Just a month after users reported illegal collection of their personal information by OnePlus, a new one arrives reporting the existence of a backdoor in OnePlus Smartphones.
This specific report was made via Twitter by Elliot Anderson, who stated that this backdoor is found on devices running OxygenOS and can give someone root access without even having to unlock the phone's bootloader.
'EngineerMode', for those who don't know, is a diagnostic software tool used by smartphone manufacturers and technicians to check the hardware components of a mobile phone. This particular application was probably forgotten pre-installed on the OnePlus 2, OnePlus 3, OnePlus 3T and the new OnePlus 5.
You can check it yourself by going to Settings>Apps and enabling the Show System Apps option from the Menu in the top right (3 vertical dots).
Analyzing the EngineerMode app a little, the user discovered that in the 'DiagEnabled' option if you give the code “Angela” (He used reverse engineering to find it), you get root access without unlocking the bootloader. Although in practice the chances of this happening to a user are slim, OnePlus owners are worried as with a simple command someone can have root access.
Qualcomm, which equips OnePlus with the Snapdragon chipset, also addressed the issue, stating that the code in 'EngineerMode' is not the original one they had written and that it has been modified in the updates that have been made from time to time.
The official announcement from OnePlus states that although this method does indeed allow someone to have adb root access, it does not allow third-party applications to be installed. It emphasized that this is not a major security flaw, but to reassure users, it confirmed that a fix will be offered immediately.
