Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor with root access found from OnePlus phones

twitter.com

Post reply on HN
Print view View original

71–80 of 113 posts

Re: Backdoor with root access found from OnePlus phones

#71

Post by nucleardog »

dopamean wrote: post #52
SmellyGeekBoy wrote: post #34

I've said it on HN before but it bears repeating: If you have a OnePlus, do yourself a favour and put LineageOS on it. It works perfectly on my OP3.

I just asked another commenter who suggested Lineage to talk a little about their experience with it since I just flashed PA onto my 3t this past Friday. I'm going to check it out a bit today. Do you know if it's a simple process to go from PA -> Lineage? A little about me: I am a pretty experience developer but not much of a tinkerer when it comes to phones. This flash to PA is only the third time I've done this wit…

Not sure specifically how you installed PA, but, generally, that would look something like:

    1. Unlock bootloader
    2. Install aftermarket recovery (CWM or TWRP)
    3. Install new ROM (PA)
Now that you've done 1 and 2 (usually the difficult parts), you really just need to repeat step 3 with a different ROM.

Assuming you have TWRP installed, LineageOS has instructions for your specific situation (installing from recovery) at: https://wiki.lineageos.org/devices/oneplus3/install#installi...

If you have CWM or something else, it should be relatively easy to translate the instructions to your specific situation. If you have trouble, you can just start from the beginning of that document for instructions to install TWRP instead.

If you want Google Apps (gmail, etc) installed, you'll need to download that from here: http://opengapps.org/ (ARM64, 7.1) and treat that as your "additional packages" for the purposes of those instructions.

Re: Backdoor with root access found from OnePlus phones

#72

Post by matwood »

zeveb wrote: post #60
jetpks wrote: post #46

Earlier quoted context omitted.

As a long time iPhone user that swings Android every few years to try the waters, I am consistently blown away at the level of garbage Android users are expected to deal with on a regular basis. Want to know how many times my iPhones have boot looped in the last nine years? Not once ever. My last Android (Nexus 6p) managed to do it several times in the 3-ish months I daily-drove it. Want to know how long you can expe…

> I am consistently blown away at the level of garbage Android users are expected to deal with on a regular basis. My girlfriend uses an iPhone; I am consistently blown away by the amount of garbage she's expected to deal with on a regular basis. When she changes to another app, our video chats go dark; there's no Termux or GNURoot equivalent (that I'm aware of); tapping doesn't move the cursor but instead selects wo…

> she's stuck using Safari and seeing ads. So, so many ads. Ads everywhere. I never see ads on my phone, but on hers the Internet is nothing but ads as far as the eye can see.

Purify is an ad blocker that works great on the iPhone. Content blockers have been a supported part of iOS for the last couple versions. Apple actually caught a lot of flack from websites for allowing them.

> But at least with Android I have freedom.

Freedom to send all your data to Google? Sure, you can install custom ROMs, but now you're squarely out of any normal user scenario.

> That's because with an iPhone there are no custom OSes and you're stuck with Apple's user-hostile features.

You're considering Apple user hostile when the only way to get around Androids lack of security updates is to go deal with custom ROMs? Apple tends to make the best decision for the largest amount of users. Do they always match up with my decisions? No, but they are close enough, and I don't have to deal with the Android mess when all I want is a working phone.

Re: Backdoor with root access found from OnePlus phones

#73

Post by levesque »

mino wrote: post #18
RpFLCL wrote: post #7

I just checked and found it on my OnePlus Two. To other OP owners: make sure you look under "all" apps, not just "downloaded". After this finding , the data collection incident a month ago, and their last 1Gb+ OTA update that bootlooped my phone, I think I'm done with OnePlus products. I enjoyed the hardware but I can't tolerate this much malice/incompetence in software in something as critical to my daily life. I'm…

> I enjoyed the hardware but Do like me, if you don't want to trash a OnePlus device: install LineageOS.

Third party software is always a bumpy ride. Something is going to not work out of the box, optimization will be less than stellar, battery usage won't be as good. I cannot tolerate my cellphone not working 100% of the time.

Re: Backdoor with root access found from OnePlus phones

#74

Post by danjoc »

dmos62 wrote: post #54
danjoc wrote: post #48

All modern mobile phones have a baseband processor with root backdoor. OnePlus is only remarkable for having a second one.

Reference, or explanation?

https://en.wikipedia.org/wiki/Mobile_baseband

If it has GSM/LTE/CDMA/etc baseband processor with closed implementation, assume it has remote root backdoor. Samsung has already been caught.

osmocombb tried to solve this. That project is essentially dead.

Re: Backdoor with root access found from OnePlus phones

#75

Post by ksk »

shpx wrote: post #40
therealmarv wrote: post #11

It's not the first time a big security/privacy leak was found on OnePlus' phones. Would stay far away from OnePlus phones.

I would stay away from proprietary software, especially if it was written in Russia or China. All of their tech companies owe their entire existence to their respective governments and it's not like the governments set up that environment for them for free.

>I would stay away from proprietary software, especially if it was written in Russia or China.

Why? What have you found in proprietary software written in China and Russia?

Re: Backdoor with root access found from OnePlus phones

#76

Post by dopamean »

nucleardog wrote: post #71
dopamean wrote: post #52

Earlier quoted context omitted.

I just asked another commenter who suggested Lineage to talk a little about their experience with it since I just flashed PA onto my 3t this past Friday. I'm going to check it out a bit today. Do you know if it's a simple process to go from PA -> Lineage? A little about me: I am a pretty experience developer but not much of a tinkerer when it comes to phones. This flash to PA is only the third time I've done this wit…

Not sure specifically how you installed PA, but, generally, that would look something like: 1. Unlock bootloader 2. Install aftermarket recovery (CWM or TWRP) 3. Install new ROM (PA) Now that you've done 1 and 2 (usually the difficult parts), you really just need to repeat step 3 with a different ROM. Assuming you have TWRP installed, LineageOS has instructions for your specific situation (installing from recovery) a…

I have TWRP installed. Thanks for the links. It looks like this will be simpler than I thought. I'm a little paranoid about bricking my phone as I only bought it a year ago and I'd have to have to get another.

Re: Backdoor with root access found from OnePlus phones

#77

Post by richardwhiuk »

ethagnawl wrote: post #63
hanklazard wrote: post #41

Earlier quoted context omitted.

I’ve made the same decision re: android and apple. I really wish there was a decent Linux phone I could buy ... anyone know if there are any good contenders or future prospects?

It hasn't been released yet, but Purism recently smashed their fundraising goal for the Librem 5. From the description linked to below: > Librem 5, the phone that focuses on security by design and privacy protection by default. Running Free/Libre and Open Source software and a GNU+Linux Operating System designed to create an open development utopia, rather than the walled gardens from all other phone providers. https…

Because a small fly by wire company is likely to have better QA than a much larger company....

Re: Backdoor with root access found from OnePlus phones

#78

Post by ksk »

mads wrote: post #29

User builds on some Chinese phones are pretty sloppy. I needed to access an old Oppo phone the other day, where I couldn't remember the PIN. Luckily ADB was enabled, which suggests that their production software might have been a userdebug build. I couldn't enable root via ADB, since it was at least a production/user build, but the su binary was already on the phone, so I just su'ed and got a root prompt. From there…

My Chinese phone (iPhone 6s) had a similar flaw. Okay, that was tongue in cheek, but I don't see how adding the China qualifier adds anything new or interesting other than inject bias.

Re: Backdoor with root access found from OnePlus phones

#79

Post by jokoon »

staz wrote: post #33
jokoon wrote: post #22

I got a very cheap huawei Y300 which stopped working recently. I think I remember having this app, along with many other weird ones preinstalled. Also, does anybody knows why some android phones have some "debug mode" when I plug them via USB? I mean if you think about it, that also sounds like a backdoor.

USB debug mode is a standard feature of Android that is disabled by default, but it's possible to enable it manually. If you see it without having enabled it, it is indeed strange https://www.kingoapp.com/root-tutorials/how-to-enable-usb-de...

Yes it seems to be enabled by default, I disable it from time to time.

At that point there are so many critical security flaw coming up every month that I don't really bother anymore.

Re: Backdoor with root access found from OnePlus phones

#80

Post by nucleardog »

dopamean wrote: post #76
nucleardog wrote: post #71

Earlier quoted context omitted.

Not sure specifically how you installed PA, but, generally, that would look something like: 1. Unlock bootloader 2. Install aftermarket recovery (CWM or TWRP) 3. Install new ROM (PA) Now that you've done 1 and 2 (usually the difficult parts), you really just need to repeat step 3 with a different ROM. Assuming you have TWRP installed, LineageOS has instructions for your specific situation (installing from recovery) a…

I have TWRP installed. Thanks for the links. It looks like this will be simpler than I thought. I'm a little paranoid about bricking my phone as I only bought it a year ago and I'd have to have to get another.

It's generally really hard to truly brick a phone these days.

People throw around the term like it's lost all meaning - usually when someone says they "bricked" their device, they're meaning that "it was moderately inconvenient to recover and I lost my data". Not that it's a literal brick that they now put in the garbage bin.

If you've got recovery, you've got an easy path to getting it up and running again. Just reflash your ROM, a different ROM, a stock ROM, whatever.

If you hose your recovery, you boot your phone into fastboot/odin/heimdall/etc mode which is built into the phone's firmware. From there, you can still flash images to the internal partitions to replace your recovery/system/anything else.

I don't wanna be the guy that doesn't include the "there's always risk" warning on his instructions, but if you're just flashing back and forth between ROMs the worst I'd ever expect you to mess up is wiping your internal storage and photos by accident.

Post reply on HN