OnePlus includes Qualcomm engineering app in phones, exposes root backdoor

15 November, 2017, 01:57 | Author: Julian Harrison
  • OnePlus Left Behind a Testing App on Its Devices With Backdoor to Root Access Report

OnePlus, an electronics manufacturer based in China, has reportedly been shipping its line of popular smartphones with a hidden backdoor that could allow a hacker to hijack the device relatively effortlessly. They found that the application - used for factory testing - could be easily used to gain root access to phones.

While we don't see this as a major security issue, we understand that users may still have concerns and therefore we will remove the adb root function from EngineerMode in an upcoming OTA. But Elliot Alderson found that the tool could be exploited by hackers to gain root access to a device, essentially gaining backdoor access into it where they could then take over the phone.

The app provides users with root-level access to the phone without needing to unlock its bootloader, according to Engadget.

The backdoor is provided through an application called Engineer Mode that ships pre-installed on the devices. Once the app was decompiled, a password was still needed for the app so that it would give root access to devices. With root access, an attacker could change just about anything about the device's software. It has been found on the OnePlus 5, as well as the OnePlus 3 and 3T.




He was able to find a system app named EngineerMode that is actually a Qualcomm factory app with the ability to toggle components such as the charging chip, GPS, NFC and others - as this app shouldn't be included in consumer-side ROMs, it's a target app that malicious actors will want to crack into.

We've also we've reached out to OnePlus and will update this story when we receive comment. The company already drew criticism earlier this year over its onerous data collection practices, in which the company sucked up sensitive data from user devices and transmitted that information with each device's serial number attached.

The discoverer of the app had a problem.

Recommended:

  • Things You Need To Know About The 2019 Corvette ZR1

    Things You Need To Know About The 2019 Corvette ZR1

    MSRP has not been announced for the 2019 Chevrolet Corvette ZR1 , but it is expected to arrive in dealerships this spring. Buy or sell your exotic vehicle at duPontREGISTRY.com and check back with Autofluence.com for more supercar news.
    Hamlin eliminated from playoffs, Keselowski advances

    Hamlin eliminated from playoffs, Keselowski advances

    Keselowski advances to the final round at the expense of Denny Hamlin , who had the best auto throughout much of Sunday's race. The No. 24 didn't quite spin Hamlin out, but the No. 11 got into the wall enough to wreck on his own just a few laps later.
    Rupert Murdoch contacted AT&T CEO twice about buying CNN

    Rupert Murdoch contacted AT&T CEO twice about buying CNN

    However, according to the United States news site Wired, it's not clear whether the DoJ could successfully block the merger. AT&T's chairman and CEO Randall Stephenson said in a statement Wednesday that he wanted to "set the record straight".
  • Sessions: 'Always told the truth' regarding Russian Federation  contacts

    Sessions: 'Always told the truth' regarding Russian Federation contacts

    Page told the panel he had informed some members of the Trump campaign about the trip, including Sessions. Jim Jordan as he asked about the dossier.
    Ireland to reach fourth straight World cup finals

    Ireland to reach fourth straight World cup finals

    Northern Ireland coach Michael O'Neill said his team's exit after a spirited second-half Sunday was "a devastating moment". But over the two matches Switzerland dominated both possession and chances.
    Bank of India Q2 profit rises, beats estimates

    Bank of India Q2 profit rises, beats estimates

    On a postive note, the bank's asset quality improved on sequential basis post decline in fresh slippages in the second quarter. While announcing the result, SBI Chairman Rajnish Kumar said gross slippages for the quarter stood at Rs 10,627 crore.
  • GST Council eases filing norms till March 2018

    GST Council eases filing norms till March 2018

    Restaurants in hotels with rooms above Rs 7,500 per day would continue to pay 18 percent GST with the benefit of input credit. Friday's developments should hopefully be the start of making a fundamentally sound idea good in theory as well as practice.
    UCLA basketball players suspected of shoplifting in China confined to hotel

    UCLA basketball players suspected of shoplifting in China confined to hotel

    As he pushes his wife Tina Ball's wheelchair, he tells the reporter, "I'm going to wait until I get more intel on what's going on. Three UCLA basketball players can not leave their Chinese hotel after being arrested for allegedly shoplifting.
    US Special Counsel Reportedly Probing Plot To Hand Over Turkish Cleric Gulen

    US Special Counsel Reportedly Probing Plot To Hand Over Turkish Cleric Gulen

    The younger Flynn worked closely with his father at his lobbying firm, Flynn Intel Group. WASHINGTON, DC - MARCH 19: House Science, Space and Technology Committee member Rep.
  • Hawley subpoenas Google, says Missouri is not giving company a "free pass"

    Also of interest to Hawley's investigation is the roughly 70 percent of all card transaction information that Google collects. The company operates "in a highly competitive and dynamic environment", Patrick Lenihan said in an emailed statement.
    Redskins WR Maurice Harris makes circus TD grab against Vikings

    Redskins WR Maurice Harris makes circus TD grab against Vikings

    Latavius Murray also ran for a score as five players got into the end zone for Minnesota (7-2), which was 8 of 12 on third downs. Redskins: Visit the New Orleans Saints on Sunday in a game they now badly need to win given their upcoming schedule.
    Disneyland guests, 1 worker contracted Legionnaires' disease

    Disneyland guests, 1 worker contracted Legionnaires' disease

    Disneyland has shut down two cooling towers after people who visited the Anaheim theme park came down with Legionnaires' disease. Symptoms develop two to 10 days after exposure, the OCHCA said, and include fever, chills, cough, muscle aches, and headaches.


Popular

Researchers are claiming a cheap mask can fool iPhone X Face ID
Describing how all that was needed was half a face image to make the mask, the company says people can try it out for themself. Since the iPhone X went on sale on November 3 there have been numerous attempts to hack its Face ID system.

The Dream Chaser Spacecraft
The Dream Chaser is being developed to carry cargo to and from the International Space Station without a crew aboard. The company says it will release more information about the test Monday afternoon.

Broadcom after rejection: 'Fully committed' to Qualcomm buyout
The sources said Broadcom was preparing to submit a slate of directors by Qualcomm's December 8 nomination deadline. Last week, Broadcom made national news by offering Qualcomm $130 billion to acquire the company.

Woman marries mother, gets 10 years jail term
Patricia lost custody of Misty and her two other children when they were younger and didn't reconnect with them until 2014. Under Oklahoma law, marrying a close relative is considered incest whether or not a sexual relationship exists.

Messi explains Argentina rest
Argentina's victor came with just four minutes to play and the victory marks another important milestone for Jorge Sampaoli. He singled out Aguero for creating scoring opportunities despite a lack of space offered by Russia's defensive setup.

The Top 5 Heading Into The Weekend
And, to confirm your worst nightmares, the hero America deserves is healthy and suiting up under center for the Sooners. The 21-16 win against Duke moved Army to 8-2, the program's best record through 10 games since 1996.

New Injustice 2 DLC Characters Include Teenage Mutant Ninja Turtles
The reveal trailer does not show any gameplay sample yet, so it is hard to say how the action is with having all four characters. Leo, Michelangelo, Raphael and Donatello will be suiting up (shelling up?) to fight the likes of Superman, Batman and more.

United Kingdom construction output falls more than expected
Year-on-year, construction output rose 1.1%, short of the 2.2% forecast and down from a revised 3.9% rise for August. However, construction output fell by 1.6 per cent in the month.

Google's AirDrop-like Files Go returns to the Play Store
Google already includes a cleanup utility in their Google Photos app , but this is much broader in choices and functionality. Once you've given Files Go the required access permission, you will be guided through a few additional steps.

Congress demands petroleum products, real estate be brought under GST
Daring Rahul Gandhi to flag his criticism against Modi on demonetization, GST and terrorism in the Parliament, Yeddyurappa said the BJP will give a befitting reply to all such insinuations.