OnePlus includes Qualcomm engineering app in phones
A Twitter user by the name «Elliot Alderson» has discovered a root backdoor in OnePlus devices one that has apparently been shipping for years. OnePlus has been shipping a Qualcomm engineering APK (an Android app file) in its devices, which with a few coque samsung galaxy j3 2016 basket commands can root a device.
The app called «EngineerMode» is partially exposed coque samsung galaxy core prime silicone coque huawei p8 lite 2017 breaking bad ebay to users through a secret «808» dialer command, and you can also launch the full app through an Android activity launcher or the command protection coque samsung galaxy s5 line. The app contains production line tests for various phone components, a root checker, and lots of information readouts. The important part, though, is a «DiagEnabled» activity with a method called «escalatedUp.» If this is set to «true,» the app will allow root access over Android Debug Bridge, Android’s command line developer tools.
The method for gaining root is password protected, but the password lasted all of three hours once the method was discovered. With the help ofDavid Weinsteinand theNow Secureteam, the group discovered the magic word is «angela,» which is possibly another Mr. Robot reference, just like the coque samsung galaxy alpha darty «Elliot Alderson» sfr coque samsung galaxy grand prime handle. (We swear this is real and not a Mr. Robot ARG.)
Enlarge / The «Engineering Mode» app from a OnePlus 3T.
With the password cracked, it’s now possible for an app to enable root access on any device with the APK preinstalled. For now, this coque samsung core prime plage only works in ADB, which coque samsung galaxy s7 3d requires local access to the device. Anderson says it’s «too early coque samsung gti9100 to speak about a personnaliser coque samsung j5 2017 random app getting root access, but we are on the coque samsung s6 armor good tracks.»
Since amazon coque samsung core this is a Qualcomm APK, there’s a chance other OEMs have made the same mistake coque samsung j5 2016 real madrid OnePlus has. While the root backdoor hasn’t been verified in other devices yet, reports from Twitter indicate the APK was also found in Asus and Xiaomi devices.
OnePlus CEO Carl Pel said his company is «looking into» the backdoor report. It should be a simple matter of just removing the APK in an update, but coque samsung s7 kawai this will certainly put a damper on the launch coque huawei p8 lite le roi lion dysney of coque samsung galaxy j1 blanc the OnePlus 5T, which comes outthis week.
Update:OnePlus has released a statementsaying it will remove the app:
Yesterday, we received a lot of coque a rabat pour huawei p8 lite questions regarding an apk found in several devices, including our own, named EngineerMode, and we would like to explain what it is. EngineerMode is a diagnostic tool mainly coque huawei p8 lite la belle et la bete used for factory production line functionality testing and after sales support.
We’ve seen several statements by community developers that are worried because this apk grants root privileges. While, it can enable adb root which provides privileges for adb commands, it will not let 3rd party apps access full root privileges. Additionally, adb root is only accessible if USB debugging, which is off by default, is turned on, and any sort of root access would still require physical access to your device.
While we don’t see this as a major security issue, we understand that users may still have concerns and therefore we will remove the adb root function from EngineerMode in an upcoming OTA.
Update coque samsung galaxy j5 2018 2: Qualcomm coque yin yang huawei p8 lite 2017 coque samsung galaxy j3 2016 football has chimed in, saying that while the app is based on Qualcomm source code, «EngineerMode no longer resembles the original code we provided.»
2020 Cond Nast. coque samsung galaxy grand prime ve gris Use of and/or registration on any portion of this site coque samsung s5 cheval constitutes acceptance of our User Agreement (updated 1/1/20) and Privacy Policy and Cookie Statement (updated 1/1/20) and Ars Technica Addendum (effective 8/21/2018). Ars may earn compensation on sales from links on this site. Read our affiliate link policy.
Your California Privacy RightsDo Not Sell My Personal Information
The material on this site may not be reproduced, distributed, transmitted, cached or otherwise used, except with the prior written permission of Cond coque huawei p8 lite 2017 galaxie Nast…
