Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

GrapheneOS fixes Android VPN leak Google refused to patch

cyberinsider.com

Post reply on HN
Print view View original

31–40 of 142 posts

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#31

Post by DANmode »

snapplebobapple wrote: post #10
k4rli wrote: post #5

Earlier quoted context omitted.

Interestingly GrapheneOS being so good brings more money to Google as only Pixel phones are supported.

First motorola grapheneos phone i am buying to get fully off the google pain train. Grapheneos tides me over until a real linux smart phone shows up or i die of old age. Now if home assistant could get thread network join*ng working without an android phone with a google account i could ve fully ris of those eh holes.

> real linux smart phone shows up

What’s most glaringly missing, for you specifically, from the plethora of options available?

It seems like plenty of options are getting 7/10 things right.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#32

Post by DANmode »

y-c-o-m-b wrote: post #27
winter_blue wrote: post #13

Earlier quoted context omitted.

Sadly, Verizon Pixel phones, even after carrier unlocking, seem to be forever blocked from using GrapheneOS.

I finally left Verizon after nearly 20 years. I had it with their enshittification, couldn't stand it anymore. I switched to US Mobile and on the Darkstar (AT&T) network. I have no regrets. I caught it on a black friday deal, so I'm paying basically $20/mo for top tier service. You wouldn't have caught me dead with an AT&T service or MVNO years ago because I'd seen so many bad experiences second-hand, but these days…

> I also did the math and determined buying a new unlocked phone outright on this plan was far cheaper than paying Verizon monthly for one.

On any plan.

There’s a reason that as soon as you walk into a cell store they immediately try to schmooze you into signing contracts and leasing phones.

It’s the way they make the most margin!

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#33

Post by c0balt »

hedora wrote: post #25

> Google maintained its position, authorizing public disclosure on April 29. I'm surprised they honored the embargo at that point, and delayed the fix until May. Why not just release immediately?

Not damaging their relationship with Google as a vendor most likely. For better or worse, GrapheneOS is depend on Android which is controlled by Google.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#34

Post by SV_BubbleTime »

boje wrote: post #3
unethical_ban wrote: post #2

I know there are bad business reasons, but how can someone classify a VPN leak as "not a security issue" and keep their pride?

That assumes there is pride they have to bother to keep.

We need to bring back shame.

Step one… completely reform MBA programs.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#35

Post by Georgelemental »

c0balt wrote: post #33
hedora wrote: post #25

> Google maintained its position, authorizing public disclosure on April 29. I'm surprised they honored the embargo at that point, and delayed the fix until May. Why not just release immediately?

Not damaging their relationship with Google as a vendor most likely. For better or worse, GrapheneOS is depend on Android which is controlled by Google.

The researcher who discovered the bug is not affiliated with Graphene

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#36

Post by whatsupdog »

zb3 wrote: post #17

Stock Android is spyware and adware, back in the day we called such software malicious and removed it, now it's the default.

We all agree. But what's the solution? We know 99% of the users don't care. So, the only pressure point is phone manufacturers. I don't have any power to influence anybody significant in this space. I feel helpless.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#37

Post by kqp »

Paradigm2020 wrote: post #11
nottorp wrote: post #7

> Because system_server operates with elevated networking privileges and is exempt from VPN routing restrictions So a VPN isn't a VPN on Android? Regardless of this bug. Do other locked down operating systems act the same?

Ios does the same, only way around it is if you have an ?enterprise? licence (250+ devices) Mullvad and others reported on that one ages ago

Is this really true? The Mullvad report a year or so ago was that they didn’t want to turn on no exceptions mode because it breaks network connectivity until reboot if you don’t pause it when updating the app, not that the feature doesn’t exist. They also recently shipped it anyway, opt in and behind a warning.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#38

Post by ignoramous »

The issue reported on lowlevel.fun [0] and discussed on GrapheneOS forums [1] does seem like a security issue. It isn't clear why engineers in charge would mark it infeasible as the breach demonstrates more than one failure.

1. A new (albeit "hidden" [2]) network API registerQuicConnectionClosePayload(fd, payload) lets a process set any byte array for the OS to send on its behalf.

2. No ("panaroid networking") permission checks against the calling uid/process when sending that byte array out on a OS-owned UDP socket.

3. Bypassing ("panaroid android") permission checks [3] by simply calling network-related syscalls (or libc/bionic functions) as opposed to Android SDK APIs.

These steps essentially amount to app sandbox escape (2,3) and privilege escalation (1,2). I am utterly confused why the Android security team at Google won't take this more seriously.

[0] https://lowlevel.fun/posts/tiny-udp-cannon-android-vpn-bypas...

[1] https://discuss.grapheneos.org/d/35152-android-always-on-vpn...

[2] In as much the code mmap'd into your own process can be "hidden" away. For their exploit though, the author cleverly abuses Binder IPC primitives to reach the "hidden" parts.

[3] This bypass probably only works for this one scenario because of #2.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#39

Post by fg137 »

Side question: what's a good way of getting a GrapheneOS phone?

I have been interested in using GrapheneOS but hesitant about actually getting a Pixel phone. Used phone prices are usually >$300 even for "a" series unless I go back several generations. Whether the device bootloader can be unlocked is also a question. I am definitely not ready to spend $449 on a new Pixel 10a.

Re: GrapheneOS fixes Android VPN leak Google refused to patch

#40

Post by mpol »

fg137 wrote: post #39

Side question: what's a good way of getting a GrapheneOS phone? I have been interested in using GrapheneOS but hesitant about actually getting a Pixel phone. Used phone prices are usually >$300 even for "a" series unless I go back several generations. Whether the device bootloader can be unlocked is also a question. I am definitely not ready to spend $449 on a new Pixel 10a.

You could wait it out for a bit. There is work underway to support more phone hardware. Which brand was a bit up for speculation.
Post reply on HN