5 ms·

>no data can be exfiltrated. Well, that depends on the other apps you have installed. Unless things have changed in newer versions, apps with no networking can

>no data can be exfiltrated. Well, that depends on the other apps you have installed. Unless things have changed in newer versions, apps with no networking can still do IPC, so any app can for example use Cronet to make network requests via Google Play Services, regardless of the toggle, as long as sandboxed Google Play Services has network permission.

Cider9986 3mo ago
Agreed.
subscribed 3mo ago
Yep, nothing has changed yet. GOS project still has this in the road map, but as of now Inter Profile Sharing still works.
gf000 3mo ago
Good point and thanks for the heads up. Mostly asking it as a question, given that graphene runs Google play services (optionally) as a normal, sandboxed service with no special permissions might help a bit, but I guess unless you disable networking for every other service installed, this is sort of impossible to plug 100%? IPC can be quite the security hole.
- lucb1e 3mo ago
  Only if the other services provide a network proxy right? You'd need to find an exploit in the app otherwise. Edit: although, I just remembered that it's actually as simple as sending "open this URL" intents to the Android equivalent of sensible-browser, which everyone will have installed. That does rely on users not understanding or caring about what's happening or it only works for the first user
  - gf000 3mo ago
    Yeah, there are endless holes unfortunately with IPC. It has been hardened by more recent android versions https://developer.android.com/guide/topics/manifest/queries-element https://developer.android.com/guide/topics/manifest/queries-... but even something like "share via Chat app" can be used to leak information, e.g. it will have the link preview loaded".
- a022311 3mo ago
  Yes IPC is definitely a security hole, but because the two apps communicating need to both explicitly support it (I really doubt there'd be an exploitable vulnerability here of all places), it's a much smaller concern. Here I'd mainly worry about apps like Google Photos talking to Google Play Services. GrapheneOS has mentioned they'd like to implement IPC scopes to isolate apps, just like contact scopes and storage scopes.
ignoramous 3mo ago
> so any app can for example use Cronet to make network requests via Google Play Services Cronet? Isn't that Chromium's networking library? How's that letting apps connect via Google Play Services?

Cider9986 3mo ago

Agreed.

subscribed 3mo ago

Yep, nothing has changed yet. GOS project still has this in the road map, but as of now Inter Profile Sharing still works.

gf000 3mo ago

Good point and thanks for the heads up. Mostly asking it as a question, given that graphene runs Google play services (optionally) as a normal, sandboxed service with no special permissions might help a bit, but I guess unless you disable networking for every other service installed, this is sort of impossible to plug 100%? IPC can be quite the security hole.

lucb1e 3mo ago
Only if the other services provide a network proxy right? You'd need to find an exploit in the app otherwise. Edit: although, I just remembered that it's actually as simple as sending "open this URL" intents to the Android equivalent of sensible-browser, which everyone will have installed. That does rely on users not understanding or caring about what's happening or it only works for the first user
- gf000 3mo ago
  Yeah, there are endless holes unfortunately with IPC. It has been hardened by more recent android versions https://developer.android.com/guide/topics/manifest/queries-element https://developer.android.com/guide/topics/manifest/queries-... but even something like "share via Chat app" can be used to leak information, e.g. it will have the link preview loaded".
a022311 3mo ago
Yes IPC is definitely a security hole, but because the two apps communicating need to both explicitly support it (I really doubt there'd be an exploitable vulnerability here of all places), it's a much smaller concern. Here I'd mainly worry about apps like Google Photos talking to Google Play Services. GrapheneOS has mentioned they'd like to implement IPC scopes to isolate apps, just like contact scopes and storage scopes.

ignoramous 3mo ago

> so any app can for example use Cronet to make network requests via Google Play Services Cronet? Isn't that Chromium's networking library? How's that letting apps connect via Google Play Services?