OnePlus left EngineerMode APK in end user OxygenOS builds, easily rootable

OnePlus OxygenOS Root Access Backdoor

He further claims that the company has intentionally left the backdoor on their devices.

A developer managed to use this very app to root the device by figuring out the password used to gain root access.

According to one developer named as Elliot Alderson, OnePlus has an application called as "EngineerMode", which is basically used to check whether the unit is working properly or not in the factory. Having root access essentially means the user has complete control over the device, including privileged control over features that would otherwise be locked up.

The Engineer Mode APK is capable of diagnosing Global Positioning System, run automated tests, check root status among other things.

More news: TripAdvisor adds badge to mark hotels where sexual assaults are reported

While it appears OnePlus is responsible for leaving Engineer Mode on its devices, it is not directly responsible for the application itself or the backdoor it creates. The staff member reassured users by saying that third-party apps can't gain full root privileges from EngineerMode. A developer has found an application that can be manipulated into to granting a backdoor root access.

OnePlus users can find the app pre-installed by going into Settings Apps Menu Show System Apps and search for EngineerMode in the app list. The company already drew criticism earlier this year over its onerous data collection practices, in which the company sucked up sensitive data from user devices and transmitted that information with each device's serial number attached.

While the vulnerability allows attackers to use the EngineerMode app to fully compromise devices, a mitigating factor is that local access to devices is needed - no remote exploit is available.

OnePlus co-founder Carl Pei has acknowledged the issue, and insisted that the company is looking into it. "Thanks for the heads up, we're looking into it", Pei said on Twitter.

Related News:

  • 3 shot at Rancho Tehama School in Tehama County

    3 shot at Rancho Tehama School in Tehama County

    A man says his roommate is among the victims in Northern California and that his neighbor was the gunman. It was "very clear" early on that "we had a subject that was randomly picking targets", he said .
    Barbie Unveils New Doll Wearing A Hijab

    Barbie Unveils New Doll Wearing A Hijab

    Barbie and Mattel have been shifting their image to become more racially diverse via their You Can Be Anything campaign . The doll looks like a copy of the woman athlete: the new Barbie doll wears a fencer's suit and has a fit figure.
    Israel shoots down drone over Golan Heights

    Israel shoots down drone over Golan Heights

    If it hadn't been for Russia's air support, Iran's militias would not have expanded and would not have even survived defeat. Iran has no borders with Syria, yet it is the country with the most active military action and is the most expanding.
  • Russia Used Video Game Screenshots to

    Russia Used Video Game Screenshots to "Prove" the US Is Assisting ISIS

    The Russian Defense Ministry did what every other troll does when caught red-handed - it deleted both posts. It later reposted the same statement with different images.
    IPhone X Face ID Fooled with a $150 Mask

    IPhone X Face ID Fooled with a $150 Mask

    A stylus called the "Apple Pencil" was also reported to be in progress and is expected to launch along with the new tablet. Several users have pointed out that the Face ID lock icon at the top doesn't open when the phone is facing the mask.
    Tunisia complete Africa's World Cup line-up with Libya draw

    Tunisia complete Africa's World Cup line-up with Libya draw

    For the record, the Atlas Lions team now managed by Hervé Renard, was qualified in the past to the World Cup in 1970, 1986, 1994, 1998.
  • EA slashes Battlefront 2 unlock hero costs after backlash

    Unlocking a hero is a great accomplishment in the game, something we want players to have fun earning. There is a dark cloud surrounding the forward-facing community aspects of Star Wars Battlefront 2 .
    Taylor Swift Disses Kanye West And Jay Z In New Song

    Taylor Swift Disses Kanye West And Jay Z In New Song

    Swift shared the posts with her 104 million followers and together, they have accumatated an impressive 2.9 million likes. So it's pretty much safe to say that this might have been the peak "nice things" that she refers to in the song.
    Report shows high levels of lead in certain fidget spinners

    Report shows high levels of lead in certain fidget spinners

    A toy that spun out of control in popularity is now being called into question for its potential lead levels. There are no lead-level prohibitions for products marked for children 12 and over.
  • Same-sex marriage laws slated for Thursday

    Same-sex marriage laws slated for Thursday

    It also includes exemptions so religious organisations can refuse to conduct same-sex marriages. There are now two prominent proposals for marriage equality that parliament could take up.
    Google responds to Missouri investigation

    Google responds to Missouri investigation

    Also of interest to Hawley's investigation is the roughly 70 percent of all card transaction information that Google collects. He says the company will be held accountable and Missouri is not giving Google a free pass.
    Twitter doesn't even know what

    Twitter doesn't even know what "verification" means anymore

    In other words, if you're not newsworthy by Twitter's standards, you may be denied verification. Verified accounts also take priority in searches.


Most liked

The Dream Chaser Spacecraft
The craft was made by the Sierra Nevada Corporation and was tested at NASA's Armstrong Flight Research Center in California. It's called a lifting body plane due to the lift being created by the body of the vehicle rather than the wings.

Trump chooses drug executive as health secretary
Trump said in a tweet Monday. "Happy to announce, I am nominating Alex Azar to be the next HHS Secretary", Trump wrote on Twitter. Bush's administration, serving as HHS's general counsel from 2001 and 2005 and becoming deputy secretary until 2008.

Qualcomm 'set to reject' Broadcom takeover offer
Qualcomm has been facing a series of investigations around the world linked to its dominance in the smartphone chip segment. Inside sources claim that Qualcomms board of directors will reject Broadcoms offer to acquire the Snapdragon chip designer.

Chevrolet Corvette ZR1: Fastest. Vette. Ever
The kit also includes special chassis tuning and Magnetic Ride Control, along with Michelin Pilot Sport Cup 2 summer tires. Both of the wing options are tied into the chassis, which is how it is in the Corvette Racing C7.R version, ass well.

Google Pixel 2 XL has a problem with responsiveness at screen edges
Other offers include a cashback of Rs. 8000 if they use an EMI on HDFC Card to buy the Pixel 2 or the Pixel 2 XL phone. As reported by Android Police , this issue has been affecting the touch response on some portions of the display.

Sweden and Italy gear up for World Cup playoff clash
However, the latest reports suggest that he is now being courted by two national teams who would largely benefit from his arrival. You can listen to Italy v Sweden in the World Cup play-off second leg live on talkSPORT2, on Monday, November 13 from 19:45 .

Redskins receiver Jamison Crowder returning from injury against Vikings
Crowder, 24, played in his first 40 National Football League games (20 starts) before missing the Seattle game. Keenum finished the contest with 27 completions for 288 yards, two touchdowns, and an interception.

Duterte offers to hold human rights world summit
The Philippines president said last month: "You think that we are a bunch of morons here. I take care of my country and I will nurture my country to health".

16 killed, 7 missing in boat capsize near Vijayawada; govt announces compensation
The Andhra Pradesh Tourism Department has given permission for private agencies to operate boats to Bhavani Island regularly. As many as 20 passengers, who were wearing life jackets, managed to swim to the shore safely.

Butch Jones out as Tennessee's head coach, search for replacement underway
Tennessee last won an SEC championship in 1998, the same year the Vols won the national championship with an unbeaten 13-0 record. Butch Jones is out as the head coach of the Vols, and Brady Hoke is officially the interim coach for the remainder of the season.

DeShone Kizer leaves Browns vs. Lions game with injury
With seven more games to go, the Browns are hoping to avoid becoming only the second team to go 0-16, a record held by the Lions. The Browns made mistakes, including at the end of the first half when they botched the most basic elements in clock management.

AT&T CEO: DOJ never demanded CNN sale in Time Warner deal
AT&T has argued against selling off either company's assets, as it believes this would undercut the rationale for the tie-up. The wireless giant had previously said that it expected the acquisition to take effect by the end of this year.

Score predictions for Georgia-Auburn, Notre Dame-Miami, 20 other games
But the Tigers will need a lot of help even if they beat Georgia twice and Alabama once to win the SEC championship . Both teams linger behind four one-loss teams : Notre Dame , Clemson, Oklahoma and No. 6 TCU.

New Self-Driving Shuttle in Las Vegas Crashes Just Hours After Launch
The crash happened within the shuttle's first hour of operation, according a report from local Las Vegas NBC affiliate KSNV . Police say no injuries were reported crash between the self-operating vehicle and a semi-truck.

China's Single Day - bigger than Black Friday and expected to smash $20bn
Other retailers will be trying to replicate Alibaba's success on Singles Day. Citigroup Inc. estimates this year's sales could reach $24 billion.