#GrapheneOS releases significant new security enhancement, USB-C Port Security
#cybersecgirl #privacy #security
🔥 Hello again, new #GrapheneOS Update 2024022600. This time we have a new security feature that's been worked on for a while: USB-C Port Security. This is a significant security enhancement.
This feature allows users of Tensor Pixels (6 and later) to have fine grained controls on USB controller functionality including totally disabling data lines or the port when the OS is in use.
There are 5 modes:
- On (current)
- Charging-only when locked except in BFU (before first-unlock)
- Charging-only when locked
- Charging-only
- Off (which even disables charging while booted into the normal OS mode).
This is different from the previous existing USB control features including the Android 12 USB HAL toggle which only disable high-level kernel functionality which still left all the low-level kernel driver, USB protocol and USB controller attack surface enabled.
Other changelogs:
- kernel (5.10, 5.15): add support for ignoring USB alt modes
- kernel (Tensor Pixels): extend max77759 USB-C controller driver used by Tensor Pixels with support for a sysfs node providing fine-grained control over the USB-C data path at the USB controller level
- Setup Wizard: fix crash for SIM locales not recognized by com.android.internal.app.LocalePicker
https://grapheneos.org/releases#2024022600
#GrapheneOS #Privacy #Security
Discussion
What mode would you recommend for the average person?
Charging-only when locked with BFU exception will be the potential default. If you don't use accessories when BFU then Charging-only when locked works, if you don't use accessories at all then Charging-only is best.
If any USB port usage by someone is unacceptable like in a threat with physical access, then Off is best. This makes the phone only charge when you power off. Hopefully forces them to go to BFU state.