The Story of Discovering a OnePlus-Signed Backdoor
summary
A researcher narrates finding a OnePlus-signed backdoor in November 2017 that allowed physical attackers to get root over ADB by launching a factory-mode activity; the hardcoded plaintext password was “angela”, verified via a SHA-256 stored in a native library. The investigation used a small Python script to unpack firmware and jadx to decompile, automated detection of exported components, found 320 preinstalled apps (one with ~250 exported components), produced a working exploit, and prompted OnePlus to release a patch about three weeks later.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:03Researcher background
- 2:07OnePlus 5 investigation
- 5:18Firmware extraction
- 7:45Preinstalled system apps
- 8:47App Detective tool
- 11:37Exported components
- 14:29Factory Mode app
- 17:19Suspicious strings
- 18:43Angela Root method
- 21:16Backdoor library
- 24:12ADB backdoor exploit
- 25:15Qualcomm responsible
- 27:05Media impact
- 29:57Android security issues
- 31:44Conclusion
- 32:10Q&A
related talks
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
36mPhysical Attacks Against Smartphones
22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps
45mI just hacked your app!
36mOut Of The Box Exploitation Breaking The Trust Chain Of The Ethereum Phone
32mHacking the Hackers’ Code: Inside Android Malware
15mExploiting Android Apps with Counterfeit Art
01h 06mBackdoors in Back Doors