I’m running Graphene on a Pixel 6. I lost it and someone opened it somehow and called two of my contacts to give it back.
I’m a bit confused how this even happened. When I got the phone back, they were going through my contacts. I checked app usage stats and they went through a banking app (not missing money), maps, signal, etc.
Is there a way to figure out how they even unlocked my phone?
Gonna need to know more. What method do you use to lock your phone? Is it rooted?
Also: did they return the phone to you, or to your friend? Could it be your friend who went through these apps?
Fingerprint and pin code. They left the phone at a store nearby and I went to pick it up
Odd suggestion, but do you still have their contact info? Could you ask them? 😄
You could also send them a small thank you gift and ask them with that, so not to make it seem like you’re accusing them of anything
It’s a reasonable request, you could say that you need to keep your phone secure for work, and while it was great that the stranger was able to get it to you, you’re following up on if there is some bug you need to look into
Unrelated, it might be good to set up a “If lost, call ____” type message. If you don’t have another number, email also works.
Yeah. Definitely setting that up now haha. They used my phone to call my contacts, so I don’t have their number
~But it whoever they called, will have it, so maybe find out which of your contacts got to know about it?~ This is a mystery that we need to solve now!
Edit: I’m dumb.
They used his phone…
Did they call a contact that was in you ICE list by chance? Most people understand how that works these days.
It might have been the fingerprint sensor. They can be fooled. Mine occasionally thinks the inside of my trouser pocket looks just like my finger.
Was it perhaps unlocked when you lost it?
I know I’ve set my phone down unlocked a few times; particularly at work (in a warehouse).
Unless you have it set to never lock its not possible. All phones lock automatically after 30-60 seconds by default.
This person is clearly well-intentioned, so I don’t think an exploit was the cause of your phone being unlocked. If they knew an exploit it’s likely that by now everything about you would’ve been compromised already, like you would’ve lost access to your accounts and all your money would be gone. This person probably unlocked your phone by using your pin code, so either it was a very common pin code, or something suggested here, like smudges on your screen revealing the pin code, or highly unlikely, they guessed your pin code. Anyway, it’s better safe than sorry so check if your OS’ been tampered with using the GrapheneOS auditor app. Even if it hasn’t, you should back up everything and factory reset it just to err on the side of caution. And in the future, use an 8-10 digit pin code with pin scrambling enabled.
Do those contacts happen to be your ICE? Some phones will allow those from the emergency dialer without unlocking. Don’t know about grapheme.
Graphene has and emergency dialer, but you can’t call my contacts from it.
Perhaps they simply took out the sim card and inserted into another phone, giving them access to contacts (that could have been saved into the chip instead of the original phone)?
Good thinking but doesn’t explain how they accessed the apps.
That’s true. They must have gained access to the phone itself somehow.
There’s no way it’s that easy… is it??
No, it isn’t. I’ve used many Android phones over the years and none have ever defaulted to storing contacts on the SIM. SIM storage is very rudimentary, and you’d have to go out of your way to make use of it.
True , however most people do not use a pin for sim. And if you have the access a lot of info can be gain from a simcard. And even if you ain’t got access to network, any incoming traffic will go to you.
Does your phone have a physical SIM and if so are there any contacts stored on it?
Yeah, but the calls were from my phone, so I think they would have to open it
They could’ve swapped the SIM to another phone though? Assuming you’re rocking a provider default PIN
But again, the calls were placed from his device, and other apps were accessed.
My guess would be that maybe it wasn’t locked in the first place or they happened to randomly try a few pin combinations & got lucky…
I think those are most likely scenarios.
Now if you’re some very important person who could be target then I wouldn’t assume what I stated previously & instead assume the worst.
My mom says I’m very important … so I’ll assume this was a state actor
But yeah, this is most likely. I changed my settings to lock faster with a longer pin
Ask the graphene devs.
Is it possible that something else was installed to the phone? If they manage to hack it open, then potential reason to return it to you is to spy on you.
Removed by mod
Why not? Most people ITT clearly don’t seem security minded enough to even think of that as a possibility.
Maps and signal is like they were trying to contact somebody and see where you lived to return the phone. Banking is weird since you can’t do anything without biometric anyway.
I think you got it backwards - OP was checking those apps to see if they had been accessednvm I got it backwards
They mentioned checking app usage, so the person who found the phone opened those apps
Yeah. They were accessed while the phone was lost
Any chance the phone was stolen and not lost? Got anyone in the family working for the government or anything unusual like that. Just a thought.
If they were able to guess your pin, you should probably switch to a longer pin or a password. It seems insane at first to type a long password, but if you pick two long scientific words, its secure with only letters.
I use a password longer than the android limit (16 characters) since graphene allows longer; I use letters numbers and symbols. But I also use biometrics, because fuck typing that every time I need to open my phone. Allows for a very secure fresh (re)boot state, and with decent security when it has been unlocked at least once. I also use Locker, which (assuming it works, it’s a few years old now, luckily never had to see) lets you set a max number of unlock attempts before using admin privileges to wipe. And graphene lets you set a ‘time since last unlock’ auto-restart, to get that initial secure state back.
Probably overkill, but I have leos in the family and I have been harassed before several times over the years (often without any cause or merit), as a teenager and beyond, and I don’t trust anyone wearing a badge anymore. So ‘plan for the worst, hope for the best’ is my strategy.
deleted by creator
What I said, a smartphone can never be a secure device and this is why it is crazy to have sensitive data stored in these gadgets. It is certainly unlikely that this person gained access by trying the pins, because the cell phone would be blocked after the third failed attempt, but even so, a computer expert needs seconds to access, bypassing this little protection that cell phones have. You can be happy that your Secure Banking app is better protected, probably with 2FA, coordinate card, ID card or similar. In any case, this mobile phone is already compromised, which makes it necessary to change at least the credentials, better even your phone number (ask your ISP). Also be attentive, since this person may have been honest, but he returned it may also be because he was not interested in the cell phone, but in the address where you live.
A smartphone has better protection and actual disk encryption than probably 90% of all Computers or Laptops since its enabled by default.
No, it isn’t, independent of that it’s easier to get lost or robbed.
https://www.techradar.com/news/8-reasons-why-smartphones-are-privacy-nightmare
No, it isn’t, independent of that it’s easier to get lost or robbed.
https://www.techradar.com/news/8-reasons-why-smartphones-are-privacy-nightmare
Thats not what i said.
Modern Smartphones offer a much better protection against data extraction than regular Computers/Laptops.
The own OS and preinstalled app in a Mobile are extracting your data. This you can only avoid to root it to be able to desinstalar them, but this cause that you must made the security updates by yourself, in rooted phones it isn’t automatic. Than use only apps from F-Droid and not from the Store, install an paid AV and use VPN. Only in this way it is somewhat more secure. Better if you use some Linux Mobile.
The own OS and preinstalled app in a Mobile are extracting your data. This you can only avoid to root it to be able to desinstalar them, but this cause that you must made the security updates by yourself, in rooted phones it isn’t automatic. Than use only apps from F-Droid and not from the Store, install an paid AV and use VPN. Only in this way it is somewhat more secure. Better if you use some Linux Mobile.
How is this different from Windows?
Sure, but how often do you take your desktop on a walk?
I wrote Laptop also. Pls do not try to misdirect.
Removed by mod
Lol pixel 6 did have fingerprint reader issues. But pixels are incredible secure overall. But you got a bit of a fixation don’t ya?🤡
