OnePlus engineering APK exposes backdoor to root access ars_ab.settitle(1204221)

OnePlus comes under scanner over the issue of users’ privacy

OnePlus likely kept Engineer Mode installed on the devices because it assumed it was secure and would remain unnoticed, given that the app is hidden behind a password.

This is not the first time that OnePlus has been accused of compromising privacy of its users.

Phone maker OnePlus is shipping devices with a diagnostics app that allows root superuser access to the smartphone, potentially exposing sensitive user data. The developer further added that he will publish an application for rooting OnePlus devices without unlocking.

Russian Federation posts videogame image as 'irrefutable proof' U.S. helps IS
A US Department of Defense spokesman said this incident was just the latest "episode" by the Russians. The images are consistent with a mix of screengrabs from a number of clearly identifiable videos .

Unfortunately, it seems someone at OnePlus forgot to remove or disable the package before kicking the handsets out to the general public, and as a result multiple users now have access to what is effectively a back door in their Android phones.

Still, the presence of the app brings into question OnePlus' security protocols. The developer also stated that deploying the "DiagEnabled" activity found in the APK with a specific password, it is possible to root the device. It is alarming how easily someone can get access to your smartphones in this day and age. It's used to run system tests for things like GPS, vibration, screen brightness, and also root checking. It's not something that could be achieved remotely, however, you would need the physical OnePlus device connected to a computer running the Android Debug Bridge (ADB) to exploit the vulnerability. But on the other hand, we do hope that OnePlus patches this as well, because it is provides a legitimate backdoor to OnePlus 3, 3T, and OnePlus 5 devices.

Thanks for the heads up, we're looking into it. OnePlus co-founder Carl Pei tweeted that the company will study the claims made by the developer, according to The Mobile Indian. And it looks to be an issue on the OnePlus 5T as well. He discovered that his OnePlus 2 device was sending data to an HTTPS domain, which was transmitted to Amazon Web Services and belongs to OnePlus (open.oneplus.net domain).

Related News:

  • FDA approves first 'trackable' pill Abilify

    FDA approves first 'trackable' pill Abilify

    Should prescribes take to Abilify MyCite, the new formulation could help Abilify's maker Otsuka Pharmaceutical Co. The technology in the sensors and the patch were developed by Proteus Digital Health .
    IEA: Global Crude Demand to Endure Wave of Electric Cars

    IEA: Global Crude Demand to Endure Wave of Electric Cars

    But analysts expect the price to not rise much further in coming months as the USA ramps up production. After an upbeat performance last week, oil prices edged lower for a second day Tuesday.
    Bill Gates Donates $50 Million To Alzheimer's Research

    Bill Gates Donates $50 Million To Alzheimer's Research

    He said, "It'll take probably 10 years before new theories are tried enough times to give them a high chance of success". Microsoft co-founder Bill Gates , speaks at the Bloomberg Global Business Forum in New York City, U.S., September 20.
  • Commission Head Claims Conor McGregor Has Been Pulled From UFC 219

    Commission Head Claims Conor McGregor Has Been Pulled From UFC 219

    In the monied and highly unequal world of the UFC, Dana White's word can not be taken as a byword for consistency. The 29-year-old is due to fight interim champion, Tony Ferguson, on his return to the octagon.
    Militant, Soldier Killed In South Kashmir Encounter

    Militant, Soldier Killed In South Kashmir Encounter

    The gunfights erupted in Kulgam and Pulwama districts, south of Srinagar city, the summer capital of Indian-controlled Kashmir. An official said that CASO was launched in Lam forests last night after "specific inputs" about the presence of militants.
    Rasgulla belongs to West Bengal, not Odisha

    Rasgulla belongs to West Bengal, not Odisha

    The GI tag was primarily developed with the goal of recognising the unique identity connecting different products and places. The Geographical Identification authorities ruled out today that it is Bengal where the popular rosogolla originated.
  • Emirates Partners With Mercedes-Benz & Jeremy Clarkson For New First Class Suites

    Emirates Partners With Mercedes-Benz & Jeremy Clarkson For New First Class Suites

    It operates services from Dubai to more than 140 cities on board its Boeing 777 planes across six continents. Long-haul carrier Emirates says it will buy 40 Boeing 787-10 Dreamliners in a deal worth some $15.1 billion.
    Thousands protest in Yemen against Saudi-led blockade

    Thousands protest in Yemen against Saudi-led blockade

    According to the UN's aid coordinator in Yemen, Jamie McGoldrick, there was no time to wait for a new inspection system to be set up.
    Softbank set to buy $10 billion stake of Uber

    Softbank set to buy $10 billion stake of Uber

    Crucially, Softbank expects to buy up others' Uber shares at a lower price than it will pay for its direct investment. Uber said Sunday that it agreed to move forward on a proposed investment from SoftBank Group .
  • Taylor Swift Plays 'New Year's Day' in Surprise Performance

    Gloria Fallon died "peacefully" on 4 November in hospital in NY . ". and I would squeeze I love you too", he adds. Jimmy Fallon paid tribute to his mom on Monday's show and there couldn't have been a dry eye in the studio.
    Allen County Public Health supports antibiotic awareness

    Allen County Public Health supports antibiotic awareness

    Taking antibiotics when they are not needed or worse, taking the wrong antibiotic reduces their effectiveness. Councillor Sweet added: "In addition, people take antibiotics for mild infections when they don't need to".

    Congressman Cohen Derails Sessions Russia Hearing To Ask About Weed

    Attorney General Jeff Sessions told lawmakers that the Department of Justice is investigating 27 leaks of classified information. Trump has repeatedly criticized his Justice Department for not aggressively probing a variety of conservative concerns.


Most liked

China to build 'shared future' with 'good friend' ASEAN, Chinese premier says
For one, China has steadfastly opposed what it calls U.S. meddling in the disputes and has balked at the U.S. Leaders from China, the United States and seven other nations are joining ASEAN at their annual summit.

British surfer fends off shark with a punch
Avoca and North Avoca beaches remained closed on Tuesday as authorities closely monitored the water for any sign of the shark. The 25-year-old man was taken to Gosford Hospital by his friends after he sustained scratches and a puncture wound.

US House to Adopt Mandatory Sexual Harassment Training for Members, Staffs
Congressional leaders said they are ready to order mandatory sexual harassment prevention training for all offices of the U.S. "They want the system fixed and the perpetrators held accountable", she said.

U.S. security officials arrive in Israel to discuss Syria agreement
Speaking to a special session of the Knesset on Monday, Netanyahu said he told Washington and Moscow that Israel will act according to its "security needs".

Sergio Aguero 'faints at half-time', taken to hospital during Argentina v Nigeria
Did extra work trying to curtain the Albiceleste forward line after the initial blitz that left them panicking. What time does the Argentina v Nigeria match start?

Hijab-wearing Barbie modelled on US Olympian Ibtihaj Muhammad
The doll will come with a full fencing uniforms, including a sabre and a mask. Ibtihaj Muhammad just announced that Barbie is making a doll in her likeness.

General Electric plans to slice quarterly dividend in half
The stock has a market capitalization of $177,777.73, a price-to-earnings ratio of 16.53, a PEG ratio of 2.15 and a beta of 1.11. Deutsche Bank believes credit analysts will downgrade General Electric's debt after the investor day's developments.

Australians say yes to marriage equality in historic vote
A young protester cheers in support during a march for marriage equality in Sydney . Australia has voted "Yes" to same-sex marriage.

Nintendo Close To A Deal On Super Mario Bros Movie
As Kotaku points out, the Wall Street Journal's reports on Nintendo's media haven't always been accurate. That means it will be several years before the movie is ready for release in theaters.

Mugabe's house sealed off by army
Political analysts however say the military stayed quiet then because the beneficiary of Mujuru's downfall was the 75-year-old Mnangagwa, a war veteran.

Rescue efforts end after deadly Iran quake
Rouhani landed by helicopter in the city of Kermanshah and promised the government would move swiftly to help those left homeless. Hospitals in nearby provinces took in numerous injured, state television said, airing footage of survivors waiting to be treated.

IPhone X iOS 11.1.1 gets jailbroken
MacRumors originally reported the news after a tip from accessory maker RAVpower . The Qi standard, now at v1.2, actually supports up to 15W being delivered.

Stalker sets Chennai woman, mother & sister on fire; woman dies
The woman, identified as Sindhuja, succumbed to the burns at the Kilpauk Medical College (KMC) Hospital (KMC) on Tuesday morning. Doctors at the KMC Hospital said Renuka and Nivedha suffered 49% and 23% burns repectively, mostly on their faces and hands.

At Least Three Dead, Students Wounded After Shooting At California School
Police fatally shot the attacker after reports of at least seven shooting scenes, including an elementary school, Johnston said. "Multiple students" have been airlifted from the scene according to Assistant Sheriff Phil Johnston, including a 6-year-old.

EgyptAir signs letter of intent for up to 24 Bombardier CS300s
Bombardier says that based on the list price of the CS300, a firm order for 12 aircraft would be valued at about $1.4 billion. Cromer said both sales had already being under negotiation and were not the result of the Airbus venture.