Christopher Moore, a software engineer, began a post on his own blog showing his findings. During a Hack Challenge, Moore began proxying the internet traffic of his OnePlus 2 using OWASP ZAP. If you’re not close to this process, this actually allowed him to view all incoming and outgoing internet traffic from his phone. Among the normal network activity, he noticed a lot of requests to open.oneplus.net.
Through extensive inspection, he found the field name to be an Amazon AWS instance owned by OnePlus. he could see his phone sending data periodically to the open.oneplus.net server over HTTPS. He was able to decrypt the data using the authentication key on the phone which showed that his OP2 was sending time-marked information about locks, unlocks, and unexpected reboots.
Logging sudden reboots would make sense it could help developers fix OS bugs, but as Moore wrote in his blog, recording every time the phone is opened or locked seemed excessive. He left the proxy commanding for an extended period of time, and conditions went downhill quickly.
Moore noticed that some of the data being sent to OnePlus’ servers involved the phone’s IMEI number, the phone number, MAC addresses, mobile network names and IMSI prefixes, Wi-Fi data info, and the phone’s serial number. And if you guessed that was bad, he later found that the data involved every time an app was opened.
We reached out to OnePlus about the analytics tracking, and the company responded with the below statement:
We securely forward analytics in two different streams over HTTPS to an Amazon server. The first current is usage analytics, which we collect in order for us to more precisely fine-tune our software according to user behavior. This communication of user activity can be turned off by navigating to ‘Settings’ -> ‘Advanced’ -> ‘Join user experience program’. The other stream is device information, which we receive to provide better after-sales support.
While OnePlus says that the bulk of the data communication can be turned off with the above instructions, Twitter user JaCzekanski pointed out that the app transmitting the data OnePlus Device Manager can be eliminated via ADB, root not required. Just plug your phone into a processor with ADB installed, make sure USB debugging is allowed, and run this command:
pm uninstall -k –user 0 net.oneplus.odm
Take your time to comment on this article.