Security woes as backdoor in OnePlus devices is discovered, allows for easy gain of root access


A potentially dangerous backdoor in multiple OnePlus devices has been just unearthed by a knowing developer, revealing a hidden app that can be potentially used to gain root access and take control over the device.

Dubbed "EngineedMode", the app has been created by Qualcomm to most certainly test out hardware, but OnePlus has taken it to itself to tamper with the app, customize it, and preload it on a plethora of devices, including but not limited to the OnePlus 5, OnePlus 3, and OnePlus 3T. The app gives unprecedented access to a host of security-sensitive features of your phone, with the worst offender being the "all clear" command, which would erase all data on the phone, internal storage and all.

The exploit works on devices with locked bootloader, which further turns security concerns up to 11.

The most disturbing part is that @fs0c131y, the dev that discovered the backdoor, was capable of creating a simple root app for OnePlus devices that makes use of his findings and... even published it on the Google Play Store. Sorry

Now, on its own, this app can't do anything malicious; it's a powerful tool intended for device testing and maintenance. The scary part is that it's laughably easy to run it with a simple command as well as the fact OnePlus has purposefully included it in the software builds of its devices. A malicious app or malware that is built around this loophole would potentially be able to target OnePlus devices and wreck havoc.

@fs0c131y also suggests that many other Snapdragon-powered devices could have said Qualcomm-developed app preinstalled, which would be rather concerning taking the company's market share in regard. To check out if you have it, go to Settings > Apps, and look for Show system apps in any of the menus; search for EngineerMode in the app list. 

OnePlus' Carl Pei responded on Twitter that the issue is being looked into. One things is for certain though - not a good news for the company, which is expected to launch a new device, the OnePlus 5T, in two days' time.


source: @fs0c131y

FEATURED VIDEO

15 Comments

1. baldilocks

Posts: 1494; Member since: Dec 14, 2008

I'd bet that a lot of OEMs have the same "door".

2. sgodsell

Posts: 7215; Member since: Mar 16, 2013

What do you expect from a custom or forked version of Android called Oxygen OS, especially since it's directly from China?

3. Peacetoall unregistered

Literally this the reason chinese phone are so cheap is because they all spy on their users.

4. Chaise unregistered

Oxygen? lol that used to be name of a popular rom for the Nexus S way back. Chinese copying names of OS too?

6. worldpeace

Posts: 3129; Member since: Apr 15, 2016

OxygenOS is the name of oneplus UI since forever.. (they also have HydrogenOS)

10. jacky899

Posts: 430; Member since: May 16, 2017

This is no where as bad as Samsung embedding a FakeOFF mode that if activated, it makes the television appear to be off but keeps the power running so spies can capture audio and possibly video of anything in the room depending on the version of the Samsung television set. Imagine putting a Samsung TV in your bedroom. lol Since EngineerMode is a Qualcomm default feature, it is possilbe OnePlus simply just left it in and I'm sure they're not the only ones that do that. This news could be similar to all the fake news Samsung hired trolls were spreading right at HTC phone releases when HTC was still strong in the smartphone world but Samsung was later caught and fined in court. However samsung doesn't get much online criticism. But since oneplus is a non korean company, the droves of Samsung/LG nationalist monitoring the web will surely make a big deal out of it.

5. Soundjudgment

Posts: 370; Member since: Oct 10, 2016

Remember. It is not how well you can uncover a secret... it is how well you can *keep* that very secret from others.

7. NarutoKage14

Posts: 1318; Member since: Aug 31, 2016

It's well known that these back doors are most likely required by the Chinese government.

8. GdgetXpert1337

Posts: 117; Member since: Oct 31, 2017

No 1 safe on Androd, malwar evrywhere

9. Zylam

Posts: 1813; Member since: Oct 20, 2010

LOL how many times are these guys going to get caught with "back doors".

11. Boast_Rider

Posts: 535; Member since: Sep 14, 2017

This is not an oversight in software. This is intentional, which makes it all the more worse. OP3 will be the last Oneplus device I will ever own. Apple, here I come, or maybe Samsung.

12. KeyserSoze

Posts: 387; Member since: Oct 06, 2014

Oh sht, this backdoor spyware is a serious deal breaker. The 5T doesn't look so good to me anymore. This is just another confirmation that we shouldn't buy phones from these sleazy criminal Chinese azz holes. They've proved once again that they can't be trusted, that they are our dangerous enemy who is always trying to spy on us with intent to compromise our national security and do us serious harm.

13. pupkin

Posts: 145; Member since: Feb 04, 2015

Spyware they will not remove it but simply hide it somewhere else. That’s a prerequisite by yhe Chinese Government to let them Chinese company to continue to do these kind of business outside of their country. Keep that in mind. Not only in China but US too.

14. Rocket

Posts: 642; Member since: Feb 24, 2014

Well, I'm running LOS 14 on my OP5 and i dont have that app, thank god!

15. redmd

Posts: 1926; Member since: Oct 26, 2011

Just don't buy it then. Alternatives are plenty

Latest Stories

This copy is for your personal, non-commercial use only. You can order presentation-ready copies for distribution to your colleagues, clients or customers at https://www.parsintl.com/phonearena or use the Reprints & Permissions tool that appears at the bottom of each web page. Visit https://www.parsintl.com/ for samples and additional information.