The latest update of the secure mobile platform GrapheneOS 2024053100 has introduced an emergency data lock feature on the device. Users are now able to set an additional password and PIN code, the input of which will result in the clearing of all keys in hardware stores, including keys used for encrypting data on the storage, as well as the clearing of eSIM and a reboot. Thus, in case of pressure on the user or being forced to unlock the screen, or when there is a threat of the smartphone falling into the wrong hands, the device owner can enter a destructive PIN code and block data with no possibility of restoring access.
The GrapheneOS project is an offshoot of the Android codebase (AOSP, Android Open Source Project), expanded and modified to enhance security and ensure privacy. Official support is provided for most current Google Pixel devices (Pixel 4/5/6/7/8, Pixel Fold, Pixel Tablet). The project's developments are distributed under the MIT license. It incorporates many experimental technologies related to enhancing application isolation, detailed access management, blocking common vulnerabilities, and complicating exploitation attempts.
For example, the platform uses a custom implementation of malloc and a modified variant of libc with protections against memory corruption, as well as stricter separation of process address space. Instead of JIT in the Android Runtime, only ahead-of-time (AOT) compilation is used. The Linux kernel includes many additional protection mechanisms, for instance, canary tags are added in slub to block buffer overflows. To enhance application isolation, SELinux and seccomp-bpf are employed.
There is an option for selective access for individual applications to network operations, sensors, the address book, and peripheral devices (USB, camera). By default, obtaining information about the IMEI, MAC address, SIM card serial number, and other hardware identifiers is prohibited. Reading from the clipboard is only allowed for applications that currently have input focus. Additional measures have been implemented to isolate Wi-Fi and Bluetooth-related processes and prevent leaks resulting from wireless activity. Many of the security enhancement mechanisms developed as part of the project have been integrated into the main Android codebase.
GrapheneOS employs cryptographic verification of downloaded components and advanced data encryption at the level of ext4 and f2fs file systems (data is encrypted using AES-256-XTS, while file names are encrypted with AES-256-CTS using HKDF-SHA512 to generate a separate key for each file), rather than at the block device level. Data in system partitions and within each user profile are encrypted with different keys. Available hardware capabilities are utilized to accelerate encryption operations. A session termination button is displayed on the lock screen, and upon pressing it, the decryption keys are reset, and the storage is put into an inactivated state. There is a setting to prohibit the installation of additional applications in selected user profiles. To protect against password guessing, a delay system is implemented, which varies based on the number of failed attempts (from 30 seconds to 1 day).
GrapheneOS does not include Google applications and services fundamentally, nor alternative implementations of Google services such as microG. However, there is the option to install Google Play services in a separate isolated environment without special privileges. The project is also developing several proprietary applications focused on information protection and privacy. Notably, it offers the Vanadium browser based on Chromium, a modified version of the WebView engine, a secure PDF viewer, a firewall, the Auditor application for device verification and intrusion detection, a privacy-focused camera application, and the Seedvault system for creating encrypted backups.
Source: opennet.ru
