一加系统中遗留着后门 apk

[qqjt]

https://thehackernews.com/2017/11/oneplus-root-exploit.html

https://thehackernews.com/2017/11/oneplus-logkit-app.html

这打包不讲究啊。

[zealic]

所以为什么说电子产品不能用国产的，要么吃相难看，要么那什么黑。

[kanshan]

之前不是被曝出过一加手机用户隐私数据 上传电话号码等 一加回复只是为了更好的服务用户

[hand515]

偏信则暗，兼信则明。大家先听听一加用户的发言

[EricCartman]

以后还有国产 AI 全面为你服务

[dong3580]

5，找了找，不知道为什么没找到。上次那个事件那个进程也没找到。

[cst4you]

洗不白了

[ltux]

这玩意儿是高通开发的，其他手机没发现并不代表没有。

[odirus]

Minix 系统怎么没人讨论啦？国内国外都在收集隐私，互联网下没有隐私

[roustar31]

@ltux Qualcomm, who was believed to be the creator of the EngineerMode APK, also responded to allegations, saying that there are traces of source code from their original app, but the current APK found on devices from various manufacturers has been modified by someone else.
"After an in-depth investigation, we have determined that the EngineerMode app in question was not authored by Qualcomm," Qualcomm claims.
"Although remnants of some Qualcomm source code is evident, we believe that others built upon a past, similarly named Qualcomm testing app that was limited to displaying device information. EngineerMode no longer resembles the original code we provided."

[dong3580]

看到同样图标的，全称是 com.android.enginneringmode 么？

http://m.cnbeta.com/view_670277.htm

[fengleidongxi]

相比较，一加是算是比较不错，这些问题相对来说，都不是问题。一加 ROOT 保修、内核开源、能刷 LOS，这还不够吗？自己多分析分析

[weyou]

@dong3580 我的 3t 氧 os 能找到 apk 在 /system/app/EngineeringMode 下面，进程倒是没有发现。

[weyou]

@dong3580 进程也发现了，com.android.engineringmode.specialt...

[jasontse]

高通最多告诉你这是他们的工厂测试程序，一加打包正式发布的时候忘记删除了。

[sentanl869]

https://www.xda-developers.com/oneplus-root-access-backdoor/

'Update: OnePlus has issued an official response to the matter. They will be removing the ADB root function from EngineerMode in an upcoming update.'

一加官方表示会在今后的更新中移除带有后门的应用。

'OnePlus has officially responded to the situation. In a blog post, the company reiterates that this exploit can only be utilized if an attacker has physical access to the device and has enabled USB Debugging. In order to enable USB Debugging, the attacker also needs your device ’ s pin/password. Thus, the root backdoor isn ’ t easily exploitable by any app or person, but nevertheless OnePlus will address users ’ concerns by removing this functionality from the EngineerMode app.'

一加表示这个带有后门的应用只有通过物理访问才会被使用，并且即使被攻击者利用，也会需要设备的 pin 或者密码（谁会设这些东西...）。

这东西是高通开发的 debug 工具，所以除了一加，其他 OEM 厂商的设备也有同样的风险（已知华硕和小米的部分设备有同样风险）。大体上讲，这又是一个见仁见智的东西...

[mikefy]

@dong3580 给的什么破网页，uc 进去只是下拉的动作，一次广告跳转一次软件下载，最后返回到 v2 各种返回键还失败，只能主页重新进

[flynaj]

这种被发现了就甩锅给高通，为什么小米的手机里面没有这个 APP。

[Zeonjl]

@EricCartman 菊花牌已经服务很久了

[20015jjw]

还买国产 怕不是要送命

[HongJay]

@20015jjw 还在国内。怕不是要送命