OnePlus plans to fix glaring smartphone security flaw allowing easy root access

OnePlus plans to fix glaring smartphone security flaw allowing easy root access

While we don't see this as a major security issue, we understand that users may still have concerns and therefore we will remove the adb root function from EngineerMode in an upcoming OTA. However, it also holds a backdoor which is capable of root access, even if the device has not been unlocked. While the root backdoor hasn't been verified in other devices yet, reports from Twitter indicate the APK was also found in Asus and Xiaomi devices.

The app and the subsequent backdoor access was discovered by Twitter user Elliott Alderson (a reference to the Mr. Robot character), who then went into a lot of detail about how to gain root access to the device.

According to one developer named as Elliot Alderson, OnePlus has an application called as "EngineerMode", which is basically used to check whether the unit is working properly or not in the factory. The developer further added that he will publish an application for rooting OnePlus devices without unlocking. The application is present in all OnePlus devices including 3, 3T and 5.

Entering the password into the EngineerMode app provides permanent root access to the Android Debug Bridge process. However, carrying out such an attack would require physical access to the device-the hacker would need to have the smartphone in hand to hijack Engineer Mode and start doing damage. Later, Pei confirmed in a blog post that OnePlus it will scale back on data collection on its devices.

More news: Israeli Patriot Missile Shoots Down Syrian UAV

While the vulnerability allows attackers to use the EngineerMode app to fully compromise devices, a mitigating factor is that local access to devices is needed - no remote exploit is available.

An apparent factory cockup has left many OnePlus Android smartphones with an exposed diagnostics tool that can be exploited to root the handsets.

The discoverer of the app had a problem.

Related Articles

  • Mass stabbing at Mall of America in Minnesota

    Mass stabbing at Mall of America in Minnesota

    Family members were apparently able to disarm the suspect and Bloomington police took the suspect into custody. Both of the stabbing victims, according to CBS News , suffered non-life-threatening injuries.
    Senegal is the third African nation to secure a ticket to Russian Federation

    Senegal is the third African nation to secure a ticket to Russian Federation

    Two places are still up for grabs after Nigeria and Egypt secured places last month, and now joined by Senegal. The visitors are now five points ahead of nearest Group D challengers Burkina Faso with one game remaining.

    Venus and Jupiter conjunction to be visible in dawn sky

    The planets, which orbit the sun about 416 million miles apart, will be just 17 arcminutes from each other when viewed from Earth. The two worlds will only be visible for a short time before sunrise and won't climb more than about 7 degrees above the horizon.
  • Trump Announces Next HHS Nominee, Dems Scrutinize His Former Employment

    President Trump nominated a pharmaceutical executive to be the next secretary of the Health and Human Services Department. He left Lilly in January 2017 and now consults and counsels with pharmaceutical and health insurance companies.
    Chevrolet Corvette ZR1 Unleashed

    Chevrolet Corvette ZR1 Unleashed

    The 2019 Chevrolet Corvette ZR1 isn't just the most powerful Corvette yet, but the most powerful General Motors vehicle ever made. The engine sits underneath what Chevrolet calls a "halo hood" which features a carbon fibre two-piece bonnet bulge.
    Iran Urges France to Make Regional Allies Opt for Rationality

    Iran Urges France to Make Regional Allies Opt for Rationality

    In his interview with the Time magazine, Macron also appeared to be supporting Washington's position on Iran's ballistic missile capabilities.
  • Congressman Cohen Derails Sessions Russia Hearing To Ask About Weed

    Clinton was being investigated for using a private email server during her time as secretary of state. In his testimony before Congress Tuesday, Sessions tried to account for this apparent discrepancy.
    Sweden and Italy gear up for World Cup playoff clash

    Sweden and Italy gear up for World Cup playoff clash

    He added: "We want to send Italians a message not with words, but with action on the pitch". It was the third-longest active streak behind Brazil (20) and Germany (16).
    Injustice 2 DLC will add The Teenage Mutant Ninja Turtles

    Injustice 2 DLC will add The Teenage Mutant Ninja Turtles

    Leo, Michelangelo, Raphael and Donatello will be suiting up (shelling up?) to fight the likes of Superman, Batman and more. Injustice 2 has been out for almost six months, and in that time, the game's roster of fighters has grown significantly.
  • GOP Senators Urge Moore to Quit Race If Report Is True

    GOP Senators Urge Moore to Quit Race If Report Is True

    Moore previously created controversy when he refused to order a Ten Commandments display to be taken down from a public building. He touched her over her bra and underpants, she says, and guided her hand to touch him over his underwear.
    Compromise found on Pacific trade without US

    Compromise found on Pacific trade without US

    The TPP aims to eliminate tariffs on industrial and farm products across a bloc whose trade totalled $356 billion a year ago . Staying away from the meeting wasn't a negotiating strategy, but it did yield results, the official claimed.
    Everson Griffen a surprise inactive for Vikings vs. Redskins

    Everson Griffen a surprise inactive for Vikings vs. Redskins

    Kai Forbath, though, kicked a 53-yard field goal with 7:45 left in the game to give the Vikings a safe 38-27 lead. I think the Vikings continue their winning ways and exact revenge on the Redskins for beating them last season.