When can we expect a fix for these? - OnePlus 2 Q&A, Help & Troubleshooting

A recent article shows that there are significant vulnerabilities that affect Qualcomm devices, including OP2. Indeed, when I ran their app to scan my phone it showed up as vunerable:
When can we expect a fix? My current security patch level is June 1, 2016.
If unlocking my phone and installing a custom ROM fixes it, I'm up for it!

2503 is already fixed by CM13.1 (OFFICIAL). You said, you're open to install a custom ROM: Go for it . If we get a fix, then ONLY by custom ROMS. We can't expect any fixes from OnePlus, to be honest.

Use brain.exe and you don't need an fix

vergilbt said:
Use brain.exe and you don't need an fix
Click to expand...
Click to collapse
It's because of idiots like you who brain.exe would even exist. Stop talking about stuff you don't know **** about.

LOL

Posting about fixing core security flaws in CM13 in a device specific thread like this is like posting it on the closest shopping wall info-board, at best you will get respons from other worried people non the wiser about applying fixes to the source tree.

Related

The current and future state of CyanogenMod Nightlies (ice Cream Sandwich is coming)

October 31st, 2011
The current and future state of CyanogenMod Nightlies
Happy thing to hear, but i want to give a suggestion to cm team, but dont know where to put it, if any body know it, then pls forward it to them, or help me to post it in right place,
It is;
Insted of putting nightlies on same device, frequently, cm builds should add an app through which newly realised patches and modes should be integrated into the rom from the device itself( just like windows updates or software updates) or some thing like update zip etc..
The advantages are..
1) avoid heavy size downloads of frequently updated nightlies
2) easy updates
3) every user/ device is stays updated
4) avoid errors and bugs more easily.
5) save a large amount of data space in server ( where all these nightlies are uploaded)
The 1ly thing should be cared is to ensure that the device gets updates in a constant manner, ie user should not install update no.2 unless he put update no.1 in the device.
Dont you seem it is nice?
Sent from my HTC Wildfire using XDA App
showlyshah said:
3) every user/ device is stays updated
4) avoid errors and bugs more easily.
Dont you seem it is nice?
Sent from my HTC Wildfire using XDA App
Click to expand...
Click to collapse
That is a two sided knife.
Regarding point 3, if an update brings trouble, it will bring trouble for everyone. Meaning a hell of a lot of user getting their phones messed-up. The way it is now, only those who want nightlys might bump their heads into problems. Those who don`t have the time to wait for fixes stay on stable.
4) and encounter bugs and errors more easily. Imagine a problematic update that makes you incapable of answering a call. because the nature of the update, everyone gets the bug. Imagine the amount of **** that will get thrown in the direction of the CM team.
The current way is, IMO the best way.
If I misunderstood you, please tell me.
Alex_GP said:
That is a two sided knife.
Regarding point 3, if an update brings trouble, it will bring trouble for everyone. Meaning a hell of a lot of user getting their phones messed-up. The way it is now, only those who want nightlys might bump their heads into problems. Those who don`t have the time to wait for fixes stay on stable.
4) and encounter bugs and errors more easily. Imagine a problematic update that makes you incapable of answering a call. because the nature of the update, everyone gets the bug. Imagine the amount of **** that will get thrown in the direction of the CM team.
The current way is, IMO the best way.
If I misunderstood you, please tell me.
Click to expand...
Click to collapse
You said it, but its not as right as you think. The reason is the answ you may give for my following question " how frequently do you update your Linux / windows / Mac? ? Do you keep an automatic update or a manual update? And in case you are a frequent updater, can you say every 1 is like you?"
Dude i just mention to add an app, from which you can update your cm, and not necessarly it is an automatic one, it should be a manual one, just like cwm updates are notified by rommanager , you will be provided with a notification, you may or may not install it, and ofcourse every update package should have a changelog, so that you are aware of the changes.
Also the app should have an option to backup the old files in case if you want to revert back.
Sent from my HTC Wildfire using XDA App
Mmmm I'm happy the way it is.
Motto/quote : if it ain't broke don't try and fix it!!
I have yet to see a heavy size nightly or stable for that matter.I'm not having a moan at your idea but people are all different and choice is what makes us stand apart. We have an app which informs us of new builds and its then our choice of what to do with said information. There is an updated changelog page for info on each build and xda forum members have everything else regarding new builds/stable info.
My personal preference is stable but I like to test nightlys too and swap and change like the weather, so for me I say nooooooo I have everything I need where it is now. Regards Slymobi.
sent from my wilderbeast:buzz
ya you are right, stable versions are here, but what about nightlies? every week or two they are releasing a new nightly, and many of them contains major or minor bug fixes, so the user have to download, wipe(if it is needed) and flash again, dont it seems a bit discouraging?, i seem it like formatting your pc, running all the os setups, then installing your softwares etc.., some times you do all this for a small script/library change? so is that worthy enough? i dont think so. more over the developers have to build and build the update zip again and again, thats why i started thinking like this.
if you people dont like my idea, just we can stop it.
showlyshah said:
ya you are right, stable versions are here, but what about nightlies? every week or two they are releasing a new nightly, and many of them contains major or minor bug fixes, so the user have to download, wipe(if it is needed) and flash again, dont it seems a bit discouraging?, i seem it like formatting your pc, running all the os setups, then installing your softwares etc.., some times you do all this for a small script/library change? so is that worthy enough? i dont think so. more over the developers have to build and build the update zip again and again, thats why i started thinking like this.
if you people dont like my idea, just we can stop it.
Click to expand...
Click to collapse
Back-up your apps with Titanium back-up. Many nightlies can be updated with out needing to format all the partitions. (maybe cache, just to be sure).
It`s not a chore. Nobody forces you to do it. If you consider the update to be worth the work, then ok. If not, stay on stable.

[Topic]Can We Expect Lollipop?

I'm wondering.
Since Samsung as of late have been focused on getting everything pushed to Lollipop, do you think we'll see some opinions about an update, or even rumor?
Maybe the full thing, who knows.
im interested too but...... i dont think its ever going to happen. samsung dont seem interested in the device at all anymore.
Given the cameras never even got KitKat it's very doubtful they will get Lollipop
If you ask this to Samsung, I expect them to say this:
"Galaxy Camera?"
"Isn't that that gimmick we released a couple of years ago?"
"An update to lollipop you say? Whahahahaha!"
"No."
But seriously: It never got past 4.1. I seriously doubt they would even consider this device for an update.
Samsung officialy stopped producing the K Zoom and put it EoL
so, no Lollipop or other updates anymore, even for exploit fixing
confirmed: no update
Galaxy camera 2 has stagefright!
Can we get a cyanogenmod build then ?
cantenna said:
Can we get a cyanogenmod build then ?
Click to expand...
Click to collapse
If you can get a seasoned developer to work on it, sure. I set up a device tree for the GC200 at https://github.com/AWildColin/android_device_samsung_sf2wifi six months ago. I was trying to encourage some development on it (*cough* @Decad3nce *sneeze*) by getting a custom recovery working, but everything I built and flashed resulted in black screens and I never found a way to troubleshoot exactly what was causing that to happen.
Frankly, I'm not an experienced enough developer. Maybe with a lot more free time, I might get some where, but a custom recovery is still a far cry from a stable CyanogenMod ROM. You're welcome to try though. https://wiki.cyanogenmod.org/w/Doc:_porting_intro
mjsztainbok said:
Given the cameras never even got KitKat it's very doubtful they will get Lollipop
Click to expand...
Click to collapse
If I'm not mistaken the GalCam1 and GalCamNX never were upgraded from 4.1, and the GalCamNX was an almost $2000 camera. So no, I don't anticipate that Samsung will upgrade to Lolipop.
AWildColin said:
If you can get a seasoned developer to work on it, sure. I set up a device tree for the GC200 at https://github.com/AWildColin/android_device_samsung_sf2wifi six months ago. I was trying to encourage some development on it (*cough* @Decad3nce *sneeze*) by getting a custom recovery working, but everything I built and flashed resulted in black screens and I never found a way to troubleshoot exactly what was causing that to happen.
Frankly, I'm not an experienced enough developer. Maybe with a lot more free time, I might get some where, but a custom recovery is still a far cry from a stable CyanogenMod ROM. You're welcome to try though. https://wiki.cyanogenmod.org/w/Doc:_porting_intro
Click to expand...
Click to collapse
Hi m8, did you ever manage to get a working rom for ekgc-200?
cantenna said:
Hi m8, did you ever manage to get a working rom for ekgc-200?
Click to expand...
Click to collapse
Nope. The device tree is still on Github though if anyone wants to mess around.
we really need a Cyanogenmod rom for this camera desperately.. . what people dont seem to realise or care about for some strange reason, this camera has now a nunber of very serious security vulnerability that samsung has not addressed, it is so bad you should not connect to the internet with it.
im going to try to sell mine. pretty pissed with samsung, they never once realeases any security updtes for this camera!

Custom Rom

Hello,
is there any custom ROM for the for the Dtek50 available?
The silence in here tells a lot :/
Is there still no custom ROM? I (and many other) would really need it. I am willing to test it. The problem is that there will be no Nougat-update by Blackberry.
stefan5 said:
Is there still no custom ROM? I (and many other) would really need it. I am willing to test it. The problem is that there will be no Nougat-update by Blackberry.
Click to expand...
Click to collapse
I think the biggest problem is that Blackberry/TCL has done a really good job of locking up the bootloader - I don't think any exploits have been identified yet which would allow a custom ROM to be installed, and there definitely isn't any official manufacturer-sanctioned bootloader unlocking tool.
Unless that changes, we'll be stuck with Blackberry/TCL's decisions regarding OS updates and security patches. We're already are pretty sure there won't be any major version upgrades, and it's inevitable that eventually the security patches will come to an end too.
I hear this is a rebranded idol 4 by TCL. If that's true maybe see if your phone is supported by the TCL flashing program SUGAR QCT_SP_Gotu2
PizzaG said:
I hear this is a rebranded idol 4 by TCL. If that's true maybe see if your phone is supported by the TCL flashing program SUGAR QCT_SP_Gotu2
Click to expand...
Click to collapse
It's certainly possible, but I'd be afraid to try it out. Blackberry has really focused on a security model which puts a high priority on ensuring that no unsigned OS code can ever be allowed to run.
I would hate to accidentally discover some sort tamper protection feature which might leave me with a bricked device.

OP3T in most recent versions (4.1.3 and beta5) is 3 levels of security patches behind

OP3T still is on the March 1st security patch (2017-03-01), and is missing the fixes corresponding to 2017-03-05 patch (8 critical items of which at least 6 should be applicable to OP3T) and both 2017-04-01 and 2017-04-05 security patch levels (at least 1 huge critical item plus a lot of slightly smaller ones).
https://source.android.com/security/bulletin/2017-03-01
https://source.android.com/security/bulletin/2017-04-01
And?
That's nice, why tell us? Report it to OnePlus?...or use a custom rom where all the latest security updates are in place.
I don't really care because i think the phone is awesome, the price was awesome and the constant updates is absolutely amazing. But it is a bit bizarre i get 2 updates a month on the beta yet they can't for some reason include the latest security patches. Like why do something so well then slightly ruin it?
djsubterrain said:
That's nice, why tell us? Report it to OnePlus?...or use a custom rom where all the latest security updates are in place.
Click to expand...
Click to collapse
People should flash custom ROMs to get security updates? That's the most idiotic thing i've read today. Well done.
DirkGently said:
People should flash custom ROMs to get security updates? That's the most idiotic thing i've read today. Well done.
Click to expand...
Click to collapse
Yeah, obviously, much more sensible to direct a complaint about the stock rom to people who have nothing to do with OnePlus and can do nothing to solve it.
EuEra said:
I don't really care because i think the phone is awesome, the price was awesome and the constant updates is absolutely amazing. But it is a bit bizarre i get 2 updates a month on the beta yet they can't for some reason include the latest security patches. Like why do something so well then slightly ruin it?
Click to expand...
Click to collapse
Security updates bring along bugs. That's why security patches aren't included in updates so often.
And do you really think someone is exploiting your data through these exploits.
Most exploits don't even concern anything remotely dangerous to data.
Even apps on playstore tend to theft data more then any exploit did till date.
DirkGently said:
People should flash custom ROMs to get security updates? That's the most idiotic thing i've read today. Well done.
Click to expand...
Click to collapse
thats true. what was wrong with that?
DirkGently said:
People should flash custom ROMs to get security updates? That's the most idiotic thing i've read today. Well done.
Click to expand...
Click to collapse
Okay. I'll fix the official roms for you. Happy now?
Just use a custom ROM OOS sucks anyways.
se7ensde said:
Just use a custom ROM OOS sucks anyways.
Click to expand...
Click to collapse
Oxygen OS is the best ROM/OS I've ever used,
And was the main reason for me to choose a OP3T over others phones.
Sadly,nowadays custum roms brings more harm than good.
se7ensde said:
Just use a custom ROM OOS sucks anyways.
Click to expand...
Click to collapse
Best stock ROM out there, honestly. Closest to AOSP as you're going to find.
Aosp is boring. And as soon as oneplus 5 releases you can say bye bye to oos updates for the 3 and 3t. Better start getting used to custom ROMs if you want any future for your device. And oneplus has already stopped updating security patches. Custom ROM devs are much better with keeping up with everything. OOS doesn't even have 7.1.2 yet and I always see OOS users complaining about not having this or that feature or how they can get it. Which most custom roms have all of the features that everyone wants right of the bat. And if you really want a good aosp experience there are plenty of OOS based roms with lots of extra goodies out there. Like aosp extended or freedomos plus lots of others. OOS is basically just base bones with features that aren't even that useful and if you try to say that you can switch to dark mode and change accents then I say substratum. Which almost every ROM out there supports oms now. The way I see it is people who stick to stock are afraid of changing and tinkering with their device or just don't know how to. Bottom line is OOS is terrible best rom for this phone is resurrection remix hands down.
---------- Post added at 11:11 PM ---------- Previous post was at 11:09 PM ----------
Midomad said:
Oxygen OS is the best ROM/OS I've ever used,
And was the main reason for me to choose a OP3T over others phones.
Custum roms brings more harm than good.
Click to expand...
Click to collapse
custom ROM brings no harm. I always use custom roms and have no problems. You just don't know what your doing.
se7ensde said:
. You just don't know what your doing.
Click to expand...
Click to collapse
i used custom roms before the day you got you're first android phone and joined XDA.
Android gained maturity since marshmallow,
OOS has all the details missing from Stock android(wich is the best)
So you would like to believe. I know what I'm doing and have been modding since way before marshmallow. Your the type to complain to everyone here at xda when something goes wrong. I just fix out on my own. OOS sucks and that's that of you can't use a custom rom without problems then that's your not knowing what your doing.
Midomad said:
i used custom roms before the day you got you're first android phone and joined XDA.
Android gained maturity since marshmallow,
OOS has all the details missing from Stock android(wich is the best)
Customs roms are s**t,good luck with what your doing.
Click to expand...
Click to collapse
I'd usually agree with you about custom Roms but RR is mature and truly is excellent and as good as if not better than OOS and is on April security with 7.1.2.
No doubt the custom ROMs are probably solid. But stock 7.1.1 oos (+beta) is the best stock ROM I have ever used. Fast, smooth, very close to asop with some nice tweaks. It matches the hardware nicely. It really should have up to date security patches. Maybe mention it to the couple of OnePlus guys on the forums, like @Funk Wizard @innocentwoolf
I'm guessing those guys are linked to OP, just from what I have seen, not for sure. Sorry if I'm mistaken guys.
As Android is further refined, there are fewer and fewer reasons to use a custom ROM for most users,custom ROMs will always be relevant to entry-level/midrange smartphone users, or those who still use older devices, that aren't receiving official updates from OEMs anymore.
Come on guys, the dude was escalating / highlighting something which is valid. but yeah, it should be escalated to OnePlus instead. Anyway, lets not be toxic to one another
override182 said:
Come on guys, the dude was escalating / highlighting something which is valid. but yeah, it should be escalated to OnePlus instead. Anyway, lets not be toxic to one another
Click to expand...
Click to collapse
Already done via user feedback app [emoji111]

OnePlus Security: Think Before You Buy

So, OnePlus is going to release a new phone! People are excited and have forgotten about everything bad that happen with the previous devices. The PR machine started publishing "amazing" photos from the 5T camera (they did the same with the not-that-good OP5) and everyone is ready to open their wallets.
I just wanted to remind everyone about OnePlus privacy and security "mistakes", something that is usually ignored by the fancy YouTube reviewers and android related websites. This week we have a new security issue:
OnePlus Accidentally Pre-Installed an App that acts as a Backdoor to Root Access
Last month we learned that OxygenOS is Allegedly Data-mining Personally Identifiable Information for Analytics... And back in February someone discovered a bootloader issue that worked as a backdoor.
These days we use our phones for more than simple voice calls. We use apps that have access to important parts of our lives (banking, social networks, IoT, etc) and store a lot of information on our phones.
Security is important and it should be taken into consideration when buying a new phone.
I think most people here go out of their way to unlock their bootloader and root anyways.
So I'm pretty sure this topic in general here is pointless.
Nonetheless it is a valid point, though its not that meaningful here.
If you are really worried about security you'd go with a blackberry out a pixel
@Expliciate What I've seen with the 3/3T is that while many users use custom ROMs and are not affected by OOS issues, others just unlock their bootloader and use root, but stay on stock OOS or OOS beta.
I agree with you... the people that should be warned about these issues will not read this thread. Anyway, if we are aware of the problem maybe we will think twice before buying, suggesting or using Oneplus hardware or software.
@worldsoutro You don't have to be "really worried" about security to understand that something is wrong when people keep finding security holes on Oneplus software.
Three points keep me from jumping on board
No new snapdragon
Fingerprint sensor on the back
And finally ...what about jelly?
My two cents
I am wondering if anyone knows about any vulnerabilities/backdoors in the phone, outside of the Oxygen OS, such as in the aboot, sbl, etc.
Oxygen OS can be done away with, albeit by the power users.
This kind of app must be preinstalled on all devices by Google !!
Without root Android phone is useless for me, I would better to use nokia 3310 instead than.
I hope oneplus will rewrite this app and keep it for all generation of their phones.
S4turno said:
You don't have to be "really worried" about security to understand that something is wrong when people keep finding security holes on Oneplus software.
Click to expand...
Click to collapse
I actually prefer people finding/reporting bugs with OnePlus caring for resolving the mentioned issues to people not finding/reporting bugs and/or a company which ignores them.
x111 said:
This kind of app must be preinstalled on all devices by Google !!
Without root Android phone is useless for me, I would better to use nokia 3310 instead than.
I hope oneplus will rewrite this app and keep it for all generation of their phones.
Click to expand...
Click to collapse
My phone is rooted, it's one of the first things I do when I buy a new phone, but let's not turn another security fu** up into a good thing.
Oneplus devices are not just for "nerds" anymore. In the UK, for example, a network (O2) sell their phones just like they sell iPhones and Galaxys. They advertise on newspapers, trains, etc. Normal users, that use their phones for many things, don't know what TWRP or a custom ROM is. This is an issue.
By the way, the guy who found this app keeps posting new stuff on twitter: https://twitter.com/fs0c131y/status/930773795656396801
Rosa Elefant said:
I actually prefer people finding/reporting bugs with OnePlus caring for resolving the mentioned issues to people not finding/reporting bugs and/or a company which ignores them.
Click to expand...
Click to collapse
And I agree, no software is bug free or completely secure and we all benefit when bugs are found and fixed.
The problem here is that some of these issues should never be there in the first place. Looking at the security holes from the past 2 years, it's clear to me that software is one of OnePlus weak points. For example, the bootloader problem that was fixed earlier this year was an amateur mistake... either that or they don't even know it could be an issue.
And it's not like people are not trying to find issues on Google's new Pixel or on Samsung's flagships... there's even a big market for that! But it's harder to find issues because these companies have people that know what they are doing.
I think something is wrong when using an aftermarket ROM is safer than using OxygenOS. We should be aware of these issues when buying something from them.
S4turno said:
And I agree, no software is bug free or completely secure and we all benefit when bugs are found and fixed.
The problem here is that some of these issues should never be there in the first place. Looking at the security holes from the past 2 years, it's clear to me that software is one of OnePlus weak points. For example, the bootloader problem that was fixed earlier this year was an amateur mistake... either that or they don't even know it could be an issue.
And it's not like people are not trying to find issues on Google's new Pixel or on Samsung's flagships... there's even a big market for that! But it's harder to find issues because these companies have people that know what they are doing.
I think something is wrong when using an aftermarket ROM is safer than using OxygenOS. We should be aware of these issues when buying something from them.
Click to expand...
Click to collapse
While I can see a use for this you have to keep something in mind. All devices sold from China based companies will always have something like this. Mainly die to the laws requiring monitoring software to be installed. This comes from their right to monitor everything their citzens do on line and with their mobile devices. It is part of the reason most China OEM are not allowed in places with high security needs.
Actually....I think Oxygen OS is ONEPLUS's biggest differentiator.
And it's excellent.
It's fast, it's smooth, no-one does updates better.
They will have to double down on security but nobody does software like ONEPLUS.
kolembo said:
It's fast, it's smooth, no-one does updates better.
Click to expand...
Click to collapse
"Fast and smooth" are two of the major gains of Android 7. Even my old(ish) LG is still adequately fast and smooth. :good:
kolembo said:
Actually....I think Oxygen OS is ONEPLUS's biggest differentiator.
And it's excellent.
It's fast, it's smooth, no-one does updates better.
They will have to double down on security but nobody does software like ONEPLUS.
Click to expand...
Click to collapse
That is open for debate. I personally think it is one of the worst available. If you really think it is fast and fluid you should try an aosp based rom.
How do the Slim ROMs perform on OnePlus?
zelendel said:
While I can see a use for this you have to keep something in mind. All devices sold from China based companies will always have something like this. Mainly die to the laws requiring monitoring software to be installed. This comes from their right to monitor everything their citzens do on line and with their mobile devices. It is part of the reason most China OEM are not allowed in places with high security needs.
Click to expand...
Click to collapse
So, all these issues are related to OOS. Is it likely to be present in custom ROMs too as they too use kernel codes released by Oneplus? Thinking of buying OP 5T.
unos21 said:
So, all these issues are related to OOS. Is it likely to be present in custom ROMs too as they too use kernel codes released by Oneplus? Thinking of buying OP 5T.
Click to expand...
Click to collapse
Not all issues are OS related. For example, the bootloader issue from Feb 2017 couldn't be fixed with a custom ROM.
Things like analytics and shady apps are not present on very well know custom ROMs not based on OxygenOS (LineageOS, OmniROM, Paranoid Android, etc), but keep in mind that the camera quality will never be as good as stock.
unos21 said:
So, all these issues are related to OOS. Is it likely to be present in custom ROMs too as they too use kernel codes released by Oneplus? Thinking of buying OP 5T.
Click to expand...
Click to collapse
Yes but most of the code is not kernel related. Very little of it is. It is in the format of "services" and hidden apks like the last one found.
Not gonna lie, I purchased a OnePlus One because of the development community. I usually flash a different ROM straight away.
I bought a OnePlus 5 hoping that would be the same situation. It's not. Don't get me wrong, it's not bad, but it's not like my Nexus phone.
The OnePlus 5T? My understanding is that until the 21st of November, there is a media embargo. After that, there will be more information about the device.
I'll make a decision after that.
ToucanSam said:
My understanding is that until the 21st of November, there is a media embargo.
Click to expand...
Click to collapse
Depends on how usual the reviewer models are.

Categories

Resources