User builds on some Chinese phones are pretty sloppy. I needed to access an old Oppo phone the other day, where I couldn't remember the PIN. Luckily ADB was enabled, which suggests that their production software might have been a userdebug build. I couldn't enable root via ADB, since it was at least a production/user build, but the su binary was already on the phone, so I just su'ed and got a root prompt. From there I could pull the sqlite settings database, reset the PIN and push it again. After a reboot, the phone booted without PIN.
Unfortunately there was an Oppo homebrewn secondary PIN on some of their built in apps, which hadn't been reset, but it turned out I could enter the PIN as many times as I wanted, so I made a small script to brute force it via ADB (input text). Took half an hour to disable the secondary PIN with my script.
I just checked and found it on my OnePlus Two. To other OP owners: make sure you look under "all" apps, not just "downloaded".
After this finding , the data collection incident a month ago, and their last 1Gb+ OTA update that bootlooped my phone, I think I'm done with OnePlus products. I enjoyed the hardware but I can't tolerate this much malice/incompetence in software in something as critical to my daily life.
I'm sure some posters will suggest that this is what we deserve for trusting a Chinese OEM, but I still find it all very sad.
Steal data, brick devices, and leave backdoors: How to lose a customer in three easy steps.
I have a onePlus 3 (which anecdotally has been a lovely handset, just extremely fragile. And onePlus and their repair company have been entirely useless at communication...)
I also have the EngineerMode installed and it's also using data; "61.34mb since 1 Aug".
It's worth noting that the data usage (752kb since Nov 1st) says it also includes other apps, I've listed them below for reference as I've not seen anyone else mention this yet. There's certainly some interesting names.
Content Adaptive Backlight Settings
OnePlus System Service
OnePlus Camera Service
ANT HAL Service
Sensor Test Tool
I've said it on HN before but it bears repeating: If you have a OnePlus, do yourself a favour and put LineageOS on it. It works perfectly on my OP3.
The "secret" password seems to be "angela". OnePlus == DarkArmy confirmed?
All modern mobile phones have a baseband processor with root backdoor. OnePlus is only remarkable for having a second one.
I didn’t knew that engineer mode app could be used for such malice. I bet they didn’t either (btw I know that they should have been more vigilant about what goes into the consumer device). And this app is developed by Qualcomm. I just think that they forgot to remove from user builds (which btw is a bad sign).
Isn't the EngineerMode APK an MTK app? I have been involved in developing an Marshmallow MTK based phone in the past and in my experience their BSP's were pretty messy. I.e. a lot of cleaning up is necessary if you want a relatively quiet logcat and debugging APK's removed - even for user builds.
Edit: I must have remembered wrong or I saw the EngineerMode on the QComm device we developed before our MTK based device. The OnePlus seems to be a QComm device.. :)
More context here: http://www.androidpolice.com/2017/11/13/oneplus-left-backdoo...
Can anyone clarify as to whether there is a mitigation, and post a link?
Found it on my Oneplus X. Maybe this is the time to try out Apple.
Have it on my tablet that's not even Mediatek or Qualcomm, but instead Allwinner A33... Scary. I think I should throw it away. Or, since it comes pre-rooted and in engineer build mode instead of userdebug or prod, I think I just might uninstall the APK from the shell and sleep well tonight.
No one found it just a tad strange that there was a system library called libdoor.so?
EngineerMode: so I fired this up on my OnePlus5 (and subsequently rooted my device). Fun times. Can anyone explain all the features in Engineer Mode? * DDR Aging Test: Some sort of DRAM physical memory test? * SUPL Tool: Tries to connect to supl.google.com:7276 ?? * Network set >> RAT Mode? .... other features test your screen, colors, backlight, NFC, Wifi, etc - would still be helpful if someone with a bit more background could give some color.
I just checked my OnePlus One and it doesn't have the "Engineering mode" app. Maybe because I'm on the original CyanogenOS; I didn't upgrade to Oxygen OS.
I got a very cheap huawei Y300 which stopped working recently.
I think I remember having this app, along with many other weird ones preinstalled.
Also, does anybody knows why some android phones have some "debug mode" when I plug them via USB? I mean if you think about it, that also sounds like a backdoor.
It's not the first time a big security/privacy leak was found on OnePlus' phones. Would stay far away from OnePlus phones.
on OnePlus One you can install Ubuntu Touch https://ubports.com/page/devices