OnePlus accidentally left an application which can allow for root access

[D13H4RD]

Well, here’s another one of those “Oops” moments.

 

If you’re not familiar, Android (and other Linux-based operating systems) have so-called ‘Superuser’ access, which grants system-level access. Many enthusiasts desire root access as it allows for system-level modifications, although malicious software can also force itself access to it, compromising security and also possibly breaking the device, hence the reason new Android phones have dm-verity enabled. 

 

OnePlus hasn’t exactly gotten a good eye for security, after it was found that the company was sending personal data back to its servers without prior user consent. Well, here’s another one, and yes, as mentioned earlier, it’s one of those “Oops” moments.

 

Quote

A user on Twitter who goes by the name “Elliot Anderson” (named after the main character of the popular Mr. Robot television series) has discovered that OnePlus accidentally left in place a diagnostic testing application made by Qualcomm. After decompiling this application, he discovered that it can be exploited to grant root access—effectively acting as a backdoor.

 

The application is called “EngineerMode” and it’s essentially a system application made by Qualcomm and provided to OEMs like OnePlus in order for OEMs to easily test all hardware components of the device. The application is pre-installed on all OnePlus 3, OnePlus 3T, and OnePlus 5 devices and can be easily accessible through any activity launcher as all of the app’s activities are exported.

 

We actually covered the existence of this application several months ago, but at the time we had no idea what it could be used for. The Twitter user decompiled the application (its source has been posted online here) and found an interesting activity called DiagEnabled. In particular, one method stood out within the activity: escalatedUp. This method accepts a boolean value (true/false) and a string. The string is a password that is checked by the method before it sets the system properties persist.sys.adbroot and oem.selinux.reload_policy to 1.

 

The first system property is particularly interesting as it allows the user to run ADB as root. This immediately opens up the possibility of acquiring full root access on the phone—all without unlocking the bootloader. So how exactly do you get the EngineerMode app to set these system properties to be ‘1’?

@fs0c131y needed to find the correct password to send in the intent in order to pass the logic in the method posted above. Finding this password is not a simple task, however. He decompiled the library responsible for generating the password (called libdoor.so) and found where the password hash was located: /data/backup/fpwd. The password is generated from various build properties such as ro.product.model and ro.product.brand and would not be easy to reverse engineer.

 

Luckily with the help David Weinstein and Now Secure on Twitter, he discovered the password needed by EngineerMode in order to escalate ADB to root privileges.

Source: https://www.xda-developers.com/oneplus-root-access-backdoor/

 

This means that with some savvy coding, you can in theory, gain root access to a OnePlus without a bootloader unlock. However, having 2 security blunder twice isn’t exactly confidence inspiring.

[dizmo]

Hahaha. Wow. Glad I never actually used the OnePlus phones I bought.

I wonder if they'll face any backlash for any of the missteps they've made. They're even getting rid of the zoom in the 5T (which, lets face it, is basically a copy of the new Oppo). I lost complete interest in them as a company with the information farming.

[D13H4RD]

Just now, dizmo said:

Hahaha. Wow. Glad I never actually used the OnePlus phones I bought.

I wonder if they'll face any backlash for any of the missteps they've made. They're even getting rid of the zoom in the 5T (which, lets face it, is basically a copy of the new Oppo). I lost complete interest in them as a company with the information farming.

Probably not because they’re the internet darling to some people.

[BingoFishy]

10 minutes ago, dizmo said:

Hahaha. Wow. Glad I never actually used the OnePlus phones I bought.

I wonder if they'll face any backlash for any of the missteps they've made. They're even getting rid of the zoom in the 5T (which, lets face it, is basically a copy of the new Oppo). I lost complete interest in them as a company with the information farming.

OnePlus is literally part of Oppo.

[dizmo]

Just now, BingoFishy said:

OnePlus is literally part of Oppo.

Part of BBK, but yeah. Same umbrella.

[D13H4RD]

18 minutes ago, BingoFishy said:

OnePlus is literally part of Oppo.

Wholly owned subsidiary 

 

No surprise then that the OP5 looks like an Oppo R11.

 

The 5T looks like the R11s, which in turn, looks like the Vivo V7 from the front 

[potoooooooo]

 

"by accident"

 

Lol these guys are grade a assholes, this was no mistake. They don't give a shit about the consumer, they just want your money.

[D13H4RD]

30 minutes ago, huilun02 said:

And then there's XDA. Oneplus makes the bootloader super easy to unlock for a reason. 

That’s the official method.

 

This method is unofficial and considered an unintentional exploit

[FourCorners]

I don't really know what to feel as I read this thread on my realatively new One Plus 5...

 

I've been happy with the performance of my OP5, however all this news coming out about OnePlus doing all this shady shit doesn't really aspire confidence

[vorticalbox]

2 hours ago, potoooooooo said:

 

"by accident"

 

Lol these guys are grade a assholes, this was no mistake. They don't give a shit about the consumer, they just want your money.

Tbh look how much work went into getting the password, it took a team so even if malware were made to exploit it its not like it would get much return. 

[Bananasplit_00]

2 hours ago, huilun02 said:

And then there's XDA. Oneplus makes the bootloader super easy to unlock for a reason. 

My OP2 literally factory reset as I was doing it... 

 

Anyway I have no trust in Oneplus and will not be buying another one of their devices. They have strayed to far from their goal with too high prices

[D13H4RD]

9 minutes ago, Bananasplit_00 said:

My OP2 literally factory reset as I was doing it... 

Um, that’s what it’s supposed to do.

 

When you unlock the BL, your data is wiped. Nexus phones do this too.

[Bananasplit_00]

1 hour ago, D13H4RD2L1V3 said:

Um, that’s what it’s supposed to do.

 

When you unlock the BL, your data is wiped. Nexus phones do this too.

not from what i found online, but i didnt even get to unlock it before it wiped, it wasent suposed to wipe when it did

[sof006]

I'm glad I went off OnePlus years ago. I remember I tried out the OnePlus 2 and it was horrible, finger print scanner was mediocre at best. Phone felt sluggish and just didn't work in general. Sent it back and got a refund.

 

Seeing all this justifies my reasons for not wanting to buy another one. 

[captain_to_fire]

6 hours ago, FourCorners said:

I don't really know what to feel as I read this thread on my realatively new One Plus 5...

 

I've been happy with the performance of my OP5, however all this news coming out about OnePlus doing all this shady shit doesn't really aspire confidence

I think you can still return it. ??‍♂️

[Kobathor]

9 hours ago, D13H4RD2L1V3 said:

Um, that’s what it’s supposed to do.

 

When you unlock the BL, your data is wiped. Nexus phones do this too.

Same with my Huawei Honor 5x, when I unlocked the bootloader it factory reset my device.

[OmJo93]

Ugh.

 

OnePlus is one of the few companies that still offers relatively affordable flagships. Many consider their phones as the successor to the Nexus lineup in a way, in that it's cheap and very developer friendly. Frustrating to see the company do so much shady and careless crap like this. 

[Silentprototipe]

Well there goes OnePlus for me, I was slightly considering it but nope. Id rather not anymore. I guess I really am going full Moto 

[OmJo93]

11 hours ago, Bananasplit_00 said:

not from what i found online, but i didnt even get to unlock it before it wiped, it wasent suposed to wipe when it did

Pretty sure it's a security feature. So if somebody steals your phone they can't get access to it by simply unlocking the bootloader and rooting it. I wouldn't use a phone that doesn't wipe on unlocking the bootloader.

 

Where did you find a method to do it without a data wipe? 

[Bananasplit_00]

Just now, OmJo93 said:

Pretty sure it's a security feature. So if somebody steals your phone they can't get access to it by simply unlocking the bootloader and rooting it. I wouldn't use a phone that doesn't wipe on unlocking the bootloader.

 

Where did you find a method to do it without a data wipe? 

it was suposed to do it, just not where it did it. this was before getting into the real unlock, right before i was about to pull a backup

[DildorTheDecent]

*Googles OnePlus*

 

>Shenzhen based

 

Would say I'm surprised, I'm not. 

[OmJo93]

10 minutes ago, Bananasplit_00 said:

it was suposed to do it, just not where it did it. this was before getting into the real unlock, right before i was about to pull a backup

What are/were you trying to backup?

 

 

[Bananasplit_00]

Just now, OmJo93 said:

What are/were you trying to backup?

 

 

my data, video i watched said these were the steps to get to the backup of the entire phone, so i never botherd to back up the 25gb of irreplacable files on it before then

[LAwLz]

2 hours ago, silentprototipe said:

Well there goes OnePlus for me, I was slightly considering it but nope. Id rather not anymore. I guess I really am going full Moto 

Fun fact: The same program has been found on Moto phones.

[D13H4RD]

18 minutes ago, LAwLz said:

Fun fact: The same program has been found on Moto phones.

Really, most Snapdragon devices would have it as its main purpose is being a diagnostic app.

 

That said, shouldn’t have been there when it’s shipped.