Friday, 17 November, 2017

OnePlus backdoor means hackers could take over your phone

OnePlus 3T OnePlus left a backdoor in its devices capable of root access
Kayla Schwartz | 14 November, 2017, 23:34

If you have a OnePlus phone, you may be interested - and a little disturbed - to learn that the company is preinstalling an app that acts as a backdoor to root access.

Earlier, according to a post on Christopher Moore's blog, OnePlus is collecting sensitive private data like IMEI numbers, mobile network names and IMSI prefixes, MAC addresses, and more. This app is used by OnePlus to ensure that a device is working properly before it leaves the factory. They are able to gain root if they have a password to bypass privilege escalation checks. The application is a diagnostics tool called "EngineerMode" that Qualcomm developed and distributes to OEMs like OnePlus so they can test the hardware components of a device. The user can access manual tests like root status test, Global Positioning System test or the main activity by sending a command. After bringing it to attention, security outfit NowSecure reverse engineered it and found that it could easily be exploited with a simple ADB command to enable a backdoor into devices that have the application installed.

If it's there, anyone with physical access to your device can exploit EngineerMode to gain root access on your smartphone. The application is present in all OnePlus devices including 3, 3T and 5.

Hot reads: Jerry Jones won't turn down heat on Goodell extension
On Tuesday, he implied that part of his issue is that Goodell isn't close enough to the end of his current deal. We've got all the time in the world to extend him.

The app can diagnose Global Positioning System, check the root status, perform a series of automated tests, and more. Of course, expecting the developers to unlock the bootloader for each device during its testing phases would be ridiculous, but its inclusion does pose security risks for everyday users.

OnePlus did not immediately respond to a request for comment. If it was overlooked, it is likely the upcoming 5T would have it also, which would necessitate removing the app before the device ships on November 16.

Recommended

  • Bill Gates plans smart city for Arizona

    Bill Gates plans smart city for Arizona

    Now an undeveloped patch of desert 45 minutes west of Phoenix, the future of Belmont might hinge on old-fashioned infrastructure. Several big players working on autonomous vehicles including Intel, Uber and Waymo are testing innovations in Arizona.
    USA  approves first pill with digital tracking device

    USA approves first pill with digital tracking device

    The Food and Drug Administration has approved the first drug that can digitally track whether patients have taken their medicine. The patch and sensor is manufactured by the company Proteus Digital Health and aripiprazole marketed by Otsuka Pharmaceutical.
    Black Friday and Cyber Monday

    Black Friday and Cyber Monday

    Before heading out to the mall or going online, it is helpful to make a list of what you need to buy and what you'd like to buy. To protect you on Black Friday, the BBB advises consumers to not believe all they see or hear without doing their own research.
  • Rebecca Corry wishes she'd confronted Louis CK on sexual conduct sooner

    Rebecca Corry wishes she'd confronted Louis CK on sexual conduct sooner

    In addition to Louis C.K. 2017, which was his Netflix special, Hilarious, Live at the Comedy Store, Live at the Beacon Theater and Chewed Up are all now on Netflix.
    EgyptAir Signs Deal With Bombardier

    EgyptAir Signs Deal With Bombardier

    It is the first order for the C Series since the surprise announcement in October that Airbus was taking a majority stake in the programme.
    Nintendo's Mario Brothers To Be Turned Into a Movie

    Nintendo's Mario Brothers To Be Turned Into a Movie

    It's important to note that a deal is not yet done, and both Nintendo and Universal have declined to comment. Super Mario is coming back to the big screen.
  • GameStop Temporarily Suspends Unlimited Used Games Power Pass Program

    GameStop Temporarily Suspends Unlimited Used Games Power Pass Program

    Along similar lines, Nintendo is set to launch a Netflix-like service for classic retro games on its Switch platform in 2018. When Kotaku reached out to GameStop about the suspension, the company said "program limitations" were largely to blame.
    It pays to flip off Trump's motorcade

    It pays to flip off Trump's motorcade

    However, unidentifiable, Ms Briskman herself posted the viral photo on her Facebook and Twitter profiles. She added: "Only one third of Puerto Rico has power".
    Android distribution numbers for November show nearly  no change for Oreo

    Android distribution numbers for November show nearly no change for Oreo

    With Android 8.1 Oreo, when a device is running low on space, an automatic cleanup process will tidy after these unused apps. If you haven't yet been able to tell, we're pretty sarcastic when writing our headlines for Android Distribution updates.
  • Federal Bureau of Investigation  data shows hate crimes appeared to drop in Wisconsin

    Federal Bureau of Investigation data shows hate crimes appeared to drop in Wisconsin

    There were two crimes motivated by a victim's religion and two by a victim's gender identity. The hate crimes recorded previous year included nine murders and 24 rapes, the report said.
    Three Killed in Tehama County School Shooting: Sheriff

    Three Killed in Tehama County School Shooting: Sheriff

    Johnston told local media at least three people are dead, but did not elaborate if any students were among the dead. Multiple shots were fired at about 8am local time at the Rancho Tehama School on the outskirts of Corning.
    Moon and Li agree to normalize bilateral ties

    Moon and Li agree to normalize bilateral ties

    President Donald Trump exchanged war-like threats and insults over the North's nuclear and missile development programme. Global leaders have begun arriving here in Manila, the Philippines for the 31st ASEAN-related summits.

Rand Paul: 'No Justification' For Neighbor's Attack Rand Paul: 'No Justification' For Neighbor's Attack Paul is expected to vote on administration confirmation hearings and the Republican tax reform bill this week. Paul said there will be a criminal prosecution in this case, and added that he is recovering as expected .

Texas Assistant District Attorney fired after rant aimed at Uber driver Texas Assistant District Attorney fired after rant aimed at Uber driver A prosecutor in Texas has been fired after an Uber driver said she hit him, belittled him and threatened him during a ride. He said she became upset when he tried to initiate small talk and grew angrier after she asked him to change directions.

Old £10 note to disappear next year Old £10 note to disappear next year The old paper £10 note will no longer be legal tender from 1 March 2018, the Bank of England has announced. But the old note can still be exchanged by the Bank after the cut-off date.

Rescue efforts end after deadly Iran quake Rescue efforts end after deadly Iran quake The worst damage appeared to be in the Kurdish town of Sarpol-e-Zahab in the western Iranian province of Kermanshah. Full-scale rescue operation could start only with the dawn, and yet unknown, are still people under the rubble.

Russian Federation posts video game screenshot as 'irrefutable evidence' of USA helping ISIS Russian Federation  posts video game screenshot as 'irrefutable evidence' of USA  helping ISIS The Russian military is investigating claims that a civilian employee attached the bogus images, state-run media reported later Tuesday.

Watford rebuff Everton approach for Marco Silva Watford rebuff Everton approach for Marco Silva Watford have issued a hands off warning to Everton , and will not entertain another approach for manager Marco Silva . Dyche, thought to be keen on talking to Everton, would cost £2.5 million in compensation.

Netanyahu says to continue military operation in Syria Netanyahu says to continue military operation in Syria Over the weekend IDF chief Gadi Eisenkot made an undeclared trip to Brussels to speak with the top USA general in Europe.

Man checks out with coins in Walmart; cashier's response goes viral Man checks out with coins in Walmart; cashier's response goes viral Check out the post below and tell us your thoughts! Bowlin ends the post with, "I want to be more like her (the cashier)". The photo and the story went viral, after being shared more than 20,000 times. "'This is not a problem, honey".

TJX's same-store sales flat in hurricane-hit third quarter If the $61.76 price target is reached, the company will be worth $3.42B less. (The) by 9.4% in the second quarter. Silvercrest Asset Management Group LLC boosted its stake in shares of The TJX Cos.by 0.9% in the first quarter.

Robbers dig tunnel to rob bank in Navi Mumbai Robbers dig tunnel to rob bank in Navi Mumbai The robbery is believed to have taken place at a branch of Bank of Baroda in the Juninagar area near Navi Mumbai early Sunday. When the customer and a bank officer entered the locker room, they found that 27 lockers had been looted.

Oil price drops more than US$1on IEA warning of shrinking demand Oil price drops more than US$1on IEA warning of shrinking demand While the US exported 100 billion cubic metres of Canadian gas in 2005, that figure fell by over a fifth in 2016. The U.S. shale surge could also mean an era of lower-for-longer oil prices.

Kim Kardashian Reads Kanye's Mean Tweets on Jimmy Kimmel Live Kim Kardashian Reads Kanye's Mean Tweets on Jimmy Kimmel Live Oh no that means you would have gotten too much good p***y in your life", wrote West in all-caps. "Neither is David Letterman ". But Kim Kardashian got way more personal, reciting a zinger that now-husband Kanye West fired at Kimmel during their 2013 feud.

Andhra Pradesh: Wild boar enters airport, hits IndiGo flight Andhra Pradesh: Wild boar enters airport, hits IndiGo flight But the pilot could not land the flight immediately, as the rear wheel was damaged in the run-in and failed to retract. The incident occurred at around 10 p.m. on Sunday when the wild boar ran into the flight path, hitting a rear wheel.

Zlatan slammed on social media following 'arrogant' tweet about Sweden Zlatan slammed on social media following 'arrogant' tweet about Sweden Another footballing giant has missed out on next summer's World Cup , and this time it is four-time world champions Italy. It was a huge ask of the Brazil-born player who had not previously played a competitive game for Italy.

Tyson Foods, Inc. (NASDAQ:TSN) To Report Earnings Tyson Foods, Inc. (NASDAQ:TSN) To Report Earnings TRADEMARK VIOLATION NOTICE: This piece of content was originally posted by Week Herald and is the sole property of of Week Herald. The company reported $1.43 earnings per share (EPS) for the quarter, topping the Zacks' consensus estimate of $1.19 by $0.24.