GrapheneOS has diminished exploit capabilities for Cellebrite a third time. They are no longer able to Full Filesystem extraction an unlocked device. This prevents extraction of hidden operating system and application data. Given it is unlocked, they're still accessing all the important stuff though. This could be an indicator of their target. They are likely to move their resources to attempt researching an exploit targeting the Titan M2 secure element or for extraction for AFU Locked devices rather than be concerned about extracting a device already unlocked. We routinely receive this information from sources familiar with Cellebrite. However, do you have more information on exploit vendors? Do the right thing. Tip off #GrapheneOS at security@ our domain or contact the project account on our platforms. We will respect your privacy. We have made upstream security reports to Google and Apple. Encryption can be performed via our Age public key: age1dcftzgq00ykgwvxl5te6d5clqgx75h2g54c0u8gjc43mcnea7p7q3ma0yx https://grapheneos.org/.well-known/security.txt
Android Authority's avatar Android Authority
Cellebrite leak highlights how much more secure Pixel phones are with GrapheneOS https://www.androidauthority.com/cellebrite-leak-google-pixel-grapheneos-security-3611794/
View quoted note →

Replies (3)

You should provide another means beside email to contact you. Run your own SimpleX server and receive security messages there as well.
We also have Matrix with our own homeserver. All internal matters uses that. SimpleX likely will only remain an unofficial platform for moderation / bridging reasons. They also seem to be making large systematic changes, so maybe now is not the right time.