The delivery service Grubhub said a hacker stole personal data and partial payment card information from customers through a third-party contractor.
In a statement published on Monday evening, the company said it recently identified a security incident that “originated with an account belonging to a third-party service provider that provided support services to Grubhub.”
The information stolen includes names, email addresses, phone numbers, card types and the last four digits of card numbers. The hackers also stole hashed passwords for some legacy systems used by Grubhub.
The company did not respond to requests for comment about how many people were affected, when the incident happened and who was behind the attack.
“We recently detected unusual activity within our environment traced to a third-party service provider for our Support Team. Upon discovery, we promptly launched an investigation, identifying unauthorized access to an account associated with this provider. We immediately terminated the account’s access and removed the service provider from our systems altogether,” the company said.
“The unauthorized individual accessed contact information of campus diners, as well as diners, merchants and drivers who interacted with our customer care service.”
It is unclear what campus Grubhub is referring to. The company runs a service specifically for college students on campuses around the U.S.
The company said it “took immediate action” to contain the attack and worked with experts to investigate the incident. Grubhub added that it is “confident that the incident has been fully contained.” They have rotated any passwords that may have been leaked, according to the statement.
The company claimed it has taken several other steps to secure its systems but did not elaborate on what measures have been instituted.
Grubhub is one of the world’s most popular food delivery apps, with more than 375,000 merchants serving over 4,000 U.S. cities. In November, Grubhub was sold by its Dutch owner to a company named Wonder for $650 million.
The company recently paid a $25 million penalty to settle charges from the Federal Trade Commission that it hid the cost of delivery from some customers, deceived workers about how much they would make from deliveries and listed restaurants without their permission as a pressure tactic.
The settlement was originally for $140 million but it was partially suspended because Grubhub could not pay the full amount.
Several other food delivery platforms have dealt with cyberattacks involving customer information, including Asian and Hispanic grocery service Weee!, PurFoods and others.
Cybersecurity researchers have discovered an improved version of an Apple iOS spyware called LightSpy that not only expands on its functionality, but also incorporates destructive capabilities to prevent the compromised device from booting up.
“While the iOS implant delivery method closely mirrors that of the macOS version, the post-exploitation and privilege escalation stages differ significantly due to platform differences,” ThreatFabric said in an analysis published this week.
LightSpy, first documented in 2020 as targeting users in Hong Kong, is a modular implant that employs a plugin-based architecture to augment its capabilities and allow it to capture a wide range of sensitive information from an infected device.
Attack chains distributing the malware leverage known security flaws in Apple iOS and macOS to trigger a WebKit exploit that drops a file with the extension “.PNG,” but is actually a Mach-O binary responsible for retrieving next-stage payloads from a remote server by abusing a memory corruption flaw tracked as CVE-2020-3837.
This includes a component dubbed FrameworkLoader that, in turn, downloads LightSpy’s Core module and its assorted plugins, which have gone up significantly from 12 to 28 in the latest version (7.9.0).
“After the Core starts up, it will perform an Internet connectivity check using Baidu.com domain, and then it will check the arguments that were passed from FrameworkLoader as the [command-and-control] data and working directory,” the Dutch security company said.
“Using the working directory path /var/containers/Bundle/AppleAppLit/, the Core will create subfolders for logs, database, and exfiltrated data.”
The plugins can capture a wide range of data, including Wi-Fi network information, screenshots, location, iCloud Keychain, sound recordings, photos, browser history, contacts, call history, and SMS messages, as well as gather information from apps like Files, LINE, Mail Master, Telegram, Tencent QQ, WeChat, and WhatsApp.
Some of the newly added plugins also boast destructive features that can delete media files, SMS messages, Wi-Fi network configuration profiles, contacts, and browser history, and even freeze the device and prevent it from starting again. Furthermore, LightSpy plugins can generate fake push notifications containing a specific URL.
The exact distribution vehicle for the spyware is unclear, although it’s believed to be orchestrated via watering hole attacks. The campaigns have not been attributed to a known threat actor or group to date.
Some of the newly added plugins also boast destructive features that can delete media files, SMS messages, Wi-Fi network configuration profiles, contacts, and browser history, and even freeze the device and prevent it from starting again. Furthermore, LightSpy plugins can generate fake push notifications containing a specific URL.
The exact distribution vehicle for the spyware is unclear, although it’s believed to be orchestrated via watering hole attacks. The campaigns have not been attributed to a known threat actor or group to date.
INTERPOL has announced the arrest of eight individuals in Côte d’Ivoire and Nigeria as part of a crackdown on phishing scams and romance cyber fraud.
Dubbed Operation Contender 2.0, the initiative is designed to tackle cyber-enabled crimes in West Africa, the agency said.
One such threat involved a large-scale phishing scam targeting Swiss citizens that resulted in financial losses to the tune of more than $1.4 million.
The cybercriminals posed as buyers on small advertising websites and used QR codes to direct victims to fraudulent websites that mimicked a legitimate payment platform.
This allowed victims to inadvertently enter personal information such as their credentials or card numbers. The perpetrators also impersonated the unnamed platform’s customer service agents over the phone to further deceive them.
As many as 260 scam reports are said to have been received by Swiss authorities between August 2023 and April 2024, prompting a collaborative investigation that traced the roots of the campaign to Côte d’Ivoire.
The main suspect behind the attacks confessed to the scheme and making illicit financial gains of over $1.9 million. Five other individuals conducting cybercriminal activities at the same location have also been arrested.
In a separate case, authorities said they apprehended a suspect and their accomplice in Nigeria on April 27, 2024, in connection with a romance scam after Finnish authorities alerted the Nigerian Police Force via INTERPOL that a victim was scammed out of a “substantial amount of money.”
Such financial grooming crimes entail scammers creating fake online identities on dating apps and social media platforms to develop romantic or close relationships with prospective victims, only to steal money from them.
“Leveraging the increased reliance on technology in every aspect of our daily lives, cybercriminals are employing a range of techniques to steal data and execute fraudulent activities,” Neal Jetton, Director of the Cybercrime Directorate, said.
“These recent successful collaborations, under the umbrella of Operation Contender 2.0, demonstrate the importance of continued international cooperation in combating cybercrime and bringing perpetrators to justice.”
The development comes as the U.S. Department of Justice (DoJ) said a 45-year-old dual citizen of Nigeria and the United Kingdom, Oludayo Kolawole John Adeagbo, has been sentenced to seven years in prison for his role in a multimillion-dollar business email compromise (BEC) scheme.
Adeagbo “conspired with others to participate in multiple cyber-enabled BEC schemes that defrauded a North Carolina university of more than $1.9 million, and attempted to steal more than $3 million from victim entities in Texas, including local government entities, construction companies, and a Houston-area college,” the DoJ said.
It also follows an announcement from Meta that it’s teaming up with U.K. banks to combat scams on its platforms as part of an information-sharing partnership program dubbed Fraud Intelligence Reciprocal Exchange (FIRE).
Ticketmaster, a subsidiary of Live Nation, suffered a data breach, which may impact millions of customers.
Live Nation confirmed in a regulatory filing with the U.S. Securities and Exchange Commission (SEC) on Friday that its subsidiary Ticketmaster has suffered a data breach.
The filing stated that on May 20, the company noticed “unauthorized activity” within a database that contained “Company data” and subsequently “launched an investigation with industry-leading forensic investigators to understand what happened.” The filing went on to describe that on May 27, a “criminal threat actor” offered to sell, what it alleged to be, Ticketmaster data on “the dark web.”
What do we know about the Ticketmaster data breach and the force behind it?
Hackread reported on May 28 that the hacking group named ShinyHunters had claimed responsibility for the cyber-attack on the online forum BreachForums, a hacking website used to facilitate data breaches and the sharing of said data. In the post, the hacking group reportedly states it is seeking $500,000 for the 1.3TB database of compromised customer data, which it claims includes names, addresses, phone numbers, and credit card details of 560 million users.
Live Nation’s regulatory filing does not state how many of its Ticketmaster users’ data has been compromised by the hack, nor does it confirm if ShinyHunters is the culprit.
TIME has reached out to Live Nation and Ticketmaster for comment and further information.
In the filing, Live Nation stated it was “working to mitigate risk to [their] users” and was cooperating with law enforcement officials. They went on to say that in their investigation, the breach was unlikely to make “a material impact on our overall business operations or on our financial condition or results of operations.”
What can Ticketmaster customers do to protect themselves?
In the aftermath of this breach, Ticketmaster users can protect themselves by staying vigilant against phishing attempts, monitor accounts and credit cards, and change passwords, using strong and unique alternatives.
Live Nation and Ticketmaster have yet to release a public statement addressing the breach, but on Ticketmaster’s website blog in April, ahead of the data hack, they provided general advice on how to protect information and tickets. They advised users to make sure to get contact information only from Ticketmaster’s official website and to be aware of fake customer service phone numbers that could appear in search engines.
Ticketmaster’s data breach comes at a trying time
Ticketmaster specifically dominates the market for live events in the United States—so much so that on May 23, the U.S. Department of Justice (DOJ) sued Live Nation and Ticketmaster, accusing them of running an “illegal monopoly” over live events in America—destroying competition and driving up prices for fans.
Per the complaint, in 2022 “Ticketmaster accounted for at least 70% of the total face value associated with all tickets sold at large arenas and amphitheaters.” In stark contrast, “no other rival ticketed more than 14%.”
In the DOJ lawsuit, Live Nation is accused of multiple tactics, including using long-term contracts to keep venues from choosing rival ticketers, blocking venues from using multiple ticket sellers, and threatening venues that they could lose money and fans if they didn’t choose Ticketmaster.
What do we know about ShinyHunters?
The hacking group claiming responsibility, ShinyHunters, is well known for its data hacking of multiple companies in 2020 and 2021, including the Indonesian e-commerce site Tokopedia, the Indian education platform Unacademy, Wattpad, AT&T Wireless, and Microsoft. In January, one member of the ShinyHunters hacking group—a French citizen named Sebastien Raoult—was arrested and sentenced in U.S. District Court in Seattle to three years in prison.
In a statement following the arrest, the Justice Department said that between April 2020 and July 2021, ShinyHunters posted sales of hacked data from more than 60 companies, and that they stole hundreds of millions of customer records and caused loss to victim companies that is estimated to exceed $6 million.
Have I Been Pwned has added the information for 26,818,266 people whose data was leaked in a recent hack of The Post Millennial conservative news website.
The Post Millennial is a conservative Canadian online news magazine belonging to the Human Events Media Group, which also operates the American ‘Human Events’ news platform.
Earlier this month, both news platforms were hacked, with their sites’ front pages defaced with fake messages claiming to be written by The Post Millennial’s editor, Andy Ngo.
As part of the attacks, the threat actors claim to have stolen the company’s mailing lists, subscriber database, and details of the company’s writers and editors, sharing links to the stolen data shared on the defaced pages.
The data quickly spread online, being shared in torrents and hacking forums, allowing threat actors and others to download the data easily.
The exposed data during the Post Millennial hack includes the following types of information:
Full Names
Email addresses
Usernames
Account Passwords
IP addresses
Phone numbers
Physical addresses
Genders
This data allegedly belongs to writers, editors, and subscribers to the sites, which could create significant privacy and security risks to the exposed individuals.
Yesterday, Troy Hunt added the data to the Have I Been Pwned data breach notification service, noting that the data has not been confirmed to have been stolen directly from Human Events or The Post Millennial.
As the leaked data is for a considerable number of users, Hunt decided to add it to HIBP to alert those potentially exposed.
“The breach resulted in the defacement of the website and links posted to 3 different corpuses of data including hundreds of writers and editors (IP, physical address, and email exposed), tens of thousands of subscribers to the site (name, email, username, phone and plain text password exposed), and tens of millions of email addresses from several thousand mailing lists alleged to have been used by The Post Millennial (this has not been independently verified),” reads HIBP’s post.
“The mailing lists appear to be sourced from various campaigns not necessarily run by The Post Millennial and contain a variety of different personal attributes including name, phone and physical address (depending on the campaign).”
As tweeted by Troy Hunt, while the data was leaked as part of The Post Millennial defacement, it is unclear where it originated from.
By the time of writing this, The Post Millennial has not issued a public statement regarding the site’s defacement or to warn its subscribers that data may have been exposed.
BleepingComputer has contacted both The Post Millennial and Human Events for a comment but has not received a reply.
In the meantime, reset your passwords and monitor account activity closely if you are a subscriber to the mentioned news outlets. Also, treat all communications (email, call, SMS) with vigilance.
Search giant Google on Friday released an out-of-band security update to fix a new actively exploited zero-day flaw in its Chrome web browser.
The high-severity flaw, tracked as CVE-2022-4262, concerns a type confusion bug in the V8 JavaScript engine. Clement Lecigne of Google’s Threat Analysis Group (TAG) has been credited with reporting the issue on November 29, 2022.
Type confusion vulnerabilities could be weaponized by threat actors to perform out-of-bounds memory access, or lead to a crash and arbitrary code execution.
According to the NIST’s National Vulnerability Database, the flaw permits a “remote attacker to potentially exploit heap corruption via a crafted HTML page.”
Google acknowledged active exploitation of the vulnerability but stopped short of sharing additional specifics to prevent further abuse.
CVE-2022-4262 is the fourth actively exploited type confusion flaw in Chrome that Google has addressed since the start of the year. It’s also the ninth zero-day flaw attackers have exploited in the wild in 2022 –
Users are recommended to upgrade to version 108.0.5359.94 for macOS and Linux and 108.0.5359.94/.95 for Windows to mitigate potential threats.
Users of Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi are also advised to apply the fixes as and when they become available.
The new ‘AXLocker’ ransomware family is not only encrypting victims’ files and demanding a ransom payment but also stealing the Discord accounts of infected users.
When a user logs into Discord with their credentials, the platform sends back a user authentication token saved on the computer. This token can then be used to log in as the user or to issue API requests that retrieve information about the associated account.
Threat actors commonly attempt to steal these tokens because they enable them to take over accounts or, even worse, abuse them for further malicious attacks.
As Discord has become the community of choice for NFT platforms and cryptocurrency groups, stealing a moderator token or other verified community member could allow threat actors to conduct scams and steal funds.
AxLocker is a two-in-one threat
Researchers at Cyble recently analyzed a sample of the new AXLocker ransomware and discovered that it not only encrypts files but also steals a victim’s Discord tokens.
As ransomware, there is nothing particularly sophisticated about the malware or the threat actors who use it.
When executed, the ransomware will target certain file extensions and exclude specific folders, as shown in the image below.
Targeted files (left) and excluded directories (right)(Cyble)
When encrypting a file, AXLocker uses the AES algorithm, but it does not append a filename extension on the encrypted files, so they appear with their normal names.
Next, AXLocker sends a victim ID, system details, data stored in browsers, and Discord tokens to the threat actors’ Discord channel using a webhook URL.
To steal the Discord token, AxLocker will scan the following directories for and extract tokens using regular expressions:
Eventually, victims are served a pop-up window containing the ransom note, informing them that their data was encrypted and how they contact the threat actor to purchase a decryptor.
Victims are given 48 hours to contact the attackers with their victim ID, but the ransom amount isn’t mentioned in the note.
AXLocker ransom note(Cyble)
While this ransomware clearly targets consumers rather than the enterprise, it could still pose a significant threat to large communities.
Therefore, if you find that AxLocker encrypted your computer, you should immediately change your Discord password, as it will invalidate the token stolen by the ransomware.
While this may not help recover your files, it will prevent further compromise of your accounts, data, and the communities you are involved in.
Security researchers analyzed nine popular WiFi routers and found a total of 226 potential vulnerabilities in them, even when running the latest firmware.
The tested routers are made by Asus, AVM, D-Link, Netgear, Edimax, TP-Link, Synology, and Linksys, and are used by millions of people.
The front-runners in terms of the number of vulnerabilities are the TP-Link Archer AX6000, having 32 flaws, and the Synology RT-2600ac, which has 30 security bugs.
Researchers at IoT Inspector carried out the security tests in collaboration with CHIP magazine, focusing on models used mainly by small firms and home users.
“For Chip’s router evaluation, vendors provided them with current models, which were upgrade to the latest firmware version,” Florian Lukavsky, CTO & Founder at IoT Inspector, told BleepingComputer via email.
“The firmware versions were automatically analyzed by IoT Inspector and checked for more than 5,000 CVEs and other security issues.”
Their findings showed that many of the routers were still vulnerable to publicly disclosed vulnerabilities, even when using the latest firmware, as illustrated in the table below.
Router models and flaws categorized as per their severity Source: CHIP Left column translated by BleepingComputer
While not all flaws carried the same risk, the team found some common problems that affected most of the tested models:
Outdated Linux kernel in the firmware
Outdated multimedia and VPN functions
Over-reliance on older versions of BusyBox
Use of weak default passwords like “admin”
Presence of hardcoded credentials in plain text form
Jan Wendenburg, the CEO of IoT Inspector, noted that one of the most important ways of securing a router is to change the default password when you first configure the device.
“Changing passwords on first use and enabling the automatic update function must be standard practice on all IoT devices, whether the device is used at home or in a corporate network.” explained Wendenburg.
“The greatest danger, besides vulnerabilities introduced by manufacturers, is using an IoT device according to the motto ‘plug, play and forget’.”
The researchers didn’t publish many technical details about their findings, except for one case concerning the extraction of the encryption key for D-Link router firmware images.
The team found a way to gain local privileges on a D-Link DIR-X1560 and get shell access via the physical UART debug interface.
Next, they dumped the whole filesystem using built-in BusyBox commands and then located the binary responsible for the decryption routine.
By analyzing the corresponding variables and functions, the researchers eventually extracted the AES key used for the firmware encryption.
Deriving the AES key on CyberChef Source: IoT Inspector
Using that key, a threat actor can send malicious firmware image updates to pass verification checks on the device, potentially planting malware on the router.
Such problems can be solved with full-disk encryption that secures locally stored images, but this practice is not common.
Manufacturers responded quickly
All of the affected manufacturers responded to the researchers’ findings and released firmware patches.
CHIP’s author Jörg Geiger commented that the router vendors addressed most of the security flaws identified by the working group, but not all of them.
The researchers have told Bleeping Computer that the unpatched flaws are mostly lower importance vulnerabilities. However, they clarified that no follow-up tests were done to confirm that the security updates fixed the reported issues.
The vendor responses to CHIP (translated) were the following:
Asus: Asus examined every single point of the analysis and presented us with a detailed answer. Asus has patched the outdated BusyBox version, and there are also updates for “curl” and the web server. The pointed out that password problems were temp files that the process removes when it is terminated. They do not pose a risk.
D-Link: D-Link thanked us briefly for the information and published a firmware update that fixes the problems mentioned.
Edimax: Edimax doesn’t seem to have invested too much time in checking the problems, but at the end there was a firmware update that fixed some of the gaps.
Linksys: Linksys has taken a position on all issues classified as “high” and “medium”. Default passwords will be avoided in the future; there is a firmware update for the remaining problems.
Netgear: At Netgear they worked hard and took a close look at all problems. Netgear sees some of the “high” issues as less of a problem. There are updates for DNSmasq and iPerf, other reported problems should be observed first.
Synology: Synology is addressing the issues we mentioned with a major update to the Linux kernel. BusyBox and PHP will be updated to new versions and Synology will soon be cleaning up the certificates. Incidentally, not only the routers benefit from this, but also other Synology devices.
TP-Link: With updates from BusyBox, CURL and DNSmasq, TP-Link eliminates many problems. There is no new kernel, but they plan more than 50 fixes for the operating system
If you are using any of the models mentioned in the report, you are advised to apply the available security updates, enable “automatic updates”, and change the default password to one that is unique and strong.
Additionally, you should disable remote access, UPnP (Universal Plug and Play), and the WPS (WiFi Protected Setup) functions if you’re not actively using them.
Bleeping Computer has contacted all of the affected manufacturers requesting a comment on the above, and we will update this piece as soon as we receive their response.
Security researchers discovered that attackers are also deploying a Linux backdoor on compromised e-commerce servers after injecting a credit card skimmer into online shops’ websites.
The PHP-coded web skimmer (a script designed to steal and exfiltrate customers’ payment and personal info) is added and camouflaged as a .JPG image file in the /app/design/frontend/ folder.
The attackers use this script to download and inject fake payment forms on checkout pages displayed to customers by the hacked online shop.
“We found that the attacker started with automated eCommerce attack probes, testing for dozens of weaknesses in common online store platforms,” the Sansec Threat Research Team revealed.
“After a day and a half, the attacker found a file upload vulnerability in one of the store’s plugins. S/he then uploaded a webshell and modified the server code to intercept customer data.”
Linux malware undetected by security software
The Golang-based malware, spotted by Dutch cyber-security company Sansec on the same server, was downloaded and executed on breached servers as a linux_avp executable.
Once launched, it immediately removes itself from the disk and camouflages itself as a “ps -ef” process that would be used to get a list of currently-running processes.
While analyzing the linux_avp backdoor, Sansec found that it waits for commands from a Beijing server hosted on Alibaba’s network.
They also discovered that the malware would gain persistence by adding a new crontab entry that would redownload the malicious payload from its command-and-control server and reinstall the backdoor if detected and removed or the server restarts.
The uploader might be the linux_avp creator since it was submitted one day after researchers at Dutch cyber-security company Sansec spotted it while investigating the e-commerce site breach.
We’ve come a long way from the Internet of the 90s and early 00s. Not just in terms of technology, capabilities, and culture, but in the attitude most of us take when accessing the ‘net. In those early days most users had a militant drive to keep any personal or identifying information to themselves beyond the occasional (and often completely fictional) a/s/l, and before eBay and Amazon normalized online shopping it was unheard of to even type in a credit card number. On today’s internet we do all of these things with reckless abandon, and to make matters worse most of us carry around a device which not only holds all of our personal information but also reports everything about us, from our browsing habits to our locations, back to databases to be stored indefinitely.
It was always known that both popular mobile operating systems for these devices, iOS and Android, “phone home” or report data about us back to various servers. But just how much the operating systems themselves did was largely a matter of speculation, especially for Apple devices which are doing things that only Apple can really know for sure. While Apple keeps their mysteries to themselves and thus can’t be fully trusted, Android is much more open which paradoxically makes it easier for companies (and malicious users) to spy on users but also makes it easier for those users to secure their privacy on their own. Thanks to this recent privacy report on several different flavors of Android (PDF warning) we know a little bit more on specifically what the system apps are doing, what information they’re gathering and where they’re sending it, and exactly which versions of Android are best for those of us who take privacy seriously.
THE REAL RESEARCH CONFIRMS SUSPICIONS
The report takes a look at six different “flavors” of Android and what each one is doing behind the scenes. The researchers studied operating systems from Samsung, Xiaomi, Huawei, and Realme which all also produce their own devices, but also looked at two alternative Android-based operating systems — LineageOS and /e/OS — that can be installed on some devices and customized for privacy if the user chooses. /e/OS is built with privacy in mind, while LineageOS is more of a drop-in replacement which doesn’t specifically focus on privacy. It should be no surprise that the four Android versions customized by the device manufacturers report a ton of user data, or that any device with a Google Apps (GApps) package reports a seemingly unending stream of user information back to Google servers, but some of the specific results that the research team found are definitely worth noting.
First, the paper points out that all of these companies are trivially able to link devices to users. Companies match IMEI numbers and other identifiers of devices to other user data that makes linking these accounts together a simple game of connect-the-dots. Largely the reason for doing this is to target ads, but all of these companies will also share this information indiscriminately with various governmental agencies. They also aren’t perfectly secure, so any black-hat attacker who gets access to this information will have it as well. This shouldn’t be too surprising, but the new information here is that researchers also found this data is shared among companies. For example, Samsung and Google seem to share each other’s data amongst themselves. Swiftkey, a popular keyboard app, also sends information to Microsoft via Google. It’s quite a complex web of data sharing and services from one company to support another’s data gathering efforts. Some of these data gathering efforts also include details such as timestamped app usage and personal contact gathering. While a lot of the information the operating systems are actually gathering is sometimes obfuscated, it’s clear that anything done on any of these devices might as well be recorded as if it was a Twitch stream as there’s evidence to suggest that literally everything could be monitored by someone (or some piece of software), right down to a user’s keystrokes.
The researchers contrast this rampant data gathering activity with /e/OS, a privacy-oriented version of Android. /e/OS is a fork of LineageOS which is specifically devoted to privacy, includes no Google-related software, and gathers essentially no user data on its own apart from information about available updates and some other necessary information. LineageOS is only marginally better than the Android offerings from the major manufacturers when the GApps package is installed with it, largely because the Google system apps are so pervasive at gathering user data. It is possible to use LineageOS without the GApps package but the researchers did not take this approach and largely focused on /e/OS as the de-Googled version of study.
While /e/OS is certainly an excellent choice for privacy-conscious users of smartphones, there are a few others worth mentioning that were not included in the study. Drawing the conclusion from this research that the real privacy violator is GApps (as long as you can avoid the other spyware from Samsung et. al.), it is possible to install LineageOS on a wider array of devices than /e/OS currently supports. Since installing GApps is something that is typically sideloaded after installing LineageOS and is an optional step, this can simply be omitted.
Additionally, if you absolutely can’t live without Google Maps or Gmail, there is a way of accessing Google services without actually installing them on your device. A software package called MicroG is available which is an open-source replacement for GApps and allows the user to access Google services that otherwise would be available but restricts tracking and gathering of user data by Google in key ways. There is a fork of LineageOS called “LineageOS for MicroG” which includes this package instead of GApps by default, although there have been squabbles between the maintainers of this project and LineageOS over concerns with the way that MicroG accesses the Google services by signature spoofing.
For those with Google Pixel devices specifically, there are two other privacy options. GrapheneOS is the Cadillac of privacy-focused versions of Android and has a number of improvements to enhance security as well, such as app sandboxing, implementation of secure/verified boot, disabling of peripherals via toggles, and other enhancements. CalyxOS is based on GrapheneOS and is similar but does allow for the use of MicroG and has some less-intense security practices than GrapheneOS. The only downsides with these flavors of Android is that they are built almost exclusively for the Google Pixel and at a minimum requires trust that Google didn’t build a hardware backdoor of some sort into their phones.
ANDROID ISN’T THE ONLY OPTION
There are a few other options for improving online privacy when using a smartphone. Linux-only phones such as the Pinephone are available but are not as fully-featured as Android. Some versions of Linux are also available for phones that would otherwise run Android. It’s also probable that an iPhone is a security and privacy improvement over a factory Android device from any major service carrier or device manufacturer, although the fact that their software is closed-source and behind a walled garden makes this extremely difficult to verify. Still, if a user isn’t willing to jump through all of these hoops to install /e/OS, GrapheneOS, or Ubuntu Touch, or if their phone has a locked bootloader making it impossible to flash a new OS (or if their device just isn’t supported), it’s preferable to choose an iPhone only if all other options are exhausted. Of course, the only other option is to not own a smartphone at all, which is arguably the easiest way of improving the privacy concerns with these devices.
The paper goes into great detail on methodology and also includes information on how they determined what data was being sent for those curious about specifics. It’s also worth noting that they point out that none of this research investigates any specific apps that might be installed on a phone and only looks at the operating system apps. If you install random freemium games, banking apps, or Facebook on your GrapheneOS install, for example, it’s likely to void any and all of your privacy efforts. The paper itself is worth a read though even for those who haven’t considered their online privacy before, even if they did grow up in the 90s.
