Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoor with root access found from OnePlus phones

twitter.com

Post reply on HN
Print view View original

21–30 of 113 posts

Re: Backdoor with root access found from OnePlus phones

#21

Post by BuildTheRobots »

I have a onePlus 3 (which anecdotally has been a lovely handset, just extremely fragile. And onePlus and their repair company have been entirely useless at communication...)

I also have the EngineerMode installed and it's also using data; "61.34mb since 1 Aug".

It's worth noting that the data usage (752kb since Nov 1st) says it also includes other apps, I've listed them below for reference as I've not seen anyone else mention this yet. There's certainly some interesting names.

OPSkin

com.quicinc.cne.CNEService.CNES...

com.qti.service.colorservice

SmartcardService

SVI Settings

WifiRfTest

Screenshot

com.oneplus.setupwizard

Manage center

com.oneplus.sdcardservice

FidoCryptoService

NVBackupUI

Content Adaptive Backlight Settings

Android System

OnePlus System Service

Wfd Service

applocker

SimContacts Manager

OnePlus Camera Service

Settings Storage

SecureExtAuthService

nfc

SecureSampleAuthService

Input Devices

com.qti.dpmserviceapp

com.oem.logkitsdservice

com.qualcomm.qti.simsettings

Key Chain

Call Management

File manager

org.codeaurora.btmultisim

ANT HAL Service

com.fingerprints.service.Fingerprin...

OnePlusLogKit

BugReportLite

SeempJService

Settings

Tags

LocatonServices

AutoTestServer

com.qualcomm.qti.tetherservice

System Update

MdtpService

com.android.wallpaperbackup

Fused Location

com.qualcomm.fastdormancy

com.qualcomm.qti.biometrics.voic...

QTI Logging

OPConfig

com.qualcomm.timeservice

OPLocationService

Sensor Test Tool

Re: Backdoor with root access found from OnePlus phones

#22

Post by jokoon »

I got a very cheap huawei Y300 which stopped working recently.

I think I remember having this app, along with many other weird ones preinstalled.

Also, does anybody knows why some android phones have some "debug mode" when I plug them via USB? I mean if you think about it, that also sounds like a backdoor.

Re: Backdoor with root access found from OnePlus phones

#24

Post by kbeckmann »

RpFLCL wrote: post #7

I just checked and found it on my OnePlus Two. To other OP owners: make sure you look under "all" apps, not just "downloaded". After this finding , the data collection incident a month ago, and their last 1Gb+ OTA update that bootlooped my phone, I think I'm done with OnePlus products. I enjoyed the hardware but I can't tolerate this much malice/incompetence in software in something as critical to my daily life. I'm…

Can confirm that the privilege escalation works on OnePlus 2 as well.

Re: Backdoor with root access found from OnePlus phones

#25

Post by Phemist »

porfirium wrote: post #19
Phemist wrote: post #8

The "secret" password seems to be "angela". OnePlus == DarkArmy confirmed?

Isn't it "code"?

"code" is the name of the intent extra.

See:

https://twitter.com/fs0c131y/status/930127615389851648

and:

https://twitter.com/fs0c131y/status/930128095503441920

Re: Backdoor with root access found from OnePlus phones

#28

Post by asfdsfggtfd »

mino wrote: post #18
RpFLCL wrote: post #7

I just checked and found it on my OnePlus Two. To other OP owners: make sure you look under "all" apps, not just "downloaded". After this finding , the data collection incident a month ago, and their last 1Gb+ OTA update that bootlooped my phone, I think I'm done with OnePlus products. I enjoyed the hardware but I can't tolerate this much malice/incompetence in software in something as critical to my daily life. I'm…

> I enjoyed the hardware but Do like me, if you don't want to trash a OnePlus device: install LineageOS.

Do you trust there not to be lower level issues?

Re: Backdoor with root access found from OnePlus phones

#29

Post by mads »

User builds on some Chinese phones are pretty sloppy. I needed to access an old Oppo phone the other day, where I couldn't remember the PIN. Luckily ADB was enabled, which suggests that their production software might have been a userdebug build. I couldn't enable root via ADB, since it was at least a production/user build, but the su binary was already on the phone, so I just su'ed and got a root prompt. From there I could pull the sqlite settings database, reset the PIN and push it again. After a reboot, the phone booted without PIN.

Unfortunately there was an Oppo homebrewn secondary PIN on some of their built in apps, which hadn't been reset, but it turned out I could enter the PIN as many times as I wanted, so I made a small script to brute force it via ADB (input text). Took half an hour to disable the secondary PIN with my script.

Post reply on HN