Incident: OnePlus EngineerMode Backdoor Security Vulnerability Incident

Published Date: 2017-11-14

Postmortem Analysis
Timeline 1. The software failure incident involving the EngineerMode backdoor on OnePlus phones happened in November 2017. 2. Article 65170 was published on November 15, 2017, providing details about the incident. 3. Therefore, the software failure incident occurred in November 2017.
System 1. EngineerMode software on OnePlus phones [Article 65170, Article 65136]
Responsible Organization 1. OnePlus [65170, 65136] 2. Qualcomm [65170]
Impacted Organization 1. Users of OnePlus smartphones [65170, 65136] 2. Qualcomm (due to false attribution of the EngineerMode tool) [65170]
Software Causes 1. The software cause of the failure incident was the presence of a backdoor tool called EngineerMode on OnePlus phones, which granted virtually unlimited access to files and software, potentially allowing hackers to obtain unrestricted privileges on the phone [65170, 65136]. 2. The EngineerMode tool, which was a customized version of a Qualcomm app, contained a hard-coded password and could be accessed with simple commands, giving attackers root access to almost any OnePlus device [65136]. 3. The flaw in the EngineerMode tool was a major security lapse and an oversight in the security screening and device vetting processes of OnePlus, indicating potential issues with the company's security posture and quality control [65136].
Non-software Causes 1. Lack of proper security screening and device vetting processes by OnePlus [65136] 2. Failure to remove a potentially risky factory testing app before shipping devices to consumers [65136] 3. Reliance on security by obscurity as a common practice instead of ensuring robust security measures [65136]
Impacts 1. The software failure incident allowed hackers to obtain virtually unlimited access to files and software on OnePlus phones through the EngineerMode tool, potentially granting them unrestricted privileges on the device [65170, 65136]. 2. The incident raised concerns about the security and privacy of OnePlus smartphone users, as nearly every OnePlus phone model was found to come pre-loaded with the backdoor app, posing a risk of unauthorized access to user devices [65136]. 3. The discovery of the software flaw highlighted a major security lapse in OnePlus devices, indicating potential issues with the company's security screening and device vetting processes [65136]. 4. While the software flaw required physical access to the device for exploitation, it still represented a significant oversight in terms of security and could have led to more severe consequences if not addressed promptly [65136].
Preventions 1. Proper security testing and vetting processes during the development phase to identify and address vulnerabilities before the product is released to the market [65136]. 2. Removal of unnecessary testing tools and backdoors from the final release version of the software [65136]. 3. Regular security audits and updates to ensure that any potential security risks are promptly identified and mitigated [65170].
Fixes 1. Removing the adb root function from EngineerMode in an upcoming software update could help fix the software failure incident [65170, 65136]. 2. Disabling or removing the EngineerMode app from OnePlus devices before they are shipped to consumers could prevent potential security breaches [65136]. 3. Implementing more extensive security screening and device vetting processes by OnePlus to avoid similar security lapses in the future could be beneficial [65136].
References 1. Robert Baptiste, a freelance security researcher who goes by the name Elliot Alderson on Twitter [65170, 65136] 2. Researchers at security firm SecureNow [65170, 65136] 3. Android Police [65170] 4. Qualcomm [65170, 65136] 5. Tim Strazzere, a researcher with the mobile security group RedNaga [65136]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to the EngineerMode tool being a potential security vulnerability has happened again within the same organization, OnePlus. The tool was found on multiple OnePlus phone models, including OnePlus 3, OnePlus 5, OnePlus 3T, and OnePlus 5T [65170, 65136]. OnePlus acknowledged the issue and stated that they would remove the adb root function from EngineerMode in an upcoming software update to address the security concern [65136]. (b) The incident involving the EngineerMode tool potentially granting hackers full access to devices is not specific to OnePlus only. The tool is a customized version of a Qualcomm app that contains the backdoor, protected with a hard-coded password [65136]. This indicates that similar incidents could potentially occur with other devices using Qualcomm chips or similar testing tools.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the articles [65170, 65136]. The incident involved a factory testing app called "Engineer Mode" being pre-loaded on OnePlus phones, acting as a backdoor that potentially granted hackers full access to the devices. This app was not immediately accessible from the user interface but could be accessed with some software probing, allowing attackers to gain root access to the devices. The presence of this app in the final release was a design oversight, as such apps are typically disabled or removed before devices are shipped to consumers to prevent abuse of privileges. (b) The software failure incident related to the operation phase can also be observed in the same articles [65170, 65136]. The operation failure occurred as users who had physical access to the OnePlus devices could exploit the Engineer Mode tool to gain unrestricted privileges on the phones. While OnePlus stated that full root access would still require physical access to the device, the fact that the tool existed on the devices and could be accessed meant that there was a security lapse in the operation of the devices.
Boundary (Internal/External) within_system (a) The software failure incident related to the OnePlus phones and the EngineerMode tool can be categorized as within_system. The incident was caused by a backdoor tool called EngineerMode that was left on the devices by OnePlus, granting unauthorized access to files and software [65170, 65136]. The tool was not immediately accessible from the user interface but could be accessed with some software probing, potentially giving hackers root access to the devices [65136]. OnePlus acknowledged the issue and stated that they would remove the adb root function from EngineerMode in an upcoming software update [65136].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident in this case was primarily due to non-human actions. The incident involved a backdoor tool called EngineerMode that was left on OnePlus phones, granting virtually unlimited access to files and software. This tool was discovered by security researchers and was found to be a customized version of a Qualcomm app containing a backdoor protected with a hard-coded password [65170, 65136]. (b) However, human actions also played a role in this software failure incident. The decision to keep the EngineerMode app on the devices, despite it being a potential security risk, was a choice made by the company to avoid additional operations in the factory. This practice of keeping such tools for convenience is known as "security by obscurity," which is a common practice in the industry [65136].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - The incident involving the EngineerMode backdoor on OnePlus phones was due to a testing tool left on the devices, which granted hackers virtually unlimited access to files and software [Article 65170]. - The EngineerMode software, which acted as a backdoor, was found on multiple OnePlus phone models, indicating a hardware-related issue in the devices themselves [Article 65136]. (b) The software failure incident occurring due to software: - The presence of the EngineerMode software, which granted unauthorized access to the devices, was a software-related issue that allowed for the exploitation of the backdoor [Article 65170]. - The EngineerMode app, which was pre-loaded on OnePlus phones, was a software flaw that could potentially grant hackers full access to the devices, indicating a software-related vulnerability [Article 65136].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the articles is malicious in nature. Hackers were able to exploit a backdoor tool called EngineerMode that was left on OnePlus phones, granting them virtually unlimited access to files and software on the devices [65170, 65136]. The tool allowed unauthorized users to escalate their privileges to gain full "root" access to the phones, which could potentially lead to serious security breaches and harm to the system. The incident involved intentional actions by external actors to exploit the vulnerability for malicious purposes.
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident was poor_decisions. The incident involving the EngineerMode tool on OnePlus phones was due to poor decisions made by the company. The tool, which acted as a backdoor granting unauthorized access to files and software, was left on the devices by OnePlus. Despite being a diagnostic tool meant for factory testing and after-sales support, the tool had the potential to provide unrestricted privileges to hackers if they had physical access to the device. OnePlus initially downplayed the severity of the issue but later decided to modify EngineerMode to address the security concerns raised by researchers and users [65170, 65136].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident in the articles can be attributed to development incompetence. The incident involved a factory testing app called "Engineer Mode" being left on OnePlus phones, potentially granting hackers full access to the devices. The app was not properly secured and could be accessed with some simple commands, giving attackers root access to the devices [65170, 65136]. (b) Additionally, the incident can also be categorized as accidental, as the presence of the backdoor app "Engineer Mode" on OnePlus phones was not intentional but rather a result of oversight during the development and testing process. The app, which was meant for factory testing, was not removed or disabled before the devices were shipped to consumers, leading to the security vulnerability [65170, 65136].
Duration permanent (a) The software failure incident in the articles seems to be permanent as it was caused by a backdoor tool called EngineerMode that was pre-loaded on OnePlus phones, potentially granting hackers full access to the devices [65170, 65136]. The tool was not immediately accessible from the user interface but could be accessed with some software probing, allowing attackers to gain root access to the devices. This backdoor tool was present on almost all OnePlus phone models except the original OnePlus One, indicating a widespread issue affecting millions of smartphones [65136]. The incident was considered a major security lapse and a significant oversight in OnePlus's security screening and device vetting processes [65136].
Behaviour value, other (a) crash: The software failure incident reported in the articles does not involve a crash where the system loses state and does not perform any of its intended functions. Instead, the incident involves a backdoor access tool called EngineerMode that grants unauthorized access to files and software on OnePlus phones [65170, 65136]. (b) omission: The incident does not involve a failure due to the system omitting to perform its intended functions at an instance(s). Instead, the issue lies in the presence of a factory testing app called EngineerMode that acts as a backdoor, potentially granting hackers full access to the device [65170, 65136]. (c) timing: The failure is not related to the system performing its intended functions too late or too early. The issue with EngineerMode on OnePlus phones is more about unauthorized access and security vulnerabilities rather than timing-related failures [65170, 65136]. (d) value: The software failure incident does involve a failure due to the system performing its intended functions incorrectly. The EngineerMode tool on OnePlus phones allows for unauthorized access and escalation of privileges, which is not the intended function of a factory testing app [65170, 65136]. (e) byzantine: The incident does not involve the system behaving erroneously with inconsistent responses and interactions, which would fall under the category of a byzantine failure. The issue with EngineerMode on OnePlus phones is more about unauthorized access and security vulnerabilities [65170, 65136]. (f) other: The behavior of the software failure incident can be categorized as a security vulnerability due to the presence of a backdoor access tool (EngineerMode) on OnePlus phones, which allows for unauthorized access to files and software. This unauthorized access poses a risk to user data and device security [65170, 65136].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence, other (a) death: There is no mention of any deaths resulting from the software failure incident in the provided articles [65170, 65136]. (b) harm: The software failure incident did not result in physical harm to individuals [65170, 65136]. (c) basic: The incident did not impact people's access to food or shelter [65170, 65136]. (d) property: People's material goods, money, or data were impacted due to the software failure as hackers could obtain virtually unlimited access to files and software on OnePlus phones [65170, 65136]. (e) delay: There is no mention of any activities being postponed due to the software failure incident [65170, 65136]. (f) non-human: Non-human entities were impacted as the software failure incident involved a backdoor tool called EngineerMode that granted unauthorized access to OnePlus phones [65170, 65136]. (g) no_consequence: The articles do not mention that there were no real observed consequences of the software failure incident [65170, 65136]. (h) theoretical_consequence: There were potential consequences discussed, such as the possibility of hackers gaining full access to devices, but it is noted that attacks exploiting the app require physical access to a given unit [65136]. (i) other: The software failure incident could potentially lead to unauthorized access to personal data and compromise the privacy and security of OnePlus phone users [65170, 65136].
Domain information (a) The failed system in the articles is related to the information industry as it involves a security flaw in OnePlus smartphones that allows unauthorized access to files and software through a testing tool called EngineerMode [65170, 65136]. (b) The incident does not directly relate to the transportation industry. (c) The incident does not directly relate to the natural resources industry. (d) The incident does not directly relate to the sales industry. (e) The incident does not directly relate to the construction industry. (f) The incident does not directly relate to the manufacturing industry. (g) The incident does not directly relate to the utilities industry. (h) The incident does not directly relate to the finance industry. (i) The incident does not directly relate to the knowledge industry. (j) The incident does not directly relate to the health industry. (k) The incident does not directly relate to the entertainment industry. (l) The incident does not directly relate to the government industry. (m) The incident does not directly relate to any other industry.

Sources

Back to List