Fix promised for major security flaw in OnePlus 6

This vulnerability in OnePlus 6 allows anyone with physical access to gain full control over the phone. Here’s everything you need to know about the OnePlus 6 security flaw.

OnePlus 6 recently launched in India and other markets (HT Photo)

A security researcher has discovered a major security flaw in the OnePlus 6 smartphone. It allows cyber criminals with physical access to the device and a tethered PC connection to assume complete control over it.

Reported by Jason Donenfeld, president of a firm called Edge Security LLC and an XDA forum member, the flaw can be exploited if the boot image of the phone is altered using an insecure ADB (Android Debug Bridge) - a command-line tool that enables communication with a device. Jason added that he could bypass the locked bootloader without the need for USB debugging, a key requirement for altering phone software.

The bootloader, an Android built-firmware, is the first thing that starts running upon booting up an Android device. A locked bootloader prevents anyone from modifying the phone's operating system. According to the researcher, the bootloader on OnePlus 6 is not entirely locked, which further enables one with the necessary tools and skills to alter the boot image and gain complete control over the phone.

While XDA Developer first reported the vulnerability, a separate website Android Authority said it was able to replicate the security flaw. The website highlighted that one will need "physical and unsupervised access" to a OnePlus 6 phone for few minutes to exploit the vulnerability. It will also require a tethering cable and PC to load a new boot image via fastboot. Boot image is a file that features the Kernel and RAMDisk, which are key files to load the device before a file system can be loaded.

OnePlus has acknowledged the issue and promised a fix very soon. "We take security seriously at OnePlus. We are in contact with the security researcher, and a software update will be rolled out shortly," a company representative said in a note.

Security experts have advised OnePlus 6 users to be very careful with the phone until the next patch is released.

"OnePlus 6 users should be extra cautious and make sure that their device does not fall into the wrong hands, especially until a patch is released. Moreover, users are strongly advised to update their software as soon as the patch is released because in the absence of a bootloader lock, attackers might be able to modify the OS without actually having to wipe the device storage - further gaining complete root access to the device," said Ankush Johar, director at Infosec Ventures, an infrastructure security solutions service provider.