{"id":10478,"date":"2017-11-14T10:45:06","date_gmt":"2017-11-14T18:45:06","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/11\/14\/news-4251\/"},"modified":"2017-11-14T10:45:06","modified_gmt":"2017-11-14T18:45:06","slug":"news-4251","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/11\/14\/news-4251\/","title":{"rendered":"OnePlus Phones Were Shipped With a Hidden Backdoor"},"content":{"rendered":"

<\/p>\n

Credit to Author: Louise Matsakis| Date: Tue, 14 Nov 2017 18:07:52 +0000<\/strong><\/p>\n

OnePlus, a major Chinese smartphone manufacturer, has gotten itself into a hell of a lot of security trouble lately, and now the situation is only getting worse. <\/p>\n

Mobile security researcher Robert Baptiste, who goes by the pseudonym Elliot Alderson<\/a> (a nod to the main character<\/a> in the Mr. Robot series), discovered that OnePlus smartphones have been apparently shipping for years with a hidden backdoor. It makes it easy for a clever hacker with physical access to root a OnePlus phone with just a few lines of code.<\/p>\n

Alderson found an application on OnePlus devices intended for factory testing, and discovered it could be used to obtain \u201croot access\u201d to the phone. Rooting<\/a> an Android device allows a developer to essentially gain access to everything in the operating system, and permission to change anything about the device\u2019s software. <\/p>\n

The application the researcher found is called \u201cEngineer Mode.\u201d It\u2019s meant to be used while the smartphone is still in the factory, to test whether it\u2019s working properly. Engineer Mode was hidden behind a password, but Alderson along with researchers at app security firm NowSecure were able to quickly crack it<\/a>. The password is \u201cangela,\u201d which could ironically be another Mr. Robot reference<\/a>.<\/p>\n

Alderson believes that the vulnerability can only be exploited with physical access, at least for now. He said in a tweet<\/a> that it\u2019s \u201ctoo early to speak about a random app getting root access, but we are on the good tracks.\u201d<\/p>\n

It looks like the application was left on a number of devices, but it\u2019s not clear whether OnePlus did so intentionally, or whether it was an accident. Engineer Mode is on several different smartphones that OnePlus makes, including the OnePlus 3, OnePlus 3T, and the OnePlus 5, according to the blog Android Police<\/a>.<\/p>\n

\n