Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking • Hacker News Board

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#151

Post by strcat » Sat, Nov 01, 2025, 4:25 AM UTC

vbezhenar wrote: post #65

fph wrote: post #60

Earlier quoted context omitted.

Two fixes that would be trivial to backport to mainline Android.

You can configure USB port for charging only in the developer options.

No, that only changes the USB gadget mode. It doesn't disable USB peripheral support, USB protocol handling, etc. in the OS and doesn't disable USB at a hardware level. It doesn't protect against the vast majority of Linux kernel driver exploits heavily used by Cellebrite. They mainly exploit bugs in USB peripheral drivers but could also exploit lower level kernel code or firmware if they had to.

Modern Android on modern devices does support disabling software USB support for USB peripherals and USB gadgets while locked via Android 16 Advanced Protection feature. It also has a device admin API for disabling USB at a software level through device admin apps, which could implement disable it while locked but cannot provide support for still using a USB device connected while unlocked to make it much more usable. None of that provides comparable protection to the GrapheneOS USB protection feature, which is one small part of the overall GrapheneOS exploit protections.

By default, GrapheneOS blocks new USB connections at a software AND hardware level when the device is locked and then disabling USB data once existing connections end. You can get similar software level functionality via the Android 16 Advanced Protection feature but not the hardware-level protection or the many other exploit protections in GrapheneOS.

https://grapheneos.org/features#exploit-protection explains what's improved compared to standard Android 16. It's not documentation on Android + GrapheneOS features but rather only what GrapheneOS improves.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#152

Post by strcat » Sat, Nov 01, 2025, 4:28 AM UTC

tranq_cassowary wrote: post #124

vbezhenar wrote: post #65

Earlier quoted context omitted.

You can configure USB port for charging only in the developer options.

That only turns it of on the OS level. GrapheneOS also turns it off on the level of the USB controller.

That standard Android toggle doesn't turn off USB support at the OS level but rather controls the default USB gadget mode. USB gadget functionality is one part of the high level USB functionality. That doesn't block USB peripherals, USB-C alternate modes, etc. and leaves nearly all the kernel attack surface being exploited by Cellebrite intact.

See https://news.ycombinator.com/item?id=45779241 which explains this.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#153

Post by strcat » Sat, Nov 01, 2025, 4:28 AM UTC

giantg2 wrote: post #87

vbezhenar wrote: post #65

Earlier quoted context omitted.

You can configure USB port for charging only in the developer options.

I think that's at the OS level. I think there are things that could be done through the firmware level.

That standard Android toggle doesn't turn off USB support at the OS level but rather controls the default USB gadget mode. USB gadget functionality is one part of the high level USB functionality. That doesn't block USB peripherals, USB-C alternate modes, etc. and leaves nearly all the kernel attack surface being exploited by Cellebrite intact.

See https://news.ycombinator.com/item?id=45779241 which explains this.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#154

Post by strcat » Sat, Nov 01, 2025, 4:34 AM UTC

andrepd wrote: post #71

vbezhenar wrote: post #65

Earlier quoted context omitted.

You can configure USB port for charging only in the developer options.

On Lineage this is the default behaviour: charging only until I tap on a notification to change it.

That's the standard Android behavior for the USB gadget mode, not something specific to LineageOS, and it does not mean USB is in a charging-only mode but rather than no USB gadget functionality such as file transfer (MTP) is active. It does not mean USB peripherals and USB-C alternate mode are disabled, which certainly work in the default charging-only mode for Android's USB gadget setting. It doesn't even mean that USB gadget mode is fully disabled, only that it's in the MTP mode with MTP disabled. There's a slight difference between the regular and and more advanced setting: MTP mode with MTP disabled vs. no active USB gadget. The USB protection feature on GrapheneOS is for blocking new USB connections as a whole at both a software and hardware level and disabling USB data at a hardware level vs. that setting only controlling USB gadget mode. Most of the attack surface is in the USB protocol implementation and especially the USB peripheral drivers which are not disabled in the default mode Android calls charging-only since it's about USB gadget mode, i.e. using the phone itself as a peripheral.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#155

Post by strcat » Sat, Nov 01, 2025, 4:36 AM UTC

ls612 wrote: post #66

fph wrote: post #60

Earlier quoted context omitted.

Two fixes that would be trivial to backport to mainline Android.

iOS already does both of this afaik. At least the automatic reboot part, I think the USB data functionality is disabled in some cases while locked too.

iOS 18.1 added a variant of the locked device auto-reboot feature used by GrapheneOS, but it has a hard-wired 72 hour timer instead of a default 18 hour timer that's configurable between 10 minutes and 72 hours. iOS doesn't have an equivalent to the USB protection functionality in GrapheneOS and it doesn't enable what it does have by default.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#156

Post by strcat » Sat, Nov 01, 2025, 4:37 AM UTC

ls612 wrote: post #75

int0x29 wrote: post #74

Earlier quoted context omitted.

iOS is also compromised according to other cellebrite docs so that makes me think Graphene OS just might not be worth the effort for them.

iOS was hackable in 2024 for certain hardware (in particular the checkm8 era phones) or for iOS versions which had known vulns at that point. Modern hardware with updates was still listed as “in research” which means “we can’t”.

No, that's wrong. You're basing your claims on outdated leaks of Cellebrite documentation showing they didn't support the most recent iOS version yet, which they did end up support weeks later. You can't simply point to outdated documentation where they were working on catching up to claim they don't support those versions and devices today, which is in fact untrue.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#157

Post by tranq_cassowary » Sat, Nov 01, 2025, 4:38 AM UTC

strcat wrote: post #152

tranq_cassowary wrote: post #124

Earlier quoted context omitted.

That only turns it of on the OS level. GrapheneOS also turns it off on the level of the USB controller.

That standard Android toggle doesn't turn off USB support at the OS level but rather controls the default USB gadget mode. USB gadget functionality is one part of the high level USB functionality. That doesn't block USB peripherals, USB-C alternate modes, etc. and leaves nearly all the kernel attack surface being exploited by Cellebrite intact. See https://news.ycombinator.com/item?id=45779241 which explains this.

Thanks, I was confusing it with the Advanced Protection feature.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#158

Post by strcat » Sat, Nov 01, 2025, 4:39 AM UTC

ls612 wrote: post #114

int0x29 wrote: post #103

Earlier quoted context omitted.

The last leak was in 2024. Hopefully somone nabs the latest iOS release information Edit: last released leak showed they had broken the then most recent iOS release (17.5.1) in AFU state on all but the most recent hardware which was marked "available in CAS" https://discuss.grapheneos.org/d/14344-cellebrite-premium-ju... The good news is neither pixel nor iOS seems to show full file system extract under BFU state in…

Neither have had any known BFU on the latest iOS for years. AFU is occasionally possible but most of the leaks had latest software and hardware as still protected. Powering off the phone is always still a good idea though if you can.

That's not true. Cellebrite has working BFU and AFU exploits for recent iOS and usually catches up to the latest iOS versions and hardware in weeks or a couple months. They do not have working brute force support for the Pixel 2 / Pixel 6 or later / iPhone 12 or later due to the secure elements but can still exploit the devices in BFU mode and extract the data available before unlocking. iPhone 17 may work out better due to hardware memory tagging but previous iOS and iPhone models did not hold out in the way you're claiming at all.

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#159

Post by tranq_cassowary » Sat, Nov 01, 2025, 4:43 AM UTC

LoganDark wrote: post #145

tranq_cassowary wrote: post #135

Earlier quoted context omitted.

Google Wallet works but tap-to-pay NFC payments don't because Google enforces strong Play Integrity for that portion. They only allow Google certified OSes to use it. It's a sad choice on their part, not GrapheneOS' fault or choice.

Without Google Pay, Google Wallet is practically a glorified card number vault. Which can still be useful, just not at card terminals.

True. This is an issue in America specifically. Where there is a Google Apple duopoly on tap-to-pay tech. Can be worked around though with smart watches like Garmin watch with Garmin Pay. In many other regions there are alternatives like Curve Pay or tap-to-pay functionalities in banking apps

Re: Leaker reveals which Pixels are vulnerable to Cellebrite phone hacking

#160

Post by strcat » Sat, Nov 01, 2025, 4:54 AM UTC

int0x29 wrote: post #103

ls612 wrote: post #75

Earlier quoted context omitted.

iOS was hackable in 2024 for certain hardware (in particular the checkm8 era phones) or for iOS versions which had known vulns at that point. Modern hardware with updates was still listed as “in research” which means “we can’t”.

The last leak was in 2024. Hopefully somone nabs the latest iOS release information Edit: last released leak showed they had broken the then most recent iOS release (17.5.1) in AFU state on all but the most recent hardware which was marked "available in CAS" https://discuss.grapheneos.org/d/14344-cellebrite-premium-ju... The good news is neither pixel nor iOS seems to show full file system extract under BFU state in…

February 2025 documentation was posted by someone in that thread and a blog post was written by someone about it which was linked there. The initial link posted with the February 2025 documentation died and the blog post only focuses on Android and GrapheneOS rather than iOS too.

GrapheneOS has access to the latest Cellebrite Premium documentation since we have a contact able to share it with us. In April 2024 and then July 2024, we posted screenshots of specific capability tables from the documentation but then stopped doing it because it could result in losing access to it. The contact sharing it with us was still fine with us doing it but later came to the same conclusion we did that it's best not to post anything from it. Cellebrite doesn't like it being posted publicly even though it's essentially marketing their products, probably because it results in pressure on Android and iOS to stop it happening.