GrapheneOS Organization Announces Progress On Duress PIN

https://grapheneos.social/@GrapheneOS/112481434513090992

The latest release of GrapheneOS adds the first piece of our ongoing work on duress/panic features. It makes standard factory resets including by device admin APIs wipe the device near instantly before it reboots to recovery to wipe and format it.

We made our own wipe-without-reboot but we’re backporting the Android 15 implementation instead of using ours. They made it in response to our vulnerability report about this (CVE-2024-29748):

https://grapheneos.social/@GrapheneOS/112204428984003954

Pixels added a firmware mitigation against it in April too.

The April release added 2 Pixel specific protections against the 2 vulnerabilities we reported, but both vulnerabilities essentially impact all Android devices and were only addressed for Pixels. The factory reset interruption also isn’t fully addressed until they ship this part.