Cool blog post from a prolific security researcher about how GrapheneOS's MTE caught a crash in the Signal messaging app:

GrapheneOS's MTE caught a crash in Signal

Personal blog of Julien (jvoisin) Voisin

GrapheneOS version 2024062700 released. • add new GrapheneOS Info app through which you can get information about the latest releases of GrapheneOS, links to our community spaces, and details on how to make donations • Pixel 8a: add Let's Encrypt roots to Samsung gnssd CA root store for supl.grapheneos.org • Pixel 8a: configure Samsung gnssd to use TLSv1.2 for SUPL instead of TLSv1.1 (TLSv1.3 would work but the config doesn't offer it) • Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel Tablet, Pixel Fold: fully remove 32-bit ARM support to significantly reduce build time and update download size with no loss of functionality (7th gen Pixels launched with 32-bit app support disabled after several years of the Play Store blocking uploading 32-bit-only apps or installing them on 64-bit devices, and 8th gen Pixels use 2nd gen ARMv9 cores with no 32-bit support) • Settings: fix several cases of UI state being lost when resuming activity after configuration changes, etc. for GrapheneOS settings • kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.216 • kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.90 • kernel (6.6): update to latest GKI LTS branch revision including update to 6.6.35 • Vanadium: update to version 126.0.6478.122.0 • GmsCompatConfig: update to version 120

Releases | GrapheneOS

#GrapheneOS Info app is now available through our app repository and will be included in the next release of the OS. It supports viewing recent OS release notes, provides info on our chat rooms, forum and active social media accounts along with offering all the donations methods. This will be included in the next release of GrapheneOS. We also plan to make significant improvements to the other GrapheneOS apps in the near future. We'll also be working towards replacing or overhauling each of the user-facing AOSP apps as we already did with the Camera app. We recently completely replaced the Setup Wizard shown during the initial installation with a modern replacement following the standard setup design style. We'll be adding more functionality there and our app repository to help people get started including obtaining their apps.

Our latest release improves our hardware-based USB-C port attack surface reduction. Our previous software-based feature has been extended and merged into it as a 2nd layer of enforcement. We've also extended it to disable pogo pins data at a hardware level on the Pixel Tablet. Our previous feature is now fully obsolete and has been removed on devices with the newer approach, which is a nice simplification. We've rewritten the documentation here:

Features overview | GrapheneOS

Older approach is now only used on the Pixel 5a and earlier end-of-life devices. Our documentation explains why our approach is much better than the standard Android USB HAL toggle available to device admin apps since Android 12. Standard approach only disables USB connections in the OS. It leaves USB-C and pogo pins enabled at both the OS and hardware level. The standard approach also can't block new USB connections without ending existing USB connections. It has no distinction between those things. It forces a choice between ending existing USB connections when locking or delaying using it at all until the last USB connection ends. Several operating systems previously included a port of our legacy software-based approach and mistakenly moved to the less secure approach of disabling USB via the standard USB HAL after the last USB connection ends. It's less secure than simply extending our legacy feature... #GrapheneOS

#GrapheneOS version 2024062000 released. This version removes the USB peripheral security settings where USB-C port controls are supported. This is because that setting does the same job and far better. There are also hardening improvements. - remove our USB peripheral security setting on devices supporting our much better USB-C port mode (Pixel 6 and later) - extend USB-C port setting to also handle pogo pins on the Pixel Tablet - kernel (5.10, 5.15, 6.1, 6.6): replace our deny_new_usb feature with a new deny_new_usb2 feature also disabling USB gadgets - extend USB-C port setting to enable deny_new_usb2 as a second layer of defense disabling new USB connections in the kernel (the existing implementation disables new connections and USB data at a hardware level via the USB controller, which disables more attack surface, but we want to keep around the higher level kernel approach too) - Files: fix upstream null pointer exception triggered on resuming activity - Settings: require user authentication for changing auto-reboot, USB peripheral and USB-C port security settings - Settings: avoid prompting for user authentication when selecting the same value as before for GrapheneOS settings requiring it - temporarily add back memory tagging exception for Pixel wifi_ext service - simplify implementation of our auto-reboot feature and properly handle the first lock after the user first sets up a lock method - avoid resetting USB-C port after first unlock if it was already connected Before First Unlock (fix for regression caused by upstream changes) - add GrapheneOS Linux kernel port to the 6.6 GKI LTS branch - kernel (5.10): update to latest GKI LTS branch revision including update to 5.10.215 - kernel (6.1): update to latest GKI LTS branch revision including update to 6.1.87 - kernel (6.1, 6.6): add script for building emulator kernel - kernel (6.1, 6.6): enable forced module signing for x86_64 (emulator builds) - System Updater: increase update check interval to 6 hours from 4 hours - Vanadium: update to version 126.0.6478.110.0 GmsCompatConfig: update to version 119 - fix cast in GrapheneOS package management infrastructure needed for upcoming App Communication Scopes work

#GrapheneOS version 2024061400 was released. - revert upstream refactoring of the device association code in Android 14 QPR3 due to it introducing a chain crash bug at boot in edge cases with associated devices such as paired Android Wear devices - kernel (5.10): update to latest GKI LTS branch revision - Vanadium: update to version 126.0.6478.71.0

Releases | GrapheneOS

Pixel 6 and later use the open source Trusty OS for the Trusted Execution Environment (TrustZone) and secure core firmware. Starting with this month's quarterly release (Android 14 QPR3), Trusty sources and baseline applets are part of the Android Open Source Project in trusty/. Not everything is published, particularly Tensor specific portions. It'd be helpful to publish the rest to make it easier to audit and propose improvements. They still need to publish the Titan M2 fork of OpenTitan too, which they committed to eventually doing several years ago. The secure element in the Pixel 2 was an off-the-shelf NXP part running open source applets published in AOSP. In the Pixel 3, they moved to a custom secure element based on a standard ARM secure core and committed to open sourcing the firmware but it was blocked by the ARM NDA. OpenTitan was created to replace their secure elements based on ARM secure cores with a custom RISC-V design across their servers, Chromebooks and Pixel phones/tablets. Pixel 6 and later have a RISC-V secure element (Titan M2), but they still need to publish Pixel specific code. Upstream OpenTitan project is currently focused on implementing the TPM specification for desktop/server use. TPM is a horrible secure element API. It isn't what's used on Pixels where they got to design APIs for usage by the Android Open Source Project based on what it needs. This is closely related to publishing the rest of the Trusty code used for Pixels, since they implement communication using authenticated encryption between the SoC secure core and the standalone secure element. Non-Pixel Android ecosystem could benefit a lot from all this code.

Thank you for 1000 followers Nostr crew. Grateful to see so many fans of GrapheneOS here again. In the mean time, my profile picture was changed back to my old one. 🤔

We've found a serious bug in Android 14 QPR3 which can lead to devices getting stuck in a crash loop on boot after adding a device association such as a WearOS pairing. This impacts both stock Pixel OS and AOSP. Google is aware and reverted the broken change in Android 15 Beta 2. Today, we plan to do a release fixing this serious issue and the AOSP Bluetooth module regression breaking pairing with the Galaxy Watch6 device we purchased for testing due to previous Bluetooth regressions in Android 14 QPR2 breaking it. Today's release should reach Stable. If you don't depend on Bluetooth, you might as well update to the current OS release in the Beta channel and then switch back to Stable. Only reason it's not in the Stable channel yet is these 2 issues. There's another minor upstream Settings UI style issue which doesn't matter. #GrapheneOS

#GrapheneOS version 2024061300 released. I also missed the post about 2024061200 so I will go through both in brief. GrapheneOS moved to Android 14 QPR3 on the previous version. We've found at least one new issue with the Android Open Source Project 14 QPR3 Bluetooth module and are already working on resolving it. We'll have a quick follow-up release fixing the Bluetooth regression and other issues discovered during public Alpha testing. Pixel 8a is now supported as part of the standard Android releases instead of having a device branch based on Android 14 QPR1. We've had stable releases for it available since May 15th (1 day after launch) based on our last QPR1-based release (2024030300). Pixel 8a users will be getting the GrapheneOS improvements from March, April, May and June along with the Android 14 QPR2 and QPR3 improvements so it's a much larger release for the Pixel 8a. Changes since the 2024061200 release: - fix upstream Android 14 QPR3 regression which breaks updating certain apps with our app repository client - fix boot-time optimizing apps progress UI with Android 14 QPR3 and enable it again - fix regression in our Android 14 QPR3 port resulting in PIN scrambling in secondary users being determined by the Owner user setting - revert upstream Android 14 QPR3 Internet quick tile overhaul since it broke the functionality in secondary users - temporarily add back disabling memory tagging and hardened_malloc for surfaceflinger since Android 14 QPR3 didn't fix it as expected - disable temporary unconditional system crash notifications since we've gotten the initial feedback we needed via the previous release - add additional null check for eSIM wiping done as part of the duress PIN/password wipe implementation to avoid harmless exception - Settings: remove blank illustration from "Screen resolution" screen - Vanadium: update to version 126.0.6478.50.1 - make duress PIN/password tests faster and more reliable Changes since the 2024060500 release: - full 2024-06-05 security patch level rebased onto AP2A.240605.024 Android Open Source Project release, which is the 3rd quarterly maintenance/feature release for Android 14 (QPR3) - temporarily disable boot-time optimizing apps progress UI due to upstream Android 14 QPR3 regression (our own post-boot background optimizing apps progress notification works fine) - temporarily enable system crash notifications unconditionally for the initial QPR3-based release - change default USB-C port mode to "Charging-only when locked" from "Charging-only when locked, except before first unlock" - Settings: fix regression permitting disabling apps when it shouldn't be allowed due to device manager policy - Vanadium: update to version 126.0.6478.50.0 - GmsCompatConfig: update to version 117

Releases | GrapheneOS

#GrapheneOS version 2024060600 released. - Sandboxed Google Play compatibility layer: adjust to DynamiteLoader changes being deployed with a new feature flag in Play services 24.22 - stop treating pressing the spacebar on a physical keyboard as submitting the lockscreen password since it prevents entering passphrases with spaces (upstream Android bug which has existed for around 8.5 years) - Vanadium: update to version 125.0.6422.165.0 - GmsCompatConfig: update to version 116

Releases | GrapheneOS

#GrapheneOS version 2024060400 released. This is an early June security update release based on the May 2024 security patch backports since this month's release of the Android Open Source Project and stock Pixel OS with Android 14 QPR3 isn't available yet. There are also improvements to wiping which is used by the duress password. - full 2024-06-01 security patch level - extend the standard wipe-without-reboot implementation beyond wiping the hardware keystores (which prevents recovering any OS data by preventing deriving the key encryption keys) by also wiping the secdiscardable data needed to derive key encryption keys, the encrypted storage keys and the Weaver slots in the secure element through a secure element erase - kernel (5.10): update to latest GKI LTS branch revision - kernel (5.15): update to latest GKI LTS branch revision - kernel (6.1): update to latest GKI LTS branch revision

Releases | GrapheneOS

Latest release of #GrapheneOS finally shipped the long awaited duress PIN/password implementation. If you have a spare device, we recommend trying it out. We've added initial documentation to the features page:

Features overview | GrapheneOS

It near instantly wipes and shuts down. We've also finally added documentation on our USB-C port control to our features page:

Features overview | GrapheneOS

Most users can set this to "Charging-only when locked" without a loss of functionality or even "Charging-only" if you don't use USB accessories, DisplayPort or MTP. Default is "Charging-only when locked, except before first unlock" to avoid locking users out of devices with a broken touchscreen. The main threat model for this is defending the device until the auto-reboot timer started when the screen is locked gets user data back at rest.