OnePlus left EngineerMode APK in end user OxygenOS builds, easily rootable

Adjust Comment Print

OnePlus co-founder Carl Pei says that the company is "looking into" the presence of EngineerMode, assessing just how widespread the issue is and ways to prevent users from being subject to the security fault. The application is a diagnostics tool called "EngineerMode" that Qualcomm developed and distributes to OEMs like OnePlus so they can test the hardware components of a device. While the company eventually reversed course on the data collection, another discovery has been made in the software of OnePlus phones. It's even included on OxygenOS for the OnePlus One, but not the original CyanogenOS ROM. It's used to run system tests for things like GPS, vibration, screen brightness, and also root checking.

After tearing apart the phone's libdoor.so library, he managed to obtain root access though bypassing the escalate and isEscalated methods in the DiagEnabled activity.

OnePlus, an electronics manufacturer based in China, has reportedly been shipping its line of popular smartphones with a hidden backdoor that could allow a hacker to hijack the device relatively effortlessly. According to a Twitter user Elliot Alderson, some of OnePlus devices come with EngineerMode APK app pre-loaded on them, which acts as a backdoor, giving people root access without the need for unlocking the phone. A malicious app or malware that is built around this loophole would potentially be able to target OnePlus devices and wreck havoc. Of course, expecting the developers to unlock the bootloader for each device during its testing phases would be ridiculous, but its inclusion does pose security risks for everyday users.

Northern California Shooting Leaves 5 Dead, Including Attacker
Tehama, the community in which the shooting occurred, is about 210km north of Sacramento and has a population of just 3500. Brian Flint told local media his neighbor was the shooter , and that the neighbor had stolen his truck.

OnePlus did not immediately respond to a request for comment.

For owners of OnePlus devices who are curious to learn if the Engineer Mode app is installed on their device, it is possible to find the app by going to Settings, opening the Apps menu, tapping Menu, and Show System apps.

Comments