Android Security and Countersurveillance With GrapheneOS

Android Security and Countersurveillance With GrapheneOS

Speakers: Andrew, Security Engineer

Conference: BSides Seattle 2026

YouTube: https://www.youtube.com/watch?v=ApiyKmAFs0s

Overview

Andrew, a security engineer with a background in web application pentesting and a passion for researching surveillance technologies, delivered an exhaustive briefing on GrapheneOS as a practical countersurveillance tool for Android users. The talk laid out three categories of threats facing Android users today -- data privacy leakage, remote device compromise via nation-state spyware, and local device extraction by forensic tools like Cellebrite -- and then demonstrated how GrapheneOS mitigates each one.

The presentation is especially relevant in 2026 given the escalating use of commercial forensic tools by law enforcement agencies, the multi-billion-dollar data broker market, and the ongoing arms race between exploit vendors and mobile OS hardening efforts. Andrew grounded the technical content in a human-centered call to action: security professionals should help their loved ones -- activists, journalists, lawyers, immigrants, and others at heightened risk -- understand and mitigate these threats.

Background

▶ Watch: Motivation: why your phone is a federal informant (0:00)

The mobile surveillance landscape has grown dramatically. The Department of Homeland Security has spent millions purchasing cell phone location data. ICE deploys fake cell towers (Stingrays) and purchased a tool capable of tracking hundreds of millions of phones daily. Cellebrite and similar forensic extraction tools are routinely used by US and foreign law enforcement to crack seized devices. Meanwhile, the global mobile data broker market exceeds $12 billion, with companies like SafeGraph paying app developers $1-$4 per user per year for location data and Venntel selling the federal government access to their database at approximately $20,000 per 12,000 queries.

Google itself functions as a data broker: 75% of its revenue comes from targeted advertising. Android and iOS devices send telemetry to their manufacturers roughly once every five minutes, even when idle and even when the user has opted out of data collection at every available setting. Ninety percent of Google Play Store apps contain embedded trackers, and 99.4% of users can be uniquely fingerprinted solely by their list of installed apps.

Key Findings

▶ Watch: Data brokers: 99.4% of users fingerprinted by installed apps (5:56)

Andrew presented several critical findings about the current state of mobile security and GrapheneOS's position within it:

• Cellebrite capabilities: Full filesystem extraction of unlocked phones is essentially universal. PIN brute-forcing is impossible on Pixel 6+ (Titan M2) and iPhone 12+, but remains possible on all other Android and iOS devices. After-first-unlock (AFU) data extraction is possible on most or all phones. According to leaked Cellebrite slides, GrapheneOS on Pixel 6 or newer is immune to BFU, AFU, and brute-force attacks.

• Patch gap problem: In 2022, Google found that variants of known vulnerabilities accounted for 40% of in-the-wild exploited zero days. OEM patch rollout delays mean publicly disclosed vulnerabilities remain exploitable as de facto zero days for extended periods. GrapheneOS consistently deploys patches faster than all other Android OEMs, sometimes months ahead, and offers an option to install security patches while still under embargo.

• Data broker exposure: Location data purchased from brokers does not require a warrant. Push notifications on Android and iOS route through Google/Apple servers and are routinely subpoenaed by federal agencies. Even "end-to-end encrypted" apps like Signal leak metadata (message receipt timestamps) through this channel.

• Nation-state spyware market: NSO Group's Pegasus, Intellexa's Predator, and Kandiru's Sherlock are sold to governments for millions of dollars. One contract offered 15 concurrent infections for $15 million. These exploits can be zero-click, requiring no user interaction.

Technical Deep Dive

▶ Watch: Cellebrite capabilities: which phones can be cracked (22:00)

Android's security model layers SE Linux mandatory access control, application sandboxing (each app runs as a separate Linux user in its own SE Linux context), granular permissions, and verified boot with rollback protection. A typical exploit chain requires code execution, sandbox escape, privilege escalation, persistence, and data exfiltration. Primary attack surfaces include media parsing (images, PDFs, fonts), messaging apps (especially WhatsApp), browser engines (Chrome zero days), baseband firmware, and local USB exploits.

Device encryption on modern Android uses file-based encryption (FBE) with two storage tiers: Device Encrypted (DE) storage, accessible before first unlock (containing device info, SIM data, account names, saved Wi-Fi passwords, installed app list, Bluetooth devices), and Credential Encrypted (CE) storage, protected until the user enters their PIN. The PIN itself is verified by a secure element -- the Titan M2 on modern Pixels, Knox Vault on flagship Samsungs, or a Trusted Execution Environment on mid-range and Qualcomm devices. Only the Titan M2 and Knox Vault are discrete chips, making them less susceptible to side-channel attacks.

GrapheneOS implements extensive hardening. Its hardened memory allocator features zero-on-free (all freed memory is immediately zeroed), stack canaries, guard regions around allocations, and ARM Memory Tagging Extension (MTE) on Pixel 8+, where each 16-byte memory chunk receives a 4-bit tag that must match the accessing pointer's tag. JIT compilation for JavaScript is disabled by default, preventing JIT spraying attacks that exploit writable+executable memory pages. Dynamic code loading can be disabled for user apps.

For Cellebrite defense, GrapheneOS offers configurable auto-reboot (default 12 hours of inactivity triggers reboot to BFU state), hardware-level USB data line disabling when the device is locked, and a duress PIN that wipes the device (including all encryption keys and SIM data) within 45 seconds.

For privacy, GrapheneOS provides non-persistent Wi-Fi MAC address randomization by default, automatic Bluetooth disabling after configurable idle time, disabled Wi-Fi positioning by default, and per-app network permission control (all apps default to no network access). User profiles (up to 32 on GrapheneOS versus 3-4 on stock Android) provide isolated workspaces with separate apps, data, credential encrypted storage, and independent PINs. The recommended setup is: an owner profile for app stores only, a trusted/sensitive apps profile, an untrusted apps profile, and a Google Play Services profile.

Google Play Services runs as a sandboxed user-mode app rather than a system application, and can be limited to specific profiles. Storage scopes allow limiting app access to specific files, photos, or contacts, invisible to the app. A known cross-profile communication vulnerability exists via the localhost loopback address, actively exploited by Meta and Yandex apps.

Demo / Proof of Concept

▶ Watch: GrapheneOS defenses: auto-reboot, USB disable, duress PIN (26:00)

While this talk was not a live demo in the traditional sense, Andrew walked through practical installation and configuration of GrapheneOS. The web-based installer requires no command-line expertise: users connect their Pixel to a desktop, change one setting, and click through the installer. Andrew provided a post-installation checklist: lock the bootloader, create distinct user profiles, install open-source apps from F-Droid, use the Aurora Store for Play Store apps without Google services, install a VPN, enable embargoed security updates, enable LTE-only mode (disabling 2G, 3G, and 5G to prevent downgrade attacks), and set the USB-C port to charging only.

Defensive Implications

▶ Watch: Practical quick-start guide for installing GrapheneOS (43:48)

The defensive implications of this talk extend well beyond individual device hardening. For security practitioners, the key takeaway is that the threat landscape for mobile devices is bifurcated: data broker surveillance affects everyone at scale, while targeted exploitation (Pegasus, Cellebrite) affects specific high-risk individuals. GrapheneOS addresses both categories but is limited to Pixel hardware.

Organizations should consider GrapheneOS for employees in high-risk roles (journalists, lawyers, human rights workers). Security teams should understand that stock Android, even with all privacy settings toggled, still leaks telemetry every five minutes. The patch gap problem means even excellent patch hygiene does not guarantee protection -- GrapheneOS's embargo patch option provides a meaningful advantage. For individuals who cannot use GrapheneOS (non-Pixel hardware), eOS is the recommended alternative for privacy, though it lacks GrapheneOS's security hardening.

The duress PIN feature, while powerful, carries legal risk: in 2025, an activist using it during a CBP encounter was charged with destruction or removal of property to prevent seizure. Security professionals advising at-risk individuals should communicate this legal dimension clearly.

Key Takeaways

• Stock Android sends telemetry every 5 minutes even when idle with all opt-outs enabled; 90% of Play Store apps contain trackers; location data purchases require no warrant
• Cellebrite can extract data from most phones in BFU, AFU, and unlocked states; GrapheneOS on Pixel 6+ is the documented exception according to leaked Cellebrite slides
• GrapheneOS's hardened memory allocator (zero-on-free, MTE on Pixel 8+, guard regions) and disabled JIT compilation significantly raise the cost of remote exploitation
• User profiles (up to 32) with separate encryption keys and independent PINs provide compartmentalized security; the auto-reboot feature returns profiles to BFU state after configurable idle time
• The patch gap is severe: 40% of in-the-wild exploited zero days in 2022 were variants of known vulnerabilities; GrapheneOS deploys patches months ahead of other OEMs
• Security professionals have a responsibility to help at-risk individuals in their lives -- activists, journalists, immigrants, lawyers -- understand and mitigate mobile surveillance threats

About the Speaker(s)

Andrew is a security engineer specializing in web application pentesting who holds a DEF CON Black Badge. He has a deep research interest in surveillance technologies and countersurveillance techniques. He mentioned being actively job-seeking in offensive security roles at the time of the talk. His slides were made available on GitHub with full citations.