As much as OnePlus is popular for its devices, it is also in the news for security breach every now and then. Once again, the company fixes a flaw in its system but there’s no evidence of exploit so far.

This new security flaw was tipped by Eric Lang, a reader of Android Police on June 30. The said publication disclosed OnePlus about the issue and received confirmation from the company on July 2 that they had fixed the vulnerability and there was no exploit.

The security vulnerability was in the OnePlus’ US out-of-warranty repair invoicing system. It is run by a third-party vendor and could have only affected a small subset of US customers.

It could have exposed the details of customers through their unpaid invoices for out-of-warranty repairs. But the chance of such exploit is very low and even OnePlus’ internal audit confirmed “no evidence of any purposeful attempts to access these URLs”.

If it was ever exploited, then it could have revealed the following data of customers to the attacker.

• Order number
• Phone model
• IMEI
• Order date
• Name
• Address
• Phone number
• Email address
• Repair cost

Some of the previous infamous OnePlus security disasters include a credit card breach that affected 40,000 customers, orders information breach, and Shot on OnePlus App flaw.

UP NEXT: OnePlus to launch a Bug Bounty program, users can earn up to $7000 (49,000 CNY)

The post OnePlus fixes a security flaw in its out-of-warranty repair invoicing system appeared first on Gizmochina.

OnePlus, the smartphone manufacturer, had publicly announced the second data breach in two years back in November 2019. Since then, the company has promised to launch a new bug bounty program by the end of the year 2019. The move was made to bump up security measures and prevent future breaches. Now, the company has finally announced that its bug bounty program is live.

For users that find any bug or vulnerabilities in the systems, they can submit it on OnePlus’s official website that features a new bug report section. Users must login first and apparently, the company will be creating and updating a leaderboard of top contributors. The company will even feature the top three contributors on the bug bounty’s main page as well.

In the about section of the bug bounty program, OnePlus promises to reward users that submit reports according to certain tiers.

• • Special cases: up to $7,000 (roughly 49,000 CNY)
  • Critical: $750–$1,500 (5,258-10,517 CNY)
  • High: $250–$750 (1,752-5,258 CNY)
  • Medium: $100–$250 (701-1752 CNY)
  • Low: $50–$100 (350-701 CNY)

Editor’s Pick: OnePlus 7 and OnePlus 7 Pro’ latest update brings back “Hide Notch” feature

The exact definition of the tiers are still uncertain, however, OnePlus states that the reward you may receive is, “determined based on vulnerabilities severity and actual business impact.” The company had previously announced that it would partner up with a world renowned security platform in December 2019. That is now confirmed to be the startup HackerOne.

The collaboration with HackerOne is starting as a pilot program which would see numerous select security researchers being invited to test against OnePlus’ systems. The company also mentioned that a public version of the same will be launched in 2020.

UP NEXT: Richard Yu: Huawei shipments to reach 230 million by the end of 2019

(Source,Via)

The post OnePlus to launch a Bug Bounty program, users can earn up to $7000 (49,000 CNY) appeared first on Gizmochina.

OnePlus’ customer data has been breached, yet again. The smartphone maker made an announcement a few hours back stating that some of its customer’s information like “name, contact number, email, and shipping address within certain orders” may have been exposed by the most recent data breach. However, information like payment information, passwords and accounts are safe.

OnePlus hasn’t given out an exact number of affected users, however, the company said that it has already sent out emails to the users whose data has been breached. If you were one of the affected customers, you should have received a mail similar to this sometime in the past couple of days. If you haven’t got an email from the company, then your data wasn’t breached.

Editor’s Pick: OnePlus 3 & 3T receive their Final Security update, ends official support

The official OnePlus website seems to be the point of the breach but the company assured that they have thoroughly inspected the website to ensure there are no similar security flaws. The company also adds that affected users ‘may receive spam and phishing emails as a result of this incident’.

This isn’t the first time OnePlus had a security breach. Last year, in January, credit card information of nearly 40,000 OnePlus customers was breached through the company’s OnePlus.net website. Unfortunately, the company has not revealed the scale of this particular breach.

Security breaches are never good for a company. However, the company assures that it will partner “with a world-renowned security platform next month, and will launch an official bug bounty program by the end of December”. This is definitely the right way moving forward, however, OnePlus should have probably done this immediately after the first breach to avoid a second incident.

UP NEXT: OnePlus 7 Pro’s audio is almost as good as the Note 10+ reveals DxOMark Audio Test

(Source)

The post OnePlus Customer Data Breached yet again, Names and Addresses likely exposed appeared first on Gizmochina.