose to go out of business instead. See e.g. Lavabit.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#128

Post by ziml77 »

tavavex wrote: post #97
prima-facie wrote: post #81

Earlier quoted context omitted.

You absolutely can. But it does need an internet connection for that. Which actually makes eSIM more secure than regular SIM.

It can be more secure, but it also feels like the kind of "improvement" that's ripe for exploitation. When you put in a step where you have to ask your service provider for permission to swap the SIM, buckle up for the inevitable development of them asking for a $5, $50 or $100 "service fee" so they consider allowing it.

Couldn't they do that with physical SIM cards? On their end, record the IMEI of the first device they see connecting with a specific SIM card and then disallow connections if that SIM is used with a different IMEI.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#129

Post by tranq_cassowary »

derbOac wrote: post #3

They couldn't answer the question most on my mind: "We’ve reached out to Google to inquire about why a custom ROM created by volunteers is more resistant to industrial phone hacking than the official Pixel OS. We’ll update this article if Google has anything to say."

GrapheneOS isn't made by volunteers. They have a team of around 10 paid developers. They are a nonprofit foundation that receives donations and uses those to pay developers, infrastructure etc.

Ars Technica has update its article to rectify that mistake. It doesn't mention that anymore.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#130

Post by tranq_cassowary »

IncreasePosts wrote: post #34
derbOac wrote: post #3

They couldn't answer the question most on my mind: "We’ve reached out to Google to inquire about why a custom ROM created by volunteers is more resistant to industrial phone hacking than the official Pixel OS. We’ll update this article if Google has anything to say."

Is grapheheOS actually harder to hack or does cellebrite just not put a lot of effort into supporting it because the very low odds of LEs running into one in the wild?

All of the listed features significantly raise the bar for exploitation ;

https://grapheneos.org/features

Post reply on HN