4 ms·

It doesn't do anything though. The "store_demo_mode" and "verizonwireless_store_demo_mode" settings are not set by default, and there doesn't appear to be any w

It doesn't do anything though. The "store_demo_mode" and "verizonwireless_store_demo_mode" settings are not set by default, and there doesn't appear to be any way to set these through the UI. Also, according to other comments, the app is disabled by default. From examining the CarrierSettings app, this does indeed appear to be the case. It seems to require a certain carrier configuration to enable it. Anyone who wants to enable the functionality of this app would have to go to some effort to do so, including enabling the Developer Settings - which requires the user's PIN, password or pattern - and then connecting to the device over ADB, enabling the app (if not already enabled by the carrier), and changing one of the two settings above. This really is nothing to worry about. If you disagree, do please feel free to do some analysis of the software yourself so we can discuss this based on the facts.

strcat 2y ago
The Verizon packages are only enabled when using a Verizon / Verizon MVNO SIM. They're equivalent to uninstalled when not using one. This is a requirement from Verizon for all Android devices to fully use their network features. GrapheneOS has always omitted these apps and therefore is missing certain features like Wi-Fi calling on Verizon which work fine on T-Mobile and other carriers internationally. Aside from the packages not being enabled without a Verizon SIM, this retail demo app iVerify/Palantir claim is a serious vulnerability has the extra layer of being disabled unless it's manually set up. The access needed to set it up or especially to enable the package in the first place is already very invasive. They're also trying to portray it as if Google unnecessarily or accidentally included this without knowing what it is but that's really not the case. Verizon was using this for actual demos in their stores and required OEMs to install it to have Verizon selling their phones. Pixels made sure the packages were completely disabled along with the other Verizon apps when not using Verizon and then it's also disabled even when using them. Issues in these apps are an overall Verizon Android problem, not Pixel specific, and hardly something which was overlooked on Pixels. They know it's unfortunate that these apps are needed and have gradually gotten rid of the need for most carrier app. Verizon is the only significant holdout. One carrier in the whole world has this problem. The retail demo app is hardly part of the issue. Turned out Verizon doesn't actually use it anymore so Google removed it in Android 15 which can be seen from the Android 15 Beta releases that are available. It appears entirely correct that Google deemed this was not even a Low severity vulnerability. Android 15 will probably be released in September where the app is gone. Incredibly strange that this got portrayed as a serious issue when it's not really relevant to anyone. Meanwhile, tons of serious vulnerabilities get fixed in both Android and iOS on a regular basis. Non-Pixel Android devices don't ship Low/Moderate severity patches for the most part until the next yearly release since they skip monthly/quarterly releases and only apply High/Critical severity backports. They've got a lot of other weaknesses compared to Pixels too. iPhones and Pixels with the stock OS are both still getting exploited by Cellebrite Premium with no sign of stopping it for more than a couple months at a time after certain updates: https://grapheneos.social/@GrapheneOS/112826067364945164 https://grapheneos.social/@GrapheneOS/112826067364945164 As a bonus, there was a whole inaccurate news cycle about that too recently with the same publications falsely claiming Cellebrite couldn't exploit the latest iOS based on leaked docs from April 2024. They simply fell a bit behind after a release as often happens and had already caught up BEFORE the news cycle. We posted the new July 2024 docs as the news cycle was still propagating. Now they're onto their next fake story, and they'll simply move on to the next and the next without ever correcting or retracting all the false claims. Even the New York Times and Washington Post published this fake Showcase story promoting iVerify/Palantir.
- anvilspoke 2y ago
  Thank you for sharing all this extra information and context, in this comment and the others. It's been refreshing to read through the GrapheneOS threads on this and see some actual evidence-based discussion.
  - strcat 2y ago
    We had to go through each of these apps years ago to figure out what we would be missing from excluding them. We knew Showcase was disabled at another layer and we're very aware of the CarrierSettings system for distributing APN and other carrier configuration data since we had to make our own implementation: https://github.com/GrapheneOS/platform_packages_apps_CarrierConfig2 https://github.com/GrapheneOS/platform_packages_apps_Carrier... This is where we mark Showcase as omitted for current era GrapheneOS, but it was never included: https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8a0f6e6c5fdfeafd0f6d910f1/config/device/common/file-removal.yml#L318 https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8... Here's the part of the main non-MVNO Verizon carrier configuration where it enables these packages: https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8a0f6e6c5fdfeafd0f6d910f1/vendor-skels/google_devices/akita/proprietary/product/etc/CarrierSettings/verizon_us.textproto#L405-L419 https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8... It's also in the MVNO configuration. We update these carrier configurations via an adevtool command we made for fetching them from the relevant Google Play API similar to their CarrierSettings app and include those in GrapheneOS instead of just using the ones extracted from the latest Pixel stock OS, so this less delay than checking it in the stock OS factory images since it's fully up-to-date as of the last time we ran the tool which we do at least monthly after the new AOSP / stock Pixel OS release. The packages being disabled is nearly the same as them being uninstalled and installed on demand, meaning the overall set of apps is only actually a real world attack surface for Verizon / Verizon MVNO users. On GrapheneOS, since we expand verified boot, apps like this having privileges granted them enabled/installed adds some trusted persistent state we don't want to have but that's not relevant to the stock OS which has a narrower goal for verified boot and doesn't get impacted by this. We do various things to reduce trust in persistent state but this is still far from something with real world relevance, it just has a theoretical relevance if it was included on GrapheneOS which it never has been.
strcat 2y ago
Search for the app id (com.customermobile.preload.vzw) and you'll see people have been looking at it for years including figuring out what conditions were required to enable it even without the package disabled. GrapheneOS has repeatedly publicly talked about these apps including in threads where the CEO of Trail of Bits (which founded iVerify and was closely involved in this) was active. Incredibly strange marketing stunt which has destroyed their credibility for a lot of people, particularly with them doubling down on it and attacking people debunking it.

strcat 2y ago

The Verizon packages are only enabled when using a Verizon / Verizon MVNO SIM. They're equivalent to uninstalled when not using one. This is a requirement from Verizon for all Android devices to fully use their network features. GrapheneOS has always omitted these apps and therefore is missing certain features like Wi-Fi calling on Verizon which work fine on T-Mobile and other carriers internationally. Aside from the packages not being enabled without a Verizon SIM, this retail demo app iVerify/Palantir claim is a serious vulnerability has the extra layer of being disabled unless it's manually set up. The access needed to set it up or especially to enable the package in the first place is already very invasive. They're also trying to portray it as if Google unnecessarily or accidentally included this without knowing what it is but that's really not the case. Verizon was using this for actual demos in their stores and required OEMs to install it to have Verizon selling their phones. Pixels made sure the packages were completely disabled along with the other Verizon apps when not using Verizon and then it's also disabled even when using them. Issues in these apps are an overall Verizon Android problem, not Pixel specific, and hardly something which was overlooked on Pixels. They know it's unfortunate that these apps are needed and have gradually gotten rid of the need for most carrier app. Verizon is the only significant holdout. One carrier in the whole world has this problem. The retail demo app is hardly part of the issue. Turned out Verizon doesn't actually use it anymore so Google removed it in Android 15 which can be seen from the Android 15 Beta releases that are available. It appears entirely correct that Google deemed this was not even a Low severity vulnerability. Android 15 will probably be released in September where the app is gone. Incredibly strange that this got portrayed as a serious issue when it's not really relevant to anyone. Meanwhile, tons of serious vulnerabilities get fixed in both Android and iOS on a regular basis. Non-Pixel Android devices don't ship Low/Moderate severity patches for the most part until the next yearly release since they skip monthly/quarterly releases and only apply High/Critical severity backports. They've got a lot of other weaknesses compared to Pixels too. iPhones and Pixels with the stock OS are both still getting exploited by Cellebrite Premium with no sign of stopping it for more than a couple months at a time after certain updates: https://grapheneos.social/@GrapheneOS/112826067364945164 https://grapheneos.social/@GrapheneOS/112826067364945164 As a bonus, there was a whole inaccurate news cycle about that too recently with the same publications falsely claiming Cellebrite couldn't exploit the latest iOS based on leaked docs from April 2024. They simply fell a bit behind after a release as often happens and had already caught up BEFORE the news cycle. We posted the new July 2024 docs as the news cycle was still propagating. Now they're onto their next fake story, and they'll simply move on to the next and the next without ever correcting or retracting all the false claims. Even the New York Times and Washington Post published this fake Showcase story promoting iVerify/Palantir.

anvilspoke 2y ago
Thank you for sharing all this extra information and context, in this comment and the others. It's been refreshing to read through the GrapheneOS threads on this and see some actual evidence-based discussion.
- strcat 2y ago
  We had to go through each of these apps years ago to figure out what we would be missing from excluding them. We knew Showcase was disabled at another layer and we're very aware of the CarrierSettings system for distributing APN and other carrier configuration data since we had to make our own implementation: https://github.com/GrapheneOS/platform_packages_apps_CarrierConfig2 https://github.com/GrapheneOS/platform_packages_apps_Carrier... This is where we mark Showcase as omitted for current era GrapheneOS, but it was never included: https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8a0f6e6c5fdfeafd0f6d910f1/config/device/common/file-removal.yml#L318 https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8... Here's the part of the main non-MVNO Verizon carrier configuration where it enables these packages: https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8a0f6e6c5fdfeafd0f6d910f1/vendor-skels/google_devices/akita/proprietary/product/etc/CarrierSettings/verizon_us.textproto#L405-L419 https://github.com/GrapheneOS/adevtool/blob/0957926ce747e2d8... It's also in the MVNO configuration. We update these carrier configurations via an adevtool command we made for fetching them from the relevant Google Play API similar to their CarrierSettings app and include those in GrapheneOS instead of just using the ones extracted from the latest Pixel stock OS, so this less delay than checking it in the stock OS factory images since it's fully up-to-date as of the last time we ran the tool which we do at least monthly after the new AOSP / stock Pixel OS release. The packages being disabled is nearly the same as them being uninstalled and installed on demand, meaning the overall set of apps is only actually a real world attack surface for Verizon / Verizon MVNO users. On GrapheneOS, since we expand verified boot, apps like this having privileges granted them enabled/installed adds some trusted persistent state we don't want to have but that's not relevant to the stock OS which has a narrower goal for verified boot and doesn't get impacted by this. We do various things to reduce trust in persistent state but this is still far from something with real world relevance, it just has a theoretical relevance if it was included on GrapheneOS which it never has been.

strcat 2y ago

Search for the app id (com.customermobile.preload.vzw) and you'll see people have been looking at it for years including figuring out what conditions were required to enable it even without the package disabled. GrapheneOS has repeatedly publicly talked about these apps including in threads where the CEO of Trail of Bits (which founded iVerify and was closely involved in this) was active. Incredibly strange marketing stunt which has destroyed their credibility for a lot of people, particularly with them doubling down on it and attacking people debunking it.