OnePlus left EngineerMode APK in end user OxygenOS builds, easily rootable

Adjust Comment Print

OnePlus co-founder Carl Pei says that the company is "looking into" the presence of EngineerMode, assessing just how widespread the issue is and ways to prevent users from being subject to the security fault. The application is a diagnostics tool called "EngineerMode" that Qualcomm developed and distributes to OEMs like OnePlus so they can test the hardware components of a device. While the company eventually reversed course on the data collection, another discovery has been made in the software of OnePlus phones. It's even included on OxygenOS for the OnePlus One, but not the original CyanogenOS ROM. It's used to run system tests for things like GPS, vibration, screen brightness, and also root checking.

After tearing apart the phone's libdoor.so library, he managed to obtain root access though bypassing the escalate and isEscalated methods in the DiagEnabled activity.

OnePlus, an electronics manufacturer based in China, has reportedly been shipping its line of popular smartphones with a hidden backdoor that could allow a hacker to hijack the device relatively effortlessly. According to a Twitter user Elliot Alderson, some of OnePlus devices come with EngineerMode APK app pre-loaded on them, which acts as a backdoor, giving people root access without the need for unlocking the phone. A malicious app or malware that is built around this loophole would potentially be able to target OnePlus devices and wreck havoc. Of course, expecting the developers to unlock the bootloader for each device during its testing phases would be ridiculous, but its inclusion does pose security risks for everyday users.

Russia Used Video Game Screenshots to "Prove" the US Is Assisting ISIS
Another one is a consistent with a slightly edited screengrab from a 2015 promotional video for a gunship simulator video game. The Russian Ministry of Defence has used a videogame screenshot to accuse the United States of cooperating with ISIS.

OnePlus did not immediately respond to a request for comment.

For owners of OnePlus devices who are curious to learn if the Engineer Mode app is installed on their device, it is possible to find the app by going to Settings, opening the Apps menu, tapping Menu, and Show System apps.

Comments