12 ms·

Backdoor with root access found from OnePlus phones

317 points by hpaavola 9y ago

majewsky 9y ago
I just checked my OnePlus One and it doesn't have the "Engineering mode" app. Maybe because I'm on the original CyanogenOS; I didn't upgrade to Oxygen OS.
- hs86 9y ago
  Do you consider switching over to the community based LineageOS? They will continue to provide security updates for your phone and afair currently you are stuck with Android 6. Additionally, the upcoming release will bring Android 8 to your device: https://review.lineageos.org/#/q/branch:lineage-15.0+bacon https://review.lineageos.org/#/q/branch:lineage-15.0+bacon
  - darklajid 9y ago
    lineageos is awesome. Unfortunately the camera app is quite a bit worse in my opinion (used it on the OnePlus One, 3T and haven't tested it with my 5). Guess some things are more important at this point..
    - nocoder 9y ago
      I would like to use lineage OS but if I root my phone my work email will stop working. It is configured via Boxer app, is there a work around?
      - hs86 9y ago
        To gain root access you have to flash an optional zip file [0] after flashing LineageOS itself and the also optional OpenGapps [1]. If you don't do that, your Boxer app should pass these SafetyNet checks [2]. If you want both root and still full access to these SafetyNet-"protected" apps, you can try the alternative rooting solution Magisk [3] which specializes on bypassing these (imho arbitrary) restrictions. [0] https://download.lineageos.org/extras https://download.lineageos.org/extras [1] http://opengapps.org/ http://opengapps.org/ [2] https://www.lineageos.org/Safetynet/ https://www.lineageos.org/Safetynet/ [3] https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445 https://forum.xda-developers.com/apps/magisk/official-magisk...
      - gerty 9y ago
        My bank app refused to install on a rooted phone. I used Magisk Manager to work around that. I guess it could work in this case as well. There is a 'hide root' option (or something similar).
    - mino 9y ago
      I use OpenCamera on a oneplus X with lineageOS. The camera hardware is not great, and definitely far from the 2017 state of the art, but it works ok.
    - Tistron 9y ago
      Is there no way one can extract the oneplus camera app and install it on lineageos? I'm also going to finally switch now, but I don't understand why there isn't some clever hacker that has done this yet. Is is impossible?
  - Giroflex 9y ago
    Are there any serious known issues on LineageOS for the OP3, other than the camera being weaker?
  - DarronWyke 9y ago
    What are some things to be aware of when switching? I'm a 3T owner and I'm done with the OS (still love the hardware). Hesitant to simply flash new firmware onto it without knowing what I'm getting into.
- deleted 9y ago
  [deleted]
koevet 9y ago
More context here: http://www.androidpolice.com/2017/11/13/oneplus-left-backdoor-devices-capable-root-access/ http://www.androidpolice.com/2017/11/13/oneplus-left-backdoo...
RpFLCL 9y ago
I just checked and found it on my OnePlus Two. To other OP owners: make sure you look under "all" apps, not just "downloaded". After this finding , the data collection incident a month ago, and their last 1Gb+ OTA update that bootlooped my phone, I think I'm done with OnePlus products. I enjoyed the hardware but I can't tolerate this much malice/incompetence in software in something as critical to my daily life. I'm sure some posters will suggest that this is what we deserve for trusting a Chinese OEM, but I still find it all very sad. Steal data, brick devices, and leave backdoors: How to lose a customer in three easy steps.
- raverbashing 9y ago
  Not to mention the "phone crashes when calling 911" bug
  - differentView 9y ago
    Wasn't that a bug with other phones as well?
    - dopamean 9y ago
      Some version of this bug has cropped up on many phones on different carriers all around the world.
- ngcazz 9y ago
  Yup, done here too. Edit: EngineerMode is present on my OP3T with latest Oreo beta
- mino 9y ago
  > I enjoyed the hardware but Do like me, if you don't want to trash a OnePlus device: install LineageOS.
  - asfdsfggtfd 9y ago
    Do you trust there not to be lower level issues?
Phemist 9y ago
The "secret" password seems to be "angela". OnePlus == DarkArmy confirmed?
- parmesan 9y ago
  Ikr, why would you even insert a reference like that?
- porfirium 9y ago
  Isn't it "code"?
  - Phemist 9y ago
    "code" is the name of the intent extra. See: https://twitter.com/fs0c131y/status/930127615389851648 https://twitter.com/fs0c131y/status/930127615389851648 and: https://twitter.com/fs0c131y/status/930128095503441920 https://twitter.com/fs0c131y/status/930128095503441920
- vnchr 9y ago
  Probably fans of Angela Lansbury.
  - Double_a_92 9y ago
    Seems like a Mr.Robot reference to me.
- stiGGG 9y ago
  What? OnePlus == BND confirmed!
atomicnumber1 9y ago
I didn’t knew that engineer mode app could be used for such malice. I bet they didn’t either (btw I know that they should have been more vigilant about what goes into the consumer device). And this app is developed by Qualcomm. I just think that they forgot to remove from user builds (which btw is a bad sign).
- mondoshawan 9y ago
  After having worked in the bowels of Qualcomm's Android drops, I have to note that the amount of precompiled vendor binaries that get included was astounding. The worst part is that their tendrils hook in to major parts of the low level networking stacks in very bizarre ways. Removing them is often extremely difficult, and even simple things like removing APKs like this one often affect the stability of the system as a whole. I can't really fault 1+ for this debacle -- but this is what happens when OEMs just go along with using these inscrutable blobs of crapware from their upstream vendors. I only hope Librem can actually pull off their phone. Shipping something fully open in light of findings like this may help to turn the tide.
therealmarv 9y ago
It's not the first time a big security/privacy leak was found on OnePlus' phones. Would stay far away from OnePlus phones.
- shpx 9y ago
  I would stay away from proprietary software, especially if it was written in Russia or China. All of their tech companies owe their entire existence to their respective governments and it's not like the governments set up that environment for them for free.
  - stolho 9y ago
    Sure, and tech companies in USA are super trusted. And for sure no backdoors are found. Just one of the recent examples when author of Telegram was "contacted" by USA government during his visit to USA. If you really want to be honest - you should understand that every government is interesting in "access" to popular tech tools - laptops, phones, social networks, messengers and etc. And it will be really good also to check facts and not yellow press like CNN, BBC and etc and just bullshit Russia. Trust is a weakness... Never forget it :)
  - atomicnumber1 9y ago
    Yes. And NSA/GCHQ just doesn't involve itself with any tech companies in the U.S and EU respectively.
  - throw2016 9y ago
    What is IntelME or AMD PSP just for starters? This is completely untenable in the face of all the revelations starting with Snowden, nsl letters, secret processes and secret courts. No one will seriously claim the US tech industry has not benefited from the government. No point singling out specific governments, the NSA is not on your side.
  - ksk 9y ago
    >I would stay away from proprietary software, especially if it was written in Russia or China. Why? What have you found in proprietary software written in China and Russia?
laxentasken 9y ago
Found it on my Oneplus X. Maybe this is the time to try out Apple.
- jetpks 9y ago
  As a long time iPhone user that swings Android every few years to try the waters, I am consistently blown away at the level of garbage Android users are expected to deal with on a regular basis. Want to know how many times my iPhones have boot looped in the last nine years? Not once ever. My last Android (Nexus 6p) managed to do it several times in the 3-ish months I daily-drove it. Want to know how long you can expect to get iOS updates with a new hardware purchase? 5+ years. Compared with the very best case for Android: 2 maybe? How many times with an iPhone have I been expected to install a custom OS to get around a user-hostile feature like I saw about fifty times in the 1 billion outdated androids thread? Zero times. It’s unreal.
  - lostmsu 9y ago
    Anecdotally mine Androids never bootlooped (started with Dell Streak 5)
  - zeveb 9y ago
    > I am consistently blown away at the level of garbage Android users are expected to deal with on a regular basis. My girlfriend uses an iPhone; I am consistently blown away by the amount of garbage she's expected to deal with on a regular basis. When she changes to another app, our video chats go dark; there's no Termux or GNURoot equivalent (that I'm aware of); tapping doesn't move the cursor but instead selects words (I think that's it); the mail app is hellaciously bad; she's stuck using Safari and seeing ads. So, so many ads. Ads everywhere. I never see ads on my phone, but on hers the Internet is nothing but ads as far as the eye can see. The sad fact is that the mobile phone ecosystem in general is full of garbage. Neither Android nor iOS is exempt. But at least with Android I have freedom. > How many times with an iPhone have I been expected to install a custom OS to get around a user-hostile feature like I saw about fifty times in the 1 billion outdated androids thread? Zero times. That's because with an iPhone there are no custom OSes and you're stuck with Apple's user-hostile features.
mads 9y ago
Isn't the EngineerMode APK an MTK app? I have been involved in developing an Marshmallow MTK based phone in the past and in my experience their BSP's were pretty messy. I.e. a lot of cleaning up is necessary if you want a relatively quiet logcat and debugging APK's removed - even for user builds. Edit: I must have remembered wrong or I saw the EngineerMode on the QComm device we developed before our MTK based device. The OnePlus seems to be a QComm device.. :)
- milankragujevic 9y ago
  I have a shit Allwinner A33 tablet and it has SoftWinner APK AND EngineerMode APK. So idk maybe it's something shared for all Chinese devices...?
- brightsize 9y ago
  I have a Blu Studio Max (2017) with a MTK chipset. EngineerMode is installed and running.
- brightsize 9y ago
  Here we go (Blu Studio Max): adb shell am start -n com.mediatek.engineermode/.EngineerMode This is going to be a fun morning.
BuildTheRobots 9y ago
I have a onePlus 3 (which anecdotally has been a lovely handset, just extremely fragile. And onePlus and their repair company have been entirely useless at communication...) I also have the EngineerMode installed and it's also using data; "61.34mb since 1 Aug". It's worth noting that the data usage (752kb since Nov 1st) says it also includes other apps, I've listed them below for reference as I've not seen anyone else mention this yet. There's certainly some interesting names. OPSkin com.quicinc.cne.CNEService.CNES... com.qti.service.colorservice SmartcardService SVI Settings WifiRfTest Screenshot com.oneplus.setupwizard Manage center com.oneplus.sdcardservice FidoCryptoService NVBackupUI Content Adaptive Backlight Settings Android System OnePlus System Service Wfd Service applocker SimContacts Manager OnePlus Camera Service Settings Storage SecureExtAuthService nfc SecureSampleAuthService Input Devices com.qti.dpmserviceapp com.oem.logkitsdservice com.qualcomm.qti.simsettings Key Chain Call Management File manager org.codeaurora.btmultisim ANT HAL Service com.fingerprints.service.Fingerprin... OnePlusLogKit BugReportLite SeempJService Settings Tags LocatonServices AutoTestServer com.qualcomm.qti.tetherservice System Update MdtpService com.android.wallpaperbackup Fused Location com.qualcomm.fastdormancy com.qualcomm.qti.biometrics.voic... QTI Logging OPConfig com.qualcomm.timeservice OPLocationService Sensor Test Tool
- notsospeedruns 9y ago
  I also have the 3, agreed on points of quality but fragility. Looking at the data usage for several of the connected apps (my list is identical to yours as far as I can tell), it looks like the only data they send is as a subset of engineer mode (their individual data sent isn't shown, only the engineer mode total). There's definitely some concerning names there. Double checking my recent screenshots, it seems at least that it couldn't be sending full images with as much data as it's used. It's likely that it's not sending data from all of these, but just accessing them at some point. The previous leak on here revealed that OnePlus could track when you opened and closed apps. Based on this, it could potentially track your location, when you take screenshots, when you make phone calls, and a host of other information.
jokoon 9y ago
I got a very cheap huawei Y300 which stopped working recently. I think I remember having this app, along with many other weird ones preinstalled. Also, does anybody knows why some android phones have some "debug mode" when I plug them via USB? I mean if you think about it, that also sounds like a backdoor.
- staz 9y ago
  USB debug mode is a standard feature of Android that is disabled by default, but it's possible to enable it manually. If you see it without having enabled it, it is indeed strange https://www.kingoapp.com/root-tutorials/how-to-enable-usb-debugging-mode-on-android.htm https://www.kingoapp.com/root-tutorials/how-to-enable-usb-de...
  - jokoon 9y ago
    Yes it seems to be enabled by default, I disable it from time to time. At that point there are so many critical security flaw coming up every month that I don't really bother anymore.
- deleted 9y ago
  [deleted]
rippsu 9y ago
on OnePlus One you can install Ubuntu Touch https://ubports.com/page/devices https://ubports.com/page/devices
- tmikaeld 9y ago
  Except it's not actively developed anymore.
mads 9y ago
User builds on some Chinese phones are pretty sloppy. I needed to access an old Oppo phone the other day, where I couldn't remember the PIN. Luckily ADB was enabled, which suggests that their production software might have been a userdebug build. I couldn't enable root via ADB, since it was at least a production/user build, but the su binary was already on the phone, so I just su'ed and got a root prompt. From there I could pull the sqlite settings database, reset the PIN and push it again. After a reboot, the phone booted without PIN. Unfortunately there was an Oppo homebrewn secondary PIN on some of their built in apps, which hadn't been reset, but it turned out I could enter the PIN as many times as I wanted, so I made a small script to brute force it via ADB (input text). Took half an hour to disable the secondary PIN with my script.
- ksk 9y ago
  My Chinese phone (iPhone 6s) had a similar flaw. Okay, that was tongue in cheek, but I don't see how adding the China qualifier adds anything new or interesting other than inject bias.
  - octalmage 9y ago
    Does the iPhone 6s have a similar flaw? I'm still using one.
    - matt_wulfeck 9y ago
      He was joking. The 6s and pretty much every new phone using a Secure Enclave to make brute forcing anything technically impossible.
      - ksk 9y ago
        I was not joking. There was a lockscreen bypass bug where you could access the photos/contacts. Also, I haven't kept up with jailbreaking, so I'm not sure if they can still be rooted. So, yeah, iphones have had several security flaws in almost all versions.
  - 9y ago
mkroman 9y ago
No one found it just a tad strange that there was a system library called libdoor.so?
- chiph 9y ago
  So you can run old BBS games on your phone?
  - PacketPaul 9y ago
    Sign me up!
mijoharas 9y ago
Can anyone clarify as to whether there is a mitigation, and post a link?
SmellyGeekBoy 9y ago
I've said it on HN before but it bears repeating: If you have a OnePlus, do yourself a favour and put LineageOS on it. It works perfectly on my OP3.
- dopamean 9y ago
  I just asked another commenter who suggested Lineage to talk a little about their experience with it since I just flashed PA onto my 3t this past Friday. I'm going to check it out a bit today. Do you know if it's a simple process to go from PA -> Lineage? A little about me: I am a pretty experience developer but not much of a tinkerer when it comes to phones. This flash to PA is only the third time I've done this with a phone and the last time was a few years ago.
  - nucleardog 9y ago
    Not sure specifically how you installed PA, but, generally, that would look something like: 1. Unlock bootloader 2. Install aftermarket recovery (CWM or TWRP) 3. Install new ROM (PA) Now that you've done 1 and 2 (usually the difficult parts), you really just need to repeat step 3 with a different ROM. Assuming you have TWRP installed, LineageOS has instructions for your specific situation (installing from recovery) at: https://wiki.lineageos.org/devices/oneplus3/install#installing-lineageos-from-recovery https://wiki.lineageos.org/devices/oneplus3/install#installi... If you have CWM or something else, it should be relatively easy to translate the instructions to your specific situation. If you have trouble, you can just start from the beginning of that document for instructions to install TWRP instead. If you want Google Apps (gmail, etc) installed, you'll need to download that from here: http://opengapps.org/ http://opengapps.org/ (ARM64, 7.1) and treat that as your "additional packages" for the purposes of those instructions.
    - dopamean 9y ago
      I have TWRP installed. Thanks for the links. It looks like this will be simpler than I thought. I'm a little paranoid about bricking my phone as I only bought it a year ago and I'd have to have to get another.
logingone 9y ago
https://en.wikipedia.org/wiki/List_of_mobile_phone_makers_by_country https://en.wikipedia.org/wiki/List_of_mobile_phone_makers_by...
danjoc 9y ago
All modern mobile phones have a baseband processor with root backdoor. OnePlus is only remarkable for having a second one.
- dmos62 9y ago
  Reference, or explanation?
  - danjoc 9y ago
    https://en.wikipedia.org/wiki/Mobile_baseband https://en.wikipedia.org/wiki/Mobile_baseband If it has GSM/LTE/CDMA/etc baseband processor with closed implementation, assume it has remote root backdoor. Samsung has already been caught. osmocombb tried to solve this. That project is essentially dead.
    - lurker12390879 9y ago
      Librem 5 is a partial solution because the baseband has no access to the system.
      - nyargh 9y ago
        Still has DMA, no?
        kogepathic 9y ago
        No, the baseband radio will not be connected to the SoC via DMA. They are proposing to use an external baseband with a USB or UART interface to the main SoC and a kill switch. https://forums.puri.sm/t/level-of-freedom-of-librem-phone-especially-gsm-mdule/1316/2 https://forums.puri.sm/t/level-of-freedom-of-librem-phone-es...
milankragujevic 9y ago
Have it on my tablet that's not even Mediatek or Qualcomm, but instead Allwinner A33... Scary. I think I should throw it away. Or, since it comes pre-rooted and in engineer build mode instead of userdebug or prod, I think I just might uninstall the APK from the shell and sleep well tonight.
anonu 9y ago
EngineerMode: so I fired this up on my OnePlus5 (and subsequently rooted my device). Fun times. Can anyone explain all the features in Engineer Mode? * DDR Aging Test: Some sort of DRAM physical memory test? * SUPL Tool: Tries to connect to supl.google.com:7276 ?? * Network set >> RAT Mode? .... other features test your screen, colors, backlight, NFC, Wifi, etc - would still be helpful if someone with a bit more background could give some color.

317 points by hpaavola 9y ago

I just checked my OnePlus One and it doesn't have the "Engineering mode" app. Maybe because I'm on the original CyanogenOS; I didn't upgrade to Oxygen OS.

hs86 9y ago
Do you consider switching over to the community based LineageOS? They will continue to provide security updates for your phone and afair currently you are stuck with Android 6. Additionally, the upcoming release will bring Android 8 to your device: https://review.lineageos.org/#/q/branch:lineage-15.0+bacon https://review.lineageos.org/#/q/branch:lineage-15.0+bacon
- darklajid 9y ago
  lineageos is awesome. Unfortunately the camera app is quite a bit worse in my opinion (used it on the OnePlus One, 3T and haven't tested it with my 5). Guess some things are more important at this point..
  - nocoder 9y ago
    I would like to use lineage OS but if I root my phone my work email will stop working. It is configured via Boxer app, is there a work around?
    - hs86 9y ago
      To gain root access you have to flash an optional zip file [0] after flashing LineageOS itself and the also optional OpenGapps [1]. If you don't do that, your Boxer app should pass these SafetyNet checks [2]. If you want both root and still full access to these SafetyNet-"protected" apps, you can try the alternative rooting solution Magisk [3] which specializes on bypassing these (imho arbitrary) restrictions. [0] https://download.lineageos.org/extras https://download.lineageos.org/extras [1] http://opengapps.org/ http://opengapps.org/ [2] https://www.lineageos.org/Safetynet/ https://www.lineageos.org/Safetynet/ [3] https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445 https://forum.xda-developers.com/apps/magisk/official-magisk...
    - gerty 9y ago
      My bank app refused to install on a rooted phone. I used Magisk Manager to work around that. I guess it could work in this case as well. There is a 'hide root' option (or something similar).
  - mino 9y ago
    I use OpenCamera on a oneplus X with lineageOS. The camera hardware is not great, and definitely far from the 2017 state of the art, but it works ok.
  - Tistron 9y ago
    Is there no way one can extract the oneplus camera app and install it on lineageos? I'm also going to finally switch now, but I don't understand why there isn't some clever hacker that has done this yet. Is is impossible?
- Giroflex 9y ago
  Are there any serious known issues on LineageOS for the OP3, other than the camera being weaker?
- DarronWyke 9y ago
  What are some things to be aware of when switching? I'm a 3T owner and I'm done with the OS (still love the hardware). Hesitant to simply flash new firmware onto it without knowing what I'm getting into.
deleted 9y ago
[deleted]

koevet 9y ago

More context here: http://www.androidpolice.com/2017/11/13/oneplus-left-backdoor-devices-capable-root-access/ http://www.androidpolice.com/2017/11/13/oneplus-left-backdoo...

RpFLCL 9y ago

I just checked and found it on my OnePlus Two. To other OP owners: make sure you look under "all" apps, not just "downloaded". After this finding , the data collection incident a month ago, and their last 1Gb+ OTA update that bootlooped my phone, I think I'm done with OnePlus products. I enjoyed the hardware but I can't tolerate this much malice/incompetence in software in something as critical to my daily life. I'm sure some posters will suggest that this is what we deserve for trusting a Chinese OEM, but I still find it all very sad. Steal data, brick devices, and leave backdoors: How to lose a customer in three easy steps.

raverbashing 9y ago
Not to mention the "phone crashes when calling 911" bug
- differentView 9y ago
  Wasn't that a bug with other phones as well?
  - dopamean 9y ago
    Some version of this bug has cropped up on many phones on different carriers all around the world.
ngcazz 9y ago
Yup, done here too. Edit: EngineerMode is present on my OP3T with latest Oreo beta
mino 9y ago
> I enjoyed the hardware but Do like me, if you don't want to trash a OnePlus device: install LineageOS.
- asfdsfggtfd 9y ago
  Do you trust there not to be lower level issues?

Phemist 9y ago

The "secret" password seems to be "angela". OnePlus == DarkArmy confirmed?

parmesan 9y ago
Ikr, why would you even insert a reference like that?
porfirium 9y ago
Isn't it "code"?
- Phemist 9y ago
  "code" is the name of the intent extra. See: https://twitter.com/fs0c131y/status/930127615389851648 https://twitter.com/fs0c131y/status/930127615389851648 and: https://twitter.com/fs0c131y/status/930128095503441920 https://twitter.com/fs0c131y/status/930128095503441920
vnchr 9y ago
Probably fans of Angela Lansbury.
- Double_a_92 9y ago
  Seems like a Mr.Robot reference to me.
stiGGG 9y ago
What? OnePlus == BND confirmed!

atomicnumber1 9y ago

I didn’t knew that engineer mode app could be used for such malice. I bet they didn’t either (btw I know that they should have been more vigilant about what goes into the consumer device). And this app is developed by Qualcomm. I just think that they forgot to remove from user builds (which btw is a bad sign).

mondoshawan 9y ago
After having worked in the bowels of Qualcomm's Android drops, I have to note that the amount of precompiled vendor binaries that get included was astounding. The worst part is that their tendrils hook in to major parts of the low level networking stacks in very bizarre ways. Removing them is often extremely difficult, and even simple things like removing APKs like this one often affect the stability of the system as a whole. I can't really fault 1+ for this debacle -- but this is what happens when OEMs just go along with using these inscrutable blobs of crapware from their upstream vendors. I only hope Librem can actually pull off their phone. Shipping something fully open in light of findings like this may help to turn the tide.

therealmarv 9y ago

It's not the first time a big security/privacy leak was found on OnePlus' phones. Would stay far away from OnePlus phones.

shpx 9y ago
I would stay away from proprietary software, especially if it was written in Russia or China. All of their tech companies owe their entire existence to their respective governments and it's not like the governments set up that environment for them for free.
- stolho 9y ago
  Sure, and tech companies in USA are super trusted. And for sure no backdoors are found. Just one of the recent examples when author of Telegram was "contacted" by USA government during his visit to USA. If you really want to be honest - you should understand that every government is interesting in "access" to popular tech tools - laptops, phones, social networks, messengers and etc. And it will be really good also to check facts and not yellow press like CNN, BBC and etc and just bullshit Russia. Trust is a weakness... Never forget it :)
- atomicnumber1 9y ago
  Yes. And NSA/GCHQ just doesn't involve itself with any tech companies in the U.S and EU respectively.
- throw2016 9y ago
  What is IntelME or AMD PSP just for starters? This is completely untenable in the face of all the revelations starting with Snowden, nsl letters, secret processes and secret courts. No one will seriously claim the US tech industry has not benefited from the government. No point singling out specific governments, the NSA is not on your side.
- ksk 9y ago
  >I would stay away from proprietary software, especially if it was written in Russia or China. Why? What have you found in proprietary software written in China and Russia?

laxentasken 9y ago

Found it on my Oneplus X. Maybe this is the time to try out Apple.

jetpks 9y ago
As a long time iPhone user that swings Android every few years to try the waters, I am consistently blown away at the level of garbage Android users are expected to deal with on a regular basis. Want to know how many times my iPhones have boot looped in the last nine years? Not once ever. My last Android (Nexus 6p) managed to do it several times in the 3-ish months I daily-drove it. Want to know how long you can expect to get iOS updates with a new hardware purchase? 5+ years. Compared with the very best case for Android: 2 maybe? How many times with an iPhone have I been expected to install a custom OS to get around a user-hostile feature like I saw about fifty times in the 1 billion outdated androids thread? Zero times. It’s unreal.
- lostmsu 9y ago
  Anecdotally mine Androids never bootlooped (started with Dell Streak 5)
- zeveb 9y ago
  > I am consistently blown away at the level of garbage Android users are expected to deal with on a regular basis. My girlfriend uses an iPhone; I am consistently blown away by the amount of garbage she's expected to deal with on a regular basis. When she changes to another app, our video chats go dark; there's no Termux or GNURoot equivalent (that I'm aware of); tapping doesn't move the cursor but instead selects words (I think that's it); the mail app is hellaciously bad; she's stuck using Safari and seeing ads. So, so many ads. Ads everywhere. I never see ads on my phone, but on hers the Internet is nothing but ads as far as the eye can see. The sad fact is that the mobile phone ecosystem in general is full of garbage. Neither Android nor iOS is exempt. But at least with Android I have freedom. > How many times with an iPhone have I been expected to install a custom OS to get around a user-hostile feature like I saw about fifty times in the 1 billion outdated androids thread? Zero times. That's because with an iPhone there are no custom OSes and you're stuck with Apple's user-hostile features.

mads 9y ago

Isn't the EngineerMode APK an MTK app? I have been involved in developing an Marshmallow MTK based phone in the past and in my experience their BSP's were pretty messy. I.e. a lot of cleaning up is necessary if you want a relatively quiet logcat and debugging APK's removed - even for user builds. Edit: I must have remembered wrong or I saw the EngineerMode on the QComm device we developed before our MTK based device. The OnePlus seems to be a QComm device.. :)

milankragujevic 9y ago
I have a shit Allwinner A33 tablet and it has SoftWinner APK AND EngineerMode APK. So idk maybe it's something shared for all Chinese devices...?
brightsize 9y ago
I have a Blu Studio Max (2017) with a MTK chipset. EngineerMode is installed and running.
brightsize 9y ago
Here we go (Blu Studio Max): adb shell am start -n com.mediatek.engineermode/.EngineerMode This is going to be a fun morning.

BuildTheRobots 9y ago

I have a onePlus 3 (which anecdotally has been a lovely handset, just extremely fragile. And onePlus and their repair company have been entirely useless at communication...) I also have the EngineerMode installed and it's also using data; "61.34mb since 1 Aug". It's worth noting that the data usage (752kb since Nov 1st) says it also includes other apps, I've listed them below for reference as I've not seen anyone else mention this yet. There's certainly some interesting names. OPSkin com.quicinc.cne.CNEService.CNES... com.qti.service.colorservice SmartcardService SVI Settings WifiRfTest Screenshot com.oneplus.setupwizard Manage center com.oneplus.sdcardservice FidoCryptoService NVBackupUI Content Adaptive Backlight Settings Android System OnePlus System Service Wfd Service applocker SimContacts Manager OnePlus Camera Service Settings Storage SecureExtAuthService nfc SecureSampleAuthService Input Devices com.qti.dpmserviceapp com.oem.logkitsdservice com.qualcomm.qti.simsettings Key Chain Call Management File manager org.codeaurora.btmultisim ANT HAL Service com.fingerprints.service.Fingerprin... OnePlusLogKit BugReportLite SeempJService Settings Tags LocatonServices AutoTestServer com.qualcomm.qti.tetherservice System Update MdtpService com.android.wallpaperbackup Fused Location com.qualcomm.fastdormancy com.qualcomm.qti.biometrics.voic... QTI Logging OPConfig com.qualcomm.timeservice OPLocationService Sensor Test Tool

notsospeedruns 9y ago
I also have the 3, agreed on points of quality but fragility. Looking at the data usage for several of the connected apps (my list is identical to yours as far as I can tell), it looks like the only data they send is as a subset of engineer mode (their individual data sent isn't shown, only the engineer mode total). There's definitely some concerning names there. Double checking my recent screenshots, it seems at least that it couldn't be sending full images with as much data as it's used. It's likely that it's not sending data from all of these, but just accessing them at some point. The previous leak on here revealed that OnePlus could track when you opened and closed apps. Based on this, it could potentially track your location, when you take screenshots, when you make phone calls, and a host of other information.

jokoon 9y ago

I got a very cheap huawei Y300 which stopped working recently. I think I remember having this app, along with many other weird ones preinstalled. Also, does anybody knows why some android phones have some "debug mode" when I plug them via USB? I mean if you think about it, that also sounds like a backdoor.

staz 9y ago
USB debug mode is a standard feature of Android that is disabled by default, but it's possible to enable it manually. If you see it without having enabled it, it is indeed strange https://www.kingoapp.com/root-tutorials/how-to-enable-usb-debugging-mode-on-android.htm https://www.kingoapp.com/root-tutorials/how-to-enable-usb-de...
- jokoon 9y ago
  Yes it seems to be enabled by default, I disable it from time to time. At that point there are so many critical security flaw coming up every month that I don't really bother anymore.
deleted 9y ago
[deleted]

rippsu 9y ago

on OnePlus One you can install Ubuntu Touch https://ubports.com/page/devices https://ubports.com/page/devices

tmikaeld 9y ago
Except it's not actively developed anymore.

mads 9y ago

User builds on some Chinese phones are pretty sloppy. I needed to access an old Oppo phone the other day, where I couldn't remember the PIN. Luckily ADB was enabled, which suggests that their production software might have been a userdebug build. I couldn't enable root via ADB, since it was at least a production/user build, but the su binary was already on the phone, so I just su'ed and got a root prompt. From there I could pull the sqlite settings database, reset the PIN and push it again. After a reboot, the phone booted without PIN. Unfortunately there was an Oppo homebrewn secondary PIN on some of their built in apps, which hadn't been reset, but it turned out I could enter the PIN as many times as I wanted, so I made a small script to brute force it via ADB (input text). Took half an hour to disable the secondary PIN with my script.

ksk 9y ago
My Chinese phone (iPhone 6s) had a similar flaw. Okay, that was tongue in cheek, but I don't see how adding the China qualifier adds anything new or interesting other than inject bias.
- octalmage 9y ago
  Does the iPhone 6s have a similar flaw? I'm still using one.
  - matt_wulfeck 9y ago
    He was joking. The 6s and pretty much every new phone using a Secure Enclave to make brute forcing anything technically impossible.
    - ksk 9y ago
      I was not joking. There was a lockscreen bypass bug where you could access the photos/contacts. Also, I haven't kept up with jailbreaking, so I'm not sure if they can still be rooted. So, yeah, iphones have had several security flaws in almost all versions.
- 9y ago

mkroman 9y ago

No one found it just a tad strange that there was a system library called libdoor.so?

chiph 9y ago
So you can run old BBS games on your phone?
- PacketPaul 9y ago
  Sign me up!

mijoharas 9y ago

Can anyone clarify as to whether there is a mitigation, and post a link?

SmellyGeekBoy 9y ago

I've said it on HN before but it bears repeating: If you have a OnePlus, do yourself a favour and put LineageOS on it. It works perfectly on my OP3.

dopamean 9y ago
I just asked another commenter who suggested Lineage to talk a little about their experience with it since I just flashed PA onto my 3t this past Friday. I'm going to check it out a bit today. Do you know if it's a simple process to go from PA -> Lineage? A little about me: I am a pretty experience developer but not much of a tinkerer when it comes to phones. This flash to PA is only the third time I've done this with a phone and the last time was a few years ago.
- nucleardog 9y ago
  Not sure specifically how you installed PA, but, generally, that would look something like: 1. Unlock bootloader 2. Install aftermarket recovery (CWM or TWRP) 3. Install new ROM (PA) Now that you've done 1 and 2 (usually the difficult parts), you really just need to repeat step 3 with a different ROM. Assuming you have TWRP installed, LineageOS has instructions for your specific situation (installing from recovery) at: https://wiki.lineageos.org/devices/oneplus3/install#installing-lineageos-from-recovery https://wiki.lineageos.org/devices/oneplus3/install#installi... If you have CWM or something else, it should be relatively easy to translate the instructions to your specific situation. If you have trouble, you can just start from the beginning of that document for instructions to install TWRP instead. If you want Google Apps (gmail, etc) installed, you'll need to download that from here: http://opengapps.org/ http://opengapps.org/ (ARM64, 7.1) and treat that as your "additional packages" for the purposes of those instructions.
  - dopamean 9y ago
    I have TWRP installed. Thanks for the links. It looks like this will be simpler than I thought. I'm a little paranoid about bricking my phone as I only bought it a year ago and I'd have to have to get another.

logingone 9y ago

https://en.wikipedia.org/wiki/List_of_mobile_phone_makers_by_country https://en.wikipedia.org/wiki/List_of_mobile_phone_makers_by...

danjoc 9y ago

All modern mobile phones have a baseband processor with root backdoor. OnePlus is only remarkable for having a second one.

dmos62 9y ago
Reference, or explanation?
- danjoc 9y ago
  https://en.wikipedia.org/wiki/Mobile_baseband https://en.wikipedia.org/wiki/Mobile_baseband If it has GSM/LTE/CDMA/etc baseband processor with closed implementation, assume it has remote root backdoor. Samsung has already been caught. osmocombb tried to solve this. That project is essentially dead.
  - lurker12390879 9y ago
    Librem 5 is a partial solution because the baseband has no access to the system.
    - nyargh 9y ago
      Still has DMA, no?
      - kogepathic 9y ago
        No, the baseband radio will not be connected to the SoC via DMA. They are proposing to use an external baseband with a USB or UART interface to the main SoC and a kill switch. https://forums.puri.sm/t/level-of-freedom-of-librem-phone-especially-gsm-mdule/1316/2 https://forums.puri.sm/t/level-of-freedom-of-librem-phone-es...

milankragujevic 9y ago

Have it on my tablet that's not even Mediatek or Qualcomm, but instead Allwinner A33... Scary. I think I should throw it away. Or, since it comes pre-rooted and in engineer build mode instead of userdebug or prod, I think I just might uninstall the APK from the shell and sleep well tonight.

anonu 9y ago

EngineerMode: so I fired this up on my OnePlus5 (and subsequently rooted my device). Fun times. Can anyone explain all the features in Engineer Mode? * DDR Aging Test: Some sort of DRAM physical memory test? * SUPL Tool: Tries to connect to supl.google.com:7276 ?? * Network set >> RAT Mode? .... other features test your screen, colors, backlight, NFC, Wifi, etc - would still be helpful if someone with a bit more background could give some color.