ONEPLUS has been hacked !! (security breach)

[MyBalls]

Just received this email from oneplus.

 

 

From: OnePlus <support@oneplus.com>
Sent: Friday, November 22, 2019 5:34 PM
To: ******************
Subject: Security Notification

 

Security Notification

We are reaching out to you directly as we have discovered that part of your order information was accessed by an unauthorized party. We can confirm that your payment information, password and account are safe, but your name, contact number, email and shipping address may have been exposed. We took immediate steps to stop the intruder and reinforce security. Right now, we are working with the relevant authorities to further investigate this incident and protect your data. We wanted to notify you of this so that you can be alert to people pretending to be OnePlus to get further information from you, or people asking you to buy products or services from them. OnePlus will never ask you for your passwords, and any financial information should only be provided via a secure payment page on the OnePlus website or one of our partners if you are buying products from us. We are deeply sorry about this, and are committed to doing everything in our power to prevent further such incidents. We will continue to investigate and update you as we learn more. In the meantime, please contact us with any questions or concerns at Customer Support.

This email was sent to **************** why did I get this?    unsubscribe from this list    update subscription preferences  OnePlus · 18th Floor Tairan Building C, Tairan 8th Road · Futian District · Shenzhen, Guangdong 518040 · China

[dizmo]

"We gave the information to the Chinese government because they asked, but to cover our own asses we're going to say it was a breach."

[rcmaehl]

Here's a reputable source so your post doesn't get removed from tech news:
 

https://9to5google.com/2019/11/22/oneplus-security-notification-breach/

 

[wasab]

2 hours ago, dizmo said:

"We gave the information to the Chinese government because they asked, but to cover our own asses we're going to say it was a breach."

If Chinese government wish to hack you, it is 100% guranteed they can and will. You simply can't defend against adversary with as much resources and expertise as a national government. However, why would they? They won't be wasting money and manpower on picking out the average nobody, instead I'm pretty sure they are hacking corporation for trade secrets or the pentagon for intelligences instead. 

[minibois]

A colleague of mine told me about this earlier today. Kinda sucks.

Made him not want to go OnePlus anymore.

[dizmo]

2 minutes ago, wasab said:

If Chinese government wish to hack you, it is 100% guranteed they can and will. You simply can't defend against adversary with as much resources and expertise as a national government. However, why would they? They won't be wasting money and manpower on picking out the average nobody, instead I'm pretty sure they are hacking corporation for trade secrets or the pentagon for intelligences instead. 

Single person, no but mass amounts of information, certainly.

[wasab]

4 minutes ago, dizmo said:

Single person, no but mass amounts of information, certainly.

What do they gain out of this information? Are they trying to do consumer research? Do they want to see what times/locations you shop and websites you visit? Do they want to use your browsing history for mass ads? If so, Google and Microsoft, and countless western companies should be what you are worrying about instead of foreign governments.  

[DKL]

Add this to the OP!
https://forums.oneplus.com/threads/security-notification.1144088/
(FAQ from OnePlus)

 

Quote

What happened?
While monitoring our systems, our security team discovered that some of our users' order information was accessed by an unauthorized party. We can confirm that all payment information, passwords and accounts are safe, but the name, contact number, email and shipping address in certain orders may have been exposed.

What information was exposed?
The name, contact number, email and shipping address within certain orders may have been exposed.

I received an email saying that my information was leaked. What can I do now?
There is no additional action required on your part for now, but please be aware that you may receive spam and phishing emails as a result of this incident.

What have you done in response?
We took immediate steps to stop the intruder and reinforce security, making sure there are no similar vulnerabilities. Before making this public, we informed our impacted users by email. Right now, we are working with the relevant authorities to further investigate this incident.

How do I know if my information was involved?
We understand that personal information is very important to our users, and all impacted users were notified via email. If you don’t get an email from us today, rest assured that your order information is safe. However, if you have further concerns, please contact us at oneplus.com/support for assistance.

What will you do to improve information security?
We've inspected our website thoroughly to ensure that there are no similar security flaws. We are continually upgrading our security program - we are partnering with a world-renowned security platform next month, and will launch an official bug bounty program by the end of December.

 

[dizmo]

8 minutes ago, wasab said:

What do they gain out of this information? Are they trying to do consumer research? Do they want to see what times/locations you shop and websites you visit? Do they want to use your browsing history for mass ads? If so, Google and Microsoft, and countless western companies should be what you are worrying about instead of foreign governments.  

Who knows. Any form of information is better than none.

[wasab]

27 minutes ago, huilun02 said:

The fearmongering is real...

 

Although I am no fan of OnePlus or Winnie the pooh

But One plus make great phones.... 

[That Franc]

49 minutes ago, huilun02 said:

They fell out of favor with me when they decided to drop some of the hallmarks of Android phones - expandable storage and headphone jack

Anyone who takes away consumer choice is an enemy to me

With this kind of mindset, there isn't a single phone manufacturer left that isn't an enemy. They are all copying each other, and ultimately going the same route - at first they've taken away an option of having a moderately-sized screen, then they've taken away the headphone jack, then there were display notches everywhere, and every manufacturer has dabbled in this.

[realpetertdm]

10 hours ago, MyBalls said:

Just received this email from oneplus.

 

 

From: OnePlus <support@oneplus.com>
Sent: Friday, November 22, 2019 5:34 PM
To: ******************
Subject: Security Notification

 

Security Notification

We are reaching out to you directly as we have discovered that part of your order information was accessed by an unauthorized party. We can confirm that your payment information, password and account are safe, but your name, contact number, email and shipping address may have been exposed. We took immediate steps to stop the intruder and reinforce security. Right now, we are working with the relevant authorities to further investigate this incident and protect your data. We wanted to notify you of this so that you can be alert to people pretending to be OnePlus to get further information from you, or people asking you to buy products or services from them. OnePlus will never ask you for your passwords, and any financial information should only be provided via a secure payment page on the OnePlus website or one of our partners if you are buying products from us. We are deeply sorry about this, and are committed to doing everything in our power to prevent further such incidents. We will continue to investigate and update you as we learn more. In the meantime, please contact us with any questions or concerns at Customer Support.

This email was sent to **************** why did I get this?    unsubscribe from this list    update subscription preferences  OnePlus · 18th Floor Tairan Building C, Tairan 8th Road · Futian District · Shenzhen, Guangdong 518040 · China

 

Can you retype or edit this? The text is cropped out on my phone

[amdorintel]

8 hours ago, rcmaehl said:

Here's a reputable source so your post doesn't get removed from tech news:
 

https://9to5google.com/2019/11/22/oneplus-security-notification-breach/

 

anything with the word "google" in its name is not reputable imho

 

6 hours ago, wasab said:

If Chinese government wish to hack you, it is 100% guranteed they can and will. You simply can't defend against adversary with as much resources and expertise as a national government. However, why would they? They won't be wasting money and manpower on picking out the average nobody, instead I'm pretty sure they are hacking corporation for trade secrets or the pentagon for intelligences instead. 

yeah they got teams and those chinese teams of hackers, not russia is where blame is to be made, but russia it is. it doesnt matter really, because the blame made on russia, is just a nothing burger as Oreily states. its to what benefits the people pointing blame. even north korea has hacking teams to meddle in whatever they want to meddle in whether it be elections, facial recognition (in china), whatever it is.

 

 

6 hours ago, wasab said:

What do they gain out of this information? Are they trying to do consumer research? Do they want to see what times/locations you shop and websites you visit? Do they want to use your browsing history for mass ads? If so, Google and Microsoft, and countless western companies should be what you are worrying about instead of foreign governments.  

information is power, no matter how irrelevant that info is, the mass collection of data is happening!

[Bananasplit_00]

Oh hey, it happened AGAIN. I refuse to touch oneplus after all the shit that they did and fucked up previously. Another mark against them. Really sad because I did enjoy my OP2 a lot but it's not like their latest phones are any interesting

[Chunchunmaru_]

I have not received anything, strange

 

Or I guess it depends on which country are you registered in? 

[vanished]

Wow, again?  Did they not have a breach just like this (or worse even) not that long ago?

 

Yes, yes they did.  I hate to quote the verge but it's the first link

https://www.theverge.com/2018/1/19/16908990/oneplus-credit-card-security-breach-investigation-40000-affected

[LeSheen]

Weird, did not get the mail myself.

[Mark Kaine]

I'm quite unsure how a phone company would get my email in the first place as they are not my service provider.*

 

Otherwise never heard of them... But that sure would make me avoid them 100% if they asked for my email. 

 

And yes I'm aware somewhere in my Sony phone will be an option to give Sony my email address but it's completely unnecessary and pointless to do so, so it's not really an issue to me... 

 

 

*

Spoiler

On that note, even my service provider doesn't have my email outside the one they gave me lol 

 

[TheGreatWizardCalder]

On 11/25/2019 at 3:13 AM, Mark Kaine said:

I'm quite unsure how a phone company would get my email in the first place as they are not my service provider.*

 

Otherwise never heard of them... But that sure would make me avoid them 100% if they asked for my email. 

 

And yes I'm aware somewhere in my Sony phone will be an option to give Sony my email address but it's completely unnecessary and pointless to do so, so it's not really an issue to me... 

 

 

*

  Hide contents

On that note, even my service provider doesn't have my email outside the one they gave me lol 

 

Oneplus is a phone manufacturer, not a service company.
Need to throw your email into the phone for android iirc, and to make an account to order a phone.

Source: I have a 1+ phone.

[Nineshadow]

On 11/25/2019 at 12:13 PM, Mark Kaine said:

I'm quite unsure how a phone company would get my email in the first place as they are not my service provider.*

 

Otherwise never heard of them... But that sure would make me avoid them 100% if they asked for my email. 

 

And yes I'm aware somewhere in my Sony phone will be an option to give Sony my email address but it's completely unnecessary and pointless to do so, so it's not really an issue to me... 

 

 

*

  Reveal hidden contents

On that note, even my service provider doesn't have my email outside the one they gave me lol 

 

I don't think their phones got compromised, but rather their website which handles costumers' orders.

[Mark Kaine]

13 minutes ago, Nineshadow said:

I don't think their phones got compromised, but rather their website which handles costumers' orders.

Ah ok but that's honestly why you don't buy at random "manufacturer stores" and instead from a few trusted ones like Amazon etc,  or indeed your service provider (that's where I got all my phones from iirc) 

 

But,  I did this in the past too tbh!  Always felt very uneasy - and this is why I don't do it anymore - sometimes I do guest checkout hoping they don't save my email (probably stupid to hope that even if they say otherwise lol)

[flashiling]

i didn't get that mail either.

huh.

[vanished]

18 minutes ago, Nineshadow said:

I don't think their phones got compromised, but rather their website which handles costumers' orders.

Yes, it was the store, not the phones themselves.  However, this raises a good point - if they can't secure their store, who's to say the phones can be trusted either?  I'm sure we all remember the semi-recent issue where ASUS's software update channels got hacked and as a result malware was sent to customers.  It stands to reason that the same could happen to a phone manufacturer (of which ASUS is also one).  Maybe next time instead of a BIOS update or other PC software feature, it'll be an OTA update for phones.  For this reason I only buy "non-information" products from companies that have proven to be untrustworthy in this regard (ASUS, Sony, Lenovo, and now OnePlus to name a few).  By "non-information", I mean devices that don't collect and interact with information such as an account or other personal information.  ie, a video card, motherboard, stereo receiver, etc.  A phone though is extremely connected and thus something to be weary of imo.

[RonnieOP]

On 11/22/2019 at 6:29 PM, dizmo said:

Who knows. Any form of information is better than none.

Not really.

 

Chinas government gains nothing by knowing this mass amount of info. What little they coild do with it wouldnt be worth the time and money it costs them to get it.

 

Usually things like these are just hacker/crackers trying to get info so they can use it to try and log in to various other accounts that may share the same info.

 

Theres a huge online marketplace for cracked accounts. Netflix, walmart, amazon, porn, airline, etc. Its not even a dark web market either you can find them with a quick google search. I know of young kids who currently have thousands in btc due to cracking accounts and selling them.

[dizmo]

18 minutes ago, RonnieOP said:

Not really.

 

Chinas government gains nothing by knowing this mass amount of info. What little they coild do with it wouldnt be worth the time and money it costs them to get it.

 

Usually things like these are just hacker/crackers trying to get info so they can use it to try and log in to various other accounts that may share the same info.

 

Theres a huge online marketplace for cracked accounts. Netflix, walmart, amazon, porn, airline, etc. Its not even a dark web market either you can find them with a quick google search. I know of young kids who currently have thousands in btc due to cracking accounts and selling them.

So you figure they'll do it to their own citizens, but no one else?
How naive.