Security Researcher Christopher Moore recently published a blog post detailed the practice of data collecting by the Shenzhen-based Chinese smartphone maker Oneplus, revealing that OxygenOS' built-in analytics is regularly sending users' telemetry data to the company's servers.
Moore intercepted the network traffic of Oneplus handset running OxygenOS to analyse what data his device sends to its servers, and found that the data collected by the company included:
- User’ phone number
- MAC addresses
- IMEI and IMSI code
- Mobile network(s) names
- Wireless network ESSID and BSSID
- Device serial number
- Timestamp when a user locks or unlocks the device
- Timestamp when a user opens and closes an application on his phone
- Timestamp when a user turns his phone screen on or off
"Wow, that is quite a bit of information about my device, even more of which can be tied directly back to me by OnePlus and other entities,"
"It gets even worse. These event data contain timestamps of which activities were fired up in which in applications, again stamped with the phone’s serial number." Moore said.
Moreover, there seems to be no directly available option within the OS to disable the data collecting "features".
The same issue was publicly reported to OnePlus back in July, 2016 but was ignored by the company.
Jakub Czekański, an Android developer, has introduced a permanent solution to disable telemetry tracking practice without rooting your device.
After connect your OnePlus device through USB debugging mode to a computer, open adb shell and enter command
pm uninstall -k --user 0 net.oneplus.odm
in order to get rid of the data collecting software.