r/GrapheneOS • u/UnlimitedGibil • 3d ago
Adware as spyware
I'm trying to figure out how much or how little Graphene protects us from the recent news about zero-click malware being installed via ad scripts. I use Vanadium, mostly, which doesn't have super robust adblocking, but I imagine does have measures against at least some kinds of script injection? I'm not really informed on that topic. Also not having an advertising ID seems like it would help, at least against being specifically targeted.
Also wondering, if the team reads this, how the news impacts the policy on adblocking functionality in Vanadium, now that it's definitely a security issue.
Link to article about this in comments
12
u/mesarthim_2 3d ago
I'd say, in general people with GOS and MTE equipped Apple products in lockdown mode should be relatively protected against the malware deployment, because even if the browser or app is compromised it's sandboxing should hold (these are javascript attacks).
How much, impossible to say without knowing what they were actually pushing.
The second component of the attack - the DARK CARTOGRAPHER (what an awesomely cool name, btw), if I understand it correctly, it's using WebRTC leaks to fingerprint users, so if you're protected against that, you should be fine, unless they're doing something more fancy then that.
Also, my bet is, we got the least sophisticated implementation of this. I bet better resourced actors (US, China,...) are doing this at much larger scale, which would be much less detectable.
1
u/AutoModerator 3d ago
GrapheneOS has moved from Reddit to our own discussion forum. Please post your thread on the discussion forum instead or use one of our official chat rooms (Matrix, Discord, Telegram) which are listed in the community section on our site. Our discussion forum and especially the chat rooms have a very active, knowledgeable community including GrapheneOS project members where you will almost always get much higher quality information than you would elsewhere. On Reddit, we had serious issues with misinformation and trolls including due to raids from other subreddits. As a result, many posts on our subreddit currently need to be manually approved, which is done on a best effort basis. If you would like to get a quicker answer to your question, please use our forum or chat rooms as described above. Our discussion forum provides much better privacy and avoids the serious problems with the site administrators and overall community on Reddit.
Please use our official install guides for installation and check our features page, usage guide and FAQ for information before asking questions in our discussion forum or chat rooms to get as much information as possible from what we've already carefully written/reviewed for our site.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
u/Appropriate-Kick-601 3d ago
I'd recommend blocking JavaScript by default in vanadium, or using an alternative with an adblocker built in. Blocking js necessarily blocks ads because that's how they load. Also, a VPN with dns adblock built in is so nice. I personally have had good experiences with IVPN, mullvad, or windscribe.
2
u/other8026 3d ago
Vanadium does have an ad blocker
2
u/Appropriate-Kick-601 2d ago
Okay, I didn't want to commit to saying so myself but I thought I remember it having one. Thanks for confirming.
2
u/FunEnvironmental8687 3d ago
Ad blocking does not address the underlying issue, as this is a browser vulnerability. If the malware were known in advance, the browser could be patched to prevent exploitation. Ad blocking is not a security measure and should not be treated as a substitute for proper browser security.
Ad blockers primarily block known ads and scripts based on predefined filters. If the malicious script is unknown or hasnt yet been added to those filters, it wont be blocked.
2
u/Appropriate-Kick-601 2d ago
Right, I hear you on the limits of ad blocking. But in that case, I refer you back to my first suggestion - if JS code can't run, it can't run. I'll concede this won't cover every eventuality, and agree that a true fix is needed. But it should help.
1
u/FunEnvironmental8687 2d ago
Yes, but most modern websites require JS, so blocking it by default and whitelisting trusted sites is definitely useful. That said, most of the time, you’ll end up allowing it and running it anyway.
My point was that an ad blocker wouldn’t really help in this scenario. If the code exploits a known Chromium vulnerability, that vulnerability should be patched in Chromium itself. The ad blocker would just be blocking malware that no longer works anyway, so you’re not getting any real benefit from it.
Vanadium, on the other hand, includes a lot of security improvements over standard Chromium. So my point is that you shouldn’t rely on an alternative browser with an ad blocker to protect you from malware when Vanadium offers far better security overall.
1
-5
•
u/other8026 3d ago
I've only had a chance to read some of the article, so I can only give some general comments about the news.
Articles about the operation mention 0 day attacks. Fortunately, GrapheneOS has defenses against exploitation of unknown vulnerabilities. I'd suggest people read that section to get an idea of what that means. These protections are far more important than many may realize. This isn't to say that GrapheneOS is invulnerable to attacks, but it's significantly harder on GrapheneOS than far less secure alternatives, including other Android operating systems, operating systems that are far behind on security patches, or desktop OSes.
It's also important to note that GrapheneOS is extremely quick to release OS and Vanadium updates with all security patches available. This also goes a long way in protecting our users from known exploits.
In situations like these, I usually find myself having to remind people to keep a level head because it's easy for people's imaginations to get the better of them. The parts of the article that I read were very vague about exploits. This kind of uncertainty can lead to unfounded theories.
It's very easy to fall into the trap of "us vs. our imaginations" discussions. Imaginational adversaries are infinitely capable and we always lose. While fun in some cases, they're not productive in our community.