{"id":47137,"date":"2017-10-12T07:32:24","date_gmt":"2017-10-12T07:32:24","guid":{"rendered":"https:\/\/www.biphoo.com\/bipnews\/?p=47137"},"modified":"2017-10-12T07:32:24","modified_gmt":"2017-10-12T07:32:24","slug":"oneplus-may-be-leaking-your-data-heres-how-to-fix-that","status":"publish","type":"post","link":"https:\/\/www.biphoo.com\/bipnews\/technology\/mobile\/oneplus-may-be-leaking-your-data-heres-how-to-fix-that.html","title":{"rendered":"OnePlus May Be Leaking Your Data. Here’s How to Fix That"},"content":{"rendered":"

OnePlus May Be Leaking Your Data. Here’s How to Fix That<\/span><\/strong><\/span><\/h2>\n

OnePlus May Be Leaking Your Data. Here’s How to Fix That:- OnePlus devices are, by and large, things of beauty. The Shenzen-based company produces smartphones that hew extremely closely to a stock Android build, but without the exorbitant price tags of their Google Nexus or Pixel counterparts.<\/span><\/p>\n

There\u2019s only one problem: OnePlus phones may be invading your privacy by sending revealing data back to Chinese servers, and while there’s a fix, it may be daunting for users who aren’t technically skilled.<\/span><\/p>\n

This information comes from Chris Moore, an engineer for Redgate, a Cambridge, England-based software developer. Moore was testing his OnePlus 2 phone for unrelated security research when he found something interesting: His phone was directing traffic back to a domain called \u201copen.oneplus.net.\u201d<\/span><\/p>\n

A little bit of additional digging revealed that the server was one of OnePlus\u2019s own. (While Moore tested this on a OnePlus 2 phone, other users have replicated it on a OnePlus 3; it likely affects a variety of phones from the manufacturer running the company’s OxygenOS fork of Android.)<\/span><\/p>\n

How to Stop OnePlus Data Collection<\/span><\/strong><\/span><\/p>\n

If you want a surefire way of preventing your OnePlus phone from sharing plain-text data with its parent company, you\u2019ll have to do a bit of Android programming legwork \u2014 but you won\u2019t have to root your phone, as Moore initially thought you might.<\/span><\/p>\n

The forum Hacker News explains how to do it in detail. First, you need to enable USB debugging in your phone\u2019s settings (it\u2019s under Developer Options). Then, connect your phone to your computer via USB and install the Android Debug Bridge software.<\/span><\/p>\n

If this is your first time using ADB, there will be some trial-and-error as you ensure everything is configured correctly, but if you follow the instructions on the ADB website, you should be good to go. Then, simply copy, paste and execute the following commands from the Hacker News forum, which will uninstall the OnePlus trackers manually:<\/span><\/p>\n

$ adb start-server<\/span><\/p>\n

$ adb shell<\/span><\/p>\n

> pm uninstall -k –user 0 net.oneplus.odm<\/span><\/p>\n

Oodles of Information<\/span><\/strong><\/span><\/p>\n

Moore found that the OnePlus server would periodically collect data about his phone, including the IMEI and IMSI (the handset and SIM card unique identifiers, respectively), the phone number, MAC addresses (unique identifiers for network ports), mobile network names and wireless network names. These are all potential security and privacy risks, but they’re also the kind of thing that phone makers regularly collect in case they need to remotely troubleshoot problems with a handset.<\/span><\/p>\n

However, it gets even more unnerving. The remote OnePlus server also collected information on when Moore opened and closed Android apps, locked or unlocked his phone and even turned the screen on or off.<\/span><\/p>\n

To be fair, as long as this data stays with OnePlus, there\u2019s no risk to the end user. What\u2019s unsettling, however, is that Moore discovered that the data was not anonymized at all. A malicious actor who got his or her hand on the data could easily see everything about a user’s smartphone usage (assuming that OnePlus does not implement additional security protocols after it collects the data, that is).<\/span><\/p>\n

Moore couldn\u2019t find a way to stop the phone from collecting information, but a Polish programmer named Jakub Czeka\u0144ski got in touch with him on Twitter and suggested the above workaround.<\/span><\/p>\n

OnePlus Offers Another Workaround<\/span><\/strong><\/span><\/p>\n

We contacted OnePlus to see if the company was aware of the problem. A representative assured us that the data transmitted was actually secure, moving in two streams to an HTTPS-enabled Amazon server.<\/span><\/p>\n

The first stream, the representative said, contained analytics \u2014 perhaps the app-usage information Moore pointed out. OnePlus recommended disabling this stream, if desired, by going to Settings –> Advanced and toggling off the “Join user experience program” option.<\/span><\/p>\n

The second stream, the OnePlus rep added, was just device information, which was not shared with outside parties.<\/span><\/p>\n

I was unable to verify for myself whether the OnePlus recommendation actually stopped the transmission of user data, but there\u2019s no indication that what OnePlus said is untrue. Still, uninstalling the telemetry through ADB seems like the more absolute option.<\/span><\/p>\n

Bubbling Under for a Year<\/span><\/strong><\/span><\/p>\n

Interestingly, Moore is not the first person who found this OnePlus transmission. Back in July 2016, a software developer called Tux pointed out the same thing on Twitter, and even posted a complete record of his findings to Pastebin. The following month, another developer who contributed to the Android developers’ blog XDA-Developers chronicled the same issue.<\/span><\/p>\n

Why the story never took off until now is anyone\u2019s guess, but if this is as much of a privacy and security risk as it seems, OnePlus has let it go unaddressed for a long time.<\/span><\/p>\n

More information will probably come out over the next few days, as security researchers attempt OnePlus\u2019s fix for themselves and see how it affects data transmission. In the meantime, you might want to run the ADB script. OnePlus is almost certainly not going to do anything nefarious with your data, but as we\u2019ve seen before, no manufacturer\u2019s security is ironclad.<\/span><\/p>\n

Source:-\u00a0https:\/\/www.tomsguide.com\/us\/oneplus-data-leak-fix,news-25968.html<\/span><\/p>\n

\n\t\t\t
\n\t\t\t <\/div><\/div>\n\t\t