Saturday, June 9, 2018

OnePlus 6 bootloader vulnerability lets anyone with access into your phone

Flaw allows a modified boot image to load and grant complete admin control to anyone with the know-how.

The OnePlus 6 is a really great phone for not a lot of money. We can see why anyone would want to buy one, and if you did you need to be aware of a new exploit that could give the right person complete control over your device.

First reported at XDA Developers, president of Edge Security Jason Donenfeld (under his XDA user name zx2c4) shows that the flaw allows a person who has access to your phone and a computer to boot the system using a modified image. Notice the "has access to your phone and a computer" part — this only works when the phone is tethered via USB to a computer with the right tools and software. Nothing you download or install can do this.

This exploit works while the bootloader is still locked. That means it doesn't depend on you having already enabled developer settings, enabled USB debugging, or enabled bootloader unlocking. That's why it's a serious problem even though you can unlock the bootloader on the OnePlus 6 manually if you like.

A custom image that places files in the correct location and changes a few system parameters can alter the system permanently, which could allow the OnePlus 6 to be rooted. While some users might think rooting a phone while keeping the bootloader locked is a good thing, having an exploit that allows anyone to do it once they have your phone in their hands is not.

OnePlus has responded to an inquiry by Android Police and says:

We take security seriously at OnePlus. We are in contact with the security researcher, and a software update will be rolling out shortly.

We hope this can be fixed in short order by a simple over-the-air update.



from Android Central - Android Forums, News, Reviews, Help and Android Wallpapers https://ift.tt/2sVoPS2
via IFTTT
Posted by at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)