GrapheneOS fixes massive flaws in Android's verified boot with big improvements

"GrapheneOS requires fs-verity for out-of-band system component updates since our previous release:

https://grapheneos.org/releases#2023012500

This is part of our ongoing verified boot improvements to fix massive flaws we've discovered in the standard Android verified boot which largely break it.

On Android, verified boot won't detect malicious updates to APK-based components. An attacker can do privileged persistence via fake APK-based component updates after exploiting the OS. They can't do this for APEX components but many APK-based components are quite privileged too.

Our …

android apex apk big boot detect exploiting fake fix fixes flaws malicious persistence privacy privileged release standard system updates verified