An IT security researcher has discovered a critical vulnerability in OnePlus 6 smartphones which if exploited can allow an attacker to boot any modified image even when the bootloader is locked – This means the attacker can have full access to OnePlus 6 device without digging any further.
The vulnerability was identified by Jason Donenfeld, a security researcher from Edge Security (zx2c4 on XDA) who stated that the aforementioned scenario is only possible if the attacker has physical access to OnePlus 6 device. Moreover, it requires a computer and USB cable – This means it is nearly impossible for a third-party to mess around with your OnePlus 6 smartphone.
See: OnePlus website hacked; credit card data of 40,000 users stolen
OnePlus, on the other hand, has acknowledged the issue and vows to issue a software update in the coming days. “We take security seriously at OnePlus. We are in contact with the security researcher, and a software update will be rolling out shortly,” said the company.
The #OnePlus6 allows booting arbitrary images with `fastboot boot image.img`, even when the bootloader is completely locked and in secure mode. pic.twitter.com/MaP0bgEXXd
— Edge Security (@EdgeSecurity) June 9, 2018
OnePlus 6 was released a few weeks ago therefore if you own the device keep an eye on the update released by the company, meanwhile, do not leave your device unattended.
Lately, several OnePlus devices have been making headlines for built-in security flaws. Previously, a OnePlus 5 (OP5) user shared a video showing how his device rebooted whenever he dialed 911. In another incident, a security researcher discovered how OnePlus 5, 3 and 3T devices contained a pre-installed backdoor that was collecting user’s personal data.