The release of the secure mobile platform GrapheneOS 2024011300 is now available. This version is a branch from the Android codebase (AOSP, Android Open Source Project), enhanced and modified to boost security and ensure privacy. The project was previously developed under the name AndroidHardening and before that branched off from the CopperheadOS project after a dispute among its founders. Most current Google Pixel devices (Pixel 4\/5\/6\/7\/8, Pixel Fold, Pixel Tablet) are officially supported in GrapheneOS. The project's developments are distributed under the MIT license. <\/p>\n
GrapheneOS includes many experimental technologies related to enhancing application isolation, detailed access control, blocking typical vulnerabilities, and complicating the operation of exploits. For example, the platform uses a custom malloc implementation and a modified libc variant with memory corruption protection, as well as stricter process address space separation. Instead of JIT, only ahead-of-time (AOT) compilation is used in the Android Runtime. The Linux kernel includes many additional protection mechanisms, such as adding canary labels to slub to block buffer overflows. SELinux and seccomp-bpf are utilized to enhance application isolation. <\/p>\n
There is the capability to grant access to network operations, sensors, contacts, and peripheral devices (USB, camera) only to selected applications. Reading from the clipboard is allowed only for applications that currently have input focus. By default, obtaining information about IMEI, MAC address, SIM card serial number, and other hardware identifiers is prohibited. Additional measures have been taken to isolate Wi-Fi and Bluetooth-related processes and prevent leaks due to wireless activity. Many of the security enhancement mechanisms developed in this project have been integrated into the main Android codebase. <\/p>\n
GrapheneOS employs cryptographic verification of loaded components and advanced data encryption at the file system level for ext4 and f2fs (data is encrypted using AES-256-XTS, while file names are encrypted with AES-256-CTS utilizing HKDF-SHA512 to generate a separate key for each file), rather than at the block device level. Data in system partitions and in each user profile is encrypted with different keys. Available hardware capabilities are leveraged to accelerate encryption operations. A session termination button is displayed on the lock screen, which, when pressed, resets the decryption keys and puts the storage into an unactivated state. There is a setting to prevent the installation of additional applications for selected user profiles. To guard against password guessing, a delay system depending on the number of failed attempts is employed (ranging from 30 seconds to 1 day). <\/p>\n
GrapheneOS fundamentally does not include Google applications and services, nor alternative implementations of Google services, such as microG. However, it is possible to install Google Play services in a separate isolated environment that does not have special privileges. The project also develops several of its own applications focused on information security and privacy. For example, it offers the Vanadium browser based on Chromium and a modified version of the WebView engine, a secure PDF viewer, a firewall, the Auditor application for device verification and intrusion detection, a privacy-focused camera application, and the Seedvault system for creating encrypted backups. <\/p>\n
Among the changes in the new version: <\/p>\n
The user profile data remains encrypted after the device restart and is only decrypted after the user enters their login password. If the user has not unlocked the activated session for more than 18 hours, the device will automatically reboot (the timeout can be changed in Settings > Security > Auto reboot) to prevent key analysis that remains in memory if the device falls into other hands. <\/p>\n
As a demonstration of the necessity of the auto-reboot feature, the developers of GrapheneOS mentioned recently discovered vulnerabilities in Google Pixel and Samsung Galaxy smartphones that allow forensic analysis companies to spy on users and extract data while the device is in an activated state (when the session is active and the data is decrypted). <\/p>\n