OnePlus 3 exposes unecrypted IMEI to local network when checking for updates

[evilarceus]

Source: http://www.droid-life.com/2016/07/05/oneplus-3-imei/

 

 

Quote

According to users on reddit and the OnePlus forums, every time an owner of a OnePlus 3 checks to see if they have an update via the Settings menu, their IMEI is sent to the OnePlus servers in plain HTTP and not HTTPS. Because of this, OnePlus 3 owners on an unsecured network (a coffee shop with public WiFi access point, for example), potentially expose their device’s specific IMEI number to would-be evil doers. 

 

With an IMEI in the hands of someone not so trustworthy, a device could be blacklisted (marked as stolen, lost, etc.) in a carrier’s database, making the possibility of activating it on a network extremely difficult. This action can be reversed by the true owner of a device, but you can imagine it’s not the easiest process to deal with when it involves US carriers.

 

To sum up what’s happening here, every time you select “check for updates,” a POST request is sent to a specific URL from the OnePlus 3. This request contains the IMEI of the device in the user agent, as well as in a header labeled “imei.”

This could be a serious security issue for OnePlus 3 owners who are connected to public WiFi. Let's hope they fix this with an update ayyyy

 

[imreloadin]

11 minutes ago, evilarceus said:

Source: http://www.droid-life.com/2016/07/05/oneplus-3-imei/

 

 

This could be a serious security issue for OnePlus 3 owners who are connected to public WiFi. Let's hope they fix this with an update ayyyy

 

Well, that seems.....problematic....

[Maihym]

Is it the same for the OnePlus Two?

[SurvivorNVL]

Y'know.. I am really glad I didn't get this phone.  The M8 will be replaced with an iPhone 7.  x.x

[ShadowCaptain]

SMART

[Lays]

It's a shame I can't even use mine, had to send it in for RMA because it was essentially DOA.

[2FA]

This is why you hire security experts to validate and test your network and devices for potential flaws. Don't just take the engineer's word for it unless they are trained in cybersecurity. This is coming from a Network and Computer Security major.

[Trixanity]

I don't get how http is still a thing. Pretty much all browsers and other internet related 'authorities' are advocating against http and are blocking/phasing out http. 

https, OnePlus, https. How hard is it? It would seem their update servers aren't maintained properly. Lots of old software also contacts servers over http. It's mind-blowing that no one tests these things or goes over their old shit to see if it's still up to date on best practices etc.

[AlTech]

And this is why you don't trust some random Chinese company.......................

[Suika]

Suddenly not regretting my decision to go with the S7.

[BuckGup]

3 minutes ago, AluminiumTech said:

And this is why you don't trust some random Chinese company.......................

Let's buy iPhones assembled by them instead

[AlTech]

2 minutes ago, SamStrecker said:

Let's buy iPhones assembled by them instead

I never said people should buy iPhones.

[BuckGup]

4 minutes ago, AluminiumTech said:

I never said people should buy iPhones.

No I was playing off the whole china thing

[evilarceus]

2 hours ago, Trixanity said:

I don't get how http is still a thing. Pretty much all browsers and other internet related 'authorities' are advocating against http and are blocking/phasing out http. 

https, OnePlus, https. How hard is it? It would seem their update servers aren't maintained properly. Lots of old software also contacts servers over http. It's mind-blowing that no one tests these things or goes over their old shit to see if it's still up to date on best practices etc.

HTTPS certificates costs money, but for a multimillion dollar company, it's still pretty sad.

[Trixanity]

6 minutes ago, evilarceus said:

HTTPS certificates costs money, but for a multimillion dollar company, it's still pretty sad.

Security breaches and lawsuits are worse I'd wager.

[patrick3027]

14 hours ago, imreloadin said:

Well, that seems.....problematic....

Would be great if you put a picture of the 1+3 instead of a 1+1.

[imreloadin]

4 hours ago, patrick3027 said:

Would be great if you put a picture of the 1+3 instead of a 1+1.

It's a picture of the back of a OnePlus Two actually, and I'm not the OP so yeah....

[Celmor]

11 hours ago, Trixanity said:

I don't get how http is still a thing. Pretty much all browsers and other internet related 'authorities' are advocating against http and are blocking/phasing out http. 

https, OnePlus, https. How hard is it? It would seem their update servers aren't maintained properly. Lots of old software also contacts servers over http. It's mind-blowing that no one tests these things or goes over their old shit to see if it's still up to date on best practices etc.

HTTP still has its place for using the web for querying non-sensitive information as it requires less processing, no maintained certificates and easier implementation on the software side (less points of failure/bugs/security vulnerabilities). Even for streaming of media or software like games SSL is not absolutely imperative as long as the data is confirmed on the receiving side.

For user generated data, form submission, authentication etc. SSL or other encryption is absolutely mandatory in my eyes what many fail to implement like shown here.

I wouldn't just declare a protocol as deprecated just because it doesn't satisfy all use cases where as an alternative would while requiring overhead.

Web service would always be my recommended standard for machine-to-machine communication rather than even https while just downloading information from a web-server after providing sensitve information in the user string which is a piss-poor implementation.

I agree with your last point though, a software (embedded or on its own) solution that communicates over the internet or even just on LAN always has to be tested on security / encryption if used and vulnerabilities.

 

DRM/protection against abuse is probably always going to better protected than user data, its just a matter of prioritizing interests for the company.

Personally I'd always encrypt my traffic as far as I can (i.e. VPN when on public WiFi), the problem here still is this sensitive information is not just transferred unprotected over any WiFI/Lan but also over the internet.

I hope OnePlus responds soon, even if it's just for PR and not really getting better in protecting the interests of the user.

Currently I do have a OnePlus X but I rather prefer to always use a custom ROM throw all the Google crap off of my phone and block all apps from leaking my data as best as I can via permissions and blocking Internet access for apps that don't need it alltogether, same thing I do on Windows.

[BHS4K]

Cyanogenmod to the rescue!

[Trixanity]

8 hours ago, Celmor said:

snip

Yes, http is easier and less demanding and does have its use cases but sending IMEI over a http connection is stupid as hell. Any personal information or sensitive information should always be encrypted no matter what. Yet a lot of old software still use http and has not been updated including support and update software where you could pick up personal info or tamper with updates.

 

I'd like all traffic to be encrypted but I realize that's a tall order. All I ask is that they at least secure things that needs it such as the transmission of IMEI numbers.