4 ms·

Why was this installed on all their devices in the first place? I have nothing to do with Verizon, I've never even been to the US. This is something to worry ab

Why was this installed on all their devices in the first place? I have nothing to do with Verizon, I've never even been to the US. This is something to worry about because all it takes is someone having access to your unlocked device. For example a border guard demanding to have a look at something. When the user doesn't know this vulnerability exists, it's a problem. It's a company making remote access software. Who honestly wants this pre-installed on their devices? They can install their malware on their own phones, after having purchased them.

anvilspoke 2y ago
It doesn't do anything though. The "store_demo_mode" and "verizonwireless_store_demo_mode" settings are not set by default, and there doesn't appear to be any way to set these through the UI. Also, according to other comments, the app is disabled by default. From examining the CarrierSettings app, this does indeed appear to be the case. It seems to require a certain carrier configuration to enable it. Anyone who wants to enable the functionality of this app would have to go to some effort to do so, including enabling the Developer Settings - which requires the user's PIN, password or pattern - and then connecting to the device over ADB, enabling the app (if not already enabled by the carrier), and changing one of the two settings above. This really is nothing to worry about. If you disagree, do please feel free to do some analysis of the software yourself so we can discuss this based on the facts.
- strcat 2y ago
  The Verizon packages are only enabled when using a Verizon / Verizon MVNO SIM. They're equivalent to uninstalled when not using one. This is a requirement from Verizon for all Android devices to fully use their network features. GrapheneOS has always omitted these apps and therefore is missing certain features like Wi-Fi calling on Verizon which work fine on T-Mobile and other carriers internationally. Aside from the packages not being enabled without a Verizon SIM, this retail demo app iVerify/Palantir claim is a serious vulnerability has the extra layer of being disabled unless it's manually set up. The access needed to set it up or especially to enable the package in the first place is already very invasive. They're also trying to portray it as if Google unnecessarily or accidentally included this without knowing what it is but that's really not the case. Verizon was using this for actual demos in their stores and required OEMs to install it to have Verizon selling their phones. Pixels made sure the packages were completely disabled along with the other Verizon apps when not using Verizon and then it's also disabled even when using them. Issues in these apps are an overall Verizon Android problem, not Pixel specific, and hardly something which was overlooked on Pixels. They know it's unfortunate that these apps are needed and have gradually gotten rid of the need for most carrier app. Verizon is the only significant holdout. One carrier in the whole world has this problem. The retail demo app is hardly part of the issue. Turned out Verizon doesn't actually use it anymore so Google removed it in Android 15 which can be seen from the Android 15 Beta releases that are available. It appears entirely correct that Google deemed this was not even a Low severity vulnerability. Android 15 will probably be released in September where the app is gone. Incredibly strange that this got portrayed as a serious issue when it's not really relevant to anyone. Meanwhile, tons of serious vulnerabilities get fixed in both Android and iOS on a regular basis. Non-Pixel Android devices don't ship Low/Moderate severity patches for the most part until the next yearly release since they skip monthly/quarterly releases and only apply High/Critical severity backports. They've got a lot of other weaknesses compared to Pixels too. iPhones and Pixels with the stock OS are both still getting exploited by Cellebrite Premium with no sign of stopping it for more than a couple months at a time after certain updates: https://grapheneos.social/@GrapheneOS/112826067364945164 https://grapheneos.social/@GrapheneOS/112826067364945164 As a bonus, there was a whole inaccurate news cycle about that too recently with the same publications falsely claiming Cellebrite couldn't exploit the latest iOS based on leaked docs from April 2024. They simply fell a bit behind after a release as often happens and had already caught up BEFORE the news cycle. We posted the new July 2024 docs as the news cycle was still propagating. Now they're onto their next fake story, and they'll simply move on to the next and the next without ever correcting or retracting all the false claims. Even the New York Times and Washington Post published this fake Showcase story promoting iVerify/Palantir.
  - anvilspoke 2y ago
    Thank you for sharing all this extra information and context, in this comment and the others. It's been refreshing to read through the GrapheneOS threads on this and see some actual evidence-based discussion.
    - strcat 2y ago
      We had to go through each of these apps years ago to figure out what we would be missing from excluding them. We knew Showcase was disabled at another layer and we're very aware of the CarrierSettings system for distributing APN and other carrier configuration data since we had to make our own implementation: https://github.com/GrapheneOS/platform_packages_apps_CarrierConfig2 https://github.com/GrapheneOS/platform_packages_apps_Carrier... This is where we mark Showcase as omitted for current era GrapheneOS, but it was never included: https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8a0f6e6c5fdfeafd0f6d910f1/config/device/common/file-removal.yml#L318 https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8... Here's the part of the main non-MVNO Verizon carrier configuration where it enables these packages: https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8a0f6e6c5fdfeafd0f6d910f1/vendor-skels/google_devices/akita/proprietary/product/etc/CarrierSettings/verizon_us.textproto#L405-L419 https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8... It's also in the MVNO configuration. We update these carrier configurations via an adevtool command we made for fetching them from the relevant Google Play API similar to their CarrierSettings app and include those in GrapheneOS instead of just using the ones extracted from the latest Pixel stock OS, so this less delay than checking it in the stock OS factory images since it's fully up-to-date as of the last time we ran the tool which we do at least monthly after the new AOSP / stock Pixel OS release. The packages being disabled is nearly the same as them being uninstalled and installed on demand, meaning the overall set of apps is only actually a real world attack surface for Verizon / Verizon MVNO users. On GrapheneOS, since we expand verified boot, apps like this having privileges granted them enabled/installed adds some trusted persistent state we don't want to have but that's not relevant to the stock OS which has a narrower goal for verified boot and doesn't get impacted by this. We do various things to reduce trust in persistent state but this is still far from something with real world relevance, it just has a theoretical relevance if it was included on GrapheneOS which it never has been.
- strcat 2y ago
  Search for the app id (com.customermobile.preload.vzw) and you'll see people have been looking at it for years including figuring out what conditions were required to enable it even without the package disabled. GrapheneOS has repeatedly publicly talked about these apps including in threads where the CEO of Trail of Bits (which founded iVerify and was closely involved in this) was active. Incredibly strange marketing stunt which has destroyed their credibility for a lot of people, particularly with them doubling down on it and attacking people debunking it.
TheDong 2y ago
Why is it there? Hanlon's razor, incompetence. What if a border guard has access to your _unlocked phone_ and can re-anable an app? It would be easier for the border guard to instead "adb install government-spyware-app.apk" than to enable some weird third-party app that they don't even control the management servers to. If your threat model includes an adversary having access to your unlocked device, the least of your problems are apps like this.
- strcat 2y ago
  It's there on Pixels with the stock OS and other devices with Verizon support because it's one of the apps that are part of the standard suite for fully supporting Verizon's network. Verizon doesn't do things in standard ways so functionality like Wi-Fi calling is missing without these apps. It's not at all Pixel specific. Verizon included it with these apps because they used it for demos in their stores. They don't use it anymore, so Pixels removed it in Android 15 as their response to this. That's public as part of the Android 15 Beta. No actual security impact was found from this so they didn't consider it a security issue but removed it anyway. The other Verizon apps which actually get used are still there, but only active when you have an active Verizon SIM. They're essentially uninstalled (packages fully disabled) when not using a Verizon SIM. It's extra attack surface for Android Verizon users in general. Retail demo app part of it isn't actual attack surface, so this whole news cycle is bogus. The other apps are extra attack surface, but they're useful and needed for proper Verizon support because they refuse to be normal. ADB shell gives far more access than this app has so it doesn't matter as a physical attack vector for someone with the password.
strcat 2y ago
The Verizon apps are disabled (equivalent to uninstalled) unless you have a Verizon SIM. If you do have a Verizon SIM, this app's functionality is still disabled unless the demo mode is enabled, implying having largely equivalent or greater access to what it provides.

anvilspoke 2y ago

It doesn't do anything though. The "store_demo_mode" and "verizonwireless_store_demo_mode" settings are not set by default, and there doesn't appear to be any way to set these through the UI. Also, according to other comments, the app is disabled by default. From examining the CarrierSettings app, this does indeed appear to be the case. It seems to require a certain carrier configuration to enable it. Anyone who wants to enable the functionality of this app would have to go to some effort to do so, including enabling the Developer Settings - which requires the user's PIN, password or pattern - and then connecting to the device over ADB, enabling the app (if not already enabled by the carrier), and changing one of the two settings above. This really is nothing to worry about. If you disagree, do please feel free to do some analysis of the software yourself so we can discuss this based on the facts.

strcat 2y ago
The Verizon packages are only enabled when using a Verizon / Verizon MVNO SIM. They're equivalent to uninstalled when not using one. This is a requirement from Verizon for all Android devices to fully use their network features. GrapheneOS has always omitted these apps and therefore is missing certain features like Wi-Fi calling on Verizon which work fine on T-Mobile and other carriers internationally. Aside from the packages not being enabled without a Verizon SIM, this retail demo app iVerify/Palantir claim is a serious vulnerability has the extra layer of being disabled unless it's manually set up. The access needed to set it up or especially to enable the package in the first place is already very invasive. They're also trying to portray it as if Google unnecessarily or accidentally included this without knowing what it is but that's really not the case. Verizon was using this for actual demos in their stores and required OEMs to install it to have Verizon selling their phones. Pixels made sure the packages were completely disabled along with the other Verizon apps when not using Verizon and then it's also disabled even when using them. Issues in these apps are an overall Verizon Android problem, not Pixel specific, and hardly something which was overlooked on Pixels. They know it's unfortunate that these apps are needed and have gradually gotten rid of the need for most carrier app. Verizon is the only significant holdout. One carrier in the whole world has this problem. The retail demo app is hardly part of the issue. Turned out Verizon doesn't actually use it anymore so Google removed it in Android 15 which can be seen from the Android 15 Beta releases that are available. It appears entirely correct that Google deemed this was not even a Low severity vulnerability. Android 15 will probably be released in September where the app is gone. Incredibly strange that this got portrayed as a serious issue when it's not really relevant to anyone. Meanwhile, tons of serious vulnerabilities get fixed in both Android and iOS on a regular basis. Non-Pixel Android devices don't ship Low/Moderate severity patches for the most part until the next yearly release since they skip monthly/quarterly releases and only apply High/Critical severity backports. They've got a lot of other weaknesses compared to Pixels too. iPhones and Pixels with the stock OS are both still getting exploited by Cellebrite Premium with no sign of stopping it for more than a couple months at a time after certain updates: https://grapheneos.social/@GrapheneOS/112826067364945164 https://grapheneos.social/@GrapheneOS/112826067364945164 As a bonus, there was a whole inaccurate news cycle about that too recently with the same publications falsely claiming Cellebrite couldn't exploit the latest iOS based on leaked docs from April 2024. They simply fell a bit behind after a release as often happens and had already caught up BEFORE the news cycle. We posted the new July 2024 docs as the news cycle was still propagating. Now they're onto their next fake story, and they'll simply move on to the next and the next without ever correcting or retracting all the false claims. Even the New York Times and Washington Post published this fake Showcase story promoting iVerify/Palantir.
- anvilspoke 2y ago
  Thank you for sharing all this extra information and context, in this comment and the others. It's been refreshing to read through the GrapheneOS threads on this and see some actual evidence-based discussion.
  - strcat 2y ago
    We had to go through each of these apps years ago to figure out what we would be missing from excluding them. We knew Showcase was disabled at another layer and we're very aware of the CarrierSettings system for distributing APN and other carrier configuration data since we had to make our own implementation: https://github.com/GrapheneOS/platform_packages_apps_CarrierConfig2 https://github.com/GrapheneOS/platform_packages_apps_Carrier... This is where we mark Showcase as omitted for current era GrapheneOS, but it was never included: https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8a0f6e6c5fdfeafd0f6d910f1/config/device/common/file-removal.yml#L318 https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8... Here's the part of the main non-MVNO Verizon carrier configuration where it enables these packages: https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8a0f6e6c5fdfeafd0f6d910f1/vendor-skels/google_devices/akita/proprietary/product/etc/CarrierSettings/verizon_us.textproto#L405-L419 https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8... It's also in the MVNO configuration. We update these carrier configurations via an adevtool command we made for fetching them from the relevant Google Play API similar to their CarrierSettings app and include those in GrapheneOS instead of just using the ones extracted from the latest Pixel stock OS, so this less delay than checking it in the stock OS factory images since it's fully up-to-date as of the last time we ran the tool which we do at least monthly after the new AOSP / stock Pixel OS release. The packages being disabled is nearly the same as them being uninstalled and installed on demand, meaning the overall set of apps is only actually a real world attack surface for Verizon / Verizon MVNO users. On GrapheneOS, since we expand verified boot, apps like this having privileges granted them enabled/installed adds some trusted persistent state we don't want to have but that's not relevant to the stock OS which has a narrower goal for verified boot and doesn't get impacted by this. We do various things to reduce trust in persistent state but this is still far from something with real world relevance, it just has a theoretical relevance if it was included on GrapheneOS which it never has been.
strcat 2y ago
Search for the app id (com.customermobile.preload.vzw) and you'll see people have been looking at it for years including figuring out what conditions were required to enable it even without the package disabled. GrapheneOS has repeatedly publicly talked about these apps including in threads where the CEO of Trail of Bits (which founded iVerify and was closely involved in this) was active. Incredibly strange marketing stunt which has destroyed their credibility for a lot of people, particularly with them doubling down on it and attacking people debunking it.

TheDong 2y ago

Why is it there? Hanlon's razor, incompetence. What if a border guard has access to your _unlocked phone_ and can re-anable an app? It would be easier for the border guard to instead "adb install government-spyware-app.apk" than to enable some weird third-party app that they don't even control the management servers to. If your threat model includes an adversary having access to your unlocked device, the least of your problems are apps like this.

strcat 2y ago
It's there on Pixels with the stock OS and other devices with Verizon support because it's one of the apps that are part of the standard suite for fully supporting Verizon's network. Verizon doesn't do things in standard ways so functionality like Wi-Fi calling is missing without these apps. It's not at all Pixel specific. Verizon included it with these apps because they used it for demos in their stores. They don't use it anymore, so Pixels removed it in Android 15 as their response to this. That's public as part of the Android 15 Beta. No actual security impact was found from this so they didn't consider it a security issue but removed it anyway. The other Verizon apps which actually get used are still there, but only active when you have an active Verizon SIM. They're essentially uninstalled (packages fully disabled) when not using a Verizon SIM. It's extra attack surface for Android Verizon users in general. Retail demo app part of it isn't actual attack surface, so this whole news cycle is bogus. The other apps are extra attack surface, but they're useful and needed for proper Verizon support because they refuse to be normal. ADB shell gives far more access than this app has so it doesn't matter as a physical attack vector for someone with the password.

strcat 2y ago

The Verizon apps are disabled (equivalent to uninstalled) unless you have a Verizon SIM. If you do have a Verizon SIM, this app's functionality is still disabled unless the demo mode is enabled, implying having largely equivalent or greater access to what it provides.