Your OnePlus phone is probably at risk from a major SMS vulnerability

The OnePlus 13R is just one of many recent OnePlus devices potentially at risk.

The majority of OnePlus phones in use today may be vulnerable to a security flaw that leaves SMS and MMS data exposed, and it won’t be patched until mid-October. Only OnePlus phones still running 2020’s OxygenOS 11 or earlier are believed to be safe from the flaw.

Security company Rapid7 was first to discover the vulnerability, which relates to changes OnePlus made to the Telephony service within Android. The long and short of it is that it would allow installed apps to access SMS data “without permission, user interaction, or consent.” The company found the flaw on devices running OxygenOS 12, 14, and 15, though reported that the older OxygenOS 11, based on Android 11, is not vulnerable. While Rapid7 only tested two types of hardware — the OnePlus 8T and 10 Pro 5G — it says the flaw “affects a core component of Android,” and so is unlikely to be hardware-specific.

OnePlus has admitted to the issue, but in a statement given to 9to5Google by an unnamed spokesperson it says a fix won’t arrive until mid-October at the earliest.

We acknowledge the recent disclosure of CVE-2025-10184 and have implemented a fix. This will be rolled out globally via software update starting from mid-October. OnePlus remains committed to protecting customer data and will continue to prioritize security improvements.

Rapid7 announced the discovery on its blog on Monday this week, but OnePlus didn’t respond until Wednesday. Rapid7 says it tried and failed to contact OnePlus privately to discuss the problem, and only turned to a public disclosure after also ruling out the company’s bug bounty program because of its “restrictive Non Disclosure Agreement.”

Until the flaw is patched, Rapid7 recommends that OnePlus device owners should only install apps from trusted sources, uninstall any unnecessary ones, switch to encrypted messaging apps, and use authenticator apps rather than SMS-based two-factor authentication.

from The Verge https://ift.tt/DjsbJho

Comments

Pandora Stories lets artists add commentary to their own playlists

Pandora launched Stories today, a tool that lets artists and creators add voice commentary to their own playlists. The Stories feature merges podcasts with music playlists, and is meant for artists to add context to an album, or for podcasters to experiment with new storytelling formats. The feature is part of Pandora AMP, the streaming service’s free Artist Marketing Platform that helps creators promote their work. To kick off the launch, Pandora’s prepared some Stories by artists like John Legend and Daddy Yankee, who tell listeners their personal stories interspersed between their own songs. There’s also a Stories playlist called Love Songs That Aren’t Really Love Songs , which includes commentary on individual songs like a podcast... Continue reading… from The Verge - All Posts https://ift.tt/2Xz1oNc

Experts are furious over the FCC’s rosy picture of broadband access

To hear the Federal Communications Commission tell it, this is a golden age for broadband access in the United States. According to a newly released report from the agency on the digital divide, the gap between rural and urban internet access has “narrowed substantially, and more Americans than ever before have access to high-speed broadband.” Between the end of 2016 and the end of 2017, the number of Americans without broadband access fell from about 26 million to about 21 million, the report found. But experts, and even some commissioners at the FCC, say the report is flawed. The data underlying it, they argue, doesn’t truly capture what broadband looks like in rural America — leaving lawmakers and government officials with a warped... Continue reading… from The Verge - All Posts http://bit.ly/2HOPCZj

London health workers to receive free e-bike loaners to avoid public transport

Gocycle’s e-bikes are being offered as part of the plan. | Image: Gocycle Key National Health Service (NHS) workers in London are being offered a three-month e-bike loan to help them commute to work while social distancing. There are currently 20 Gocycle GS loaner e-bikes available, with more brands like Raleigh soon to join. The e-bikes and Abus locks and helmets are being distributed as part of a plan being organized by London-based e-bike retailer Fully Charged. Interested NHS workers can register their interest on this Fully Charged page , which also calls on other bike manufacturers and sponsors to pledge their support. Not only will free e-bikes reduce commuting costs for essential workers, but it will also help them avoid having to travel in close proximity to others on public transit. Transport for... Continue reading… from The Verge - All Posts https://ift.tt/2QQxBOf

Latest Technology

Search This Blog