Hacker News Reader

Comment by TomatoCo | Hacker News Reader

My understanding is there was a bug that let you wipe and re-enable a phone that had been disabled due to theft. This prevents a downgrade attack. It's in OnePlus's interest to make their phones less appealing for theft, or, in their interest to comply with requirements to be disableable from carriers, Google, etc.

View on HN

Carriers can check a registry of stolen phone IMEIs and block them from their networks.

There is a surprising number of carriers in the world that don't care if you're using a stolen phone.

Not surprisingly, stolen phones tend to end up in those locations.

I have never seen this happen.

I have however experienced that a ISP will write to you because you have a faulty modem (some Huawei device) and asks you to not use it anymore.

Visit eBay and search for "blocked IMEI" or variants. There are plenty of used phones which are IMEI locked due to either: reported lost, reported stolen, failed to make payments, etc.

All offers seem to be from the US.

I the lines between IMEI banning or blacklisting and the modern unlocking techniques they use have been blurred a little bit and so some carriers and some manufacturers don't really want to do or spend time doing the IMEI stuff and would prefer to just handle it all via their own unlocking and locking mechanisms.

right, but the stolen phones get sold in other countries where the carriers don't care if the phone was stolen but care that someone is spending money on their service.

And we cant own our phones due to that?

With vulnerable FW, you can change IMEIs. Hence this kind of rollback prevention updates.

Make perfect sense, Thanks kind stranger. Hope it is the reason and not some corporate greed. It on me, lately my thoughts are defaulted towards corporates sabotaging consumers. I need to work on it.

The effects on custom os community is causing me worried ( I am still rocking my oneplus 7t with crdroid and oneplus used to most geek friendly) Now I am wondering if there are other ways they could achieved the same without blowing a fuse or be more transparent about this.

I don't think so. Blowing a fuse is just how the "no downgrades" policy for firmware is implemented. No different for other vendors actually, though the software usually warns you prior to installing an update that can't be manually rolled back.

Are you quite certain?

Google pushed a non-downgradable final update to the Pixel 6a.

I was able to install Graphene on such a device. Lineage was advertised and completely incompatible, but some hinted it would work.

As I understand it, this is a similar thing on Samsung handhelds:

https://en.wikipedia.org/wiki/Samsung_Knox

> It on me, lately my thoughts are defaulted towards corporates sabotaging consumers. I need to work on it.

You absolutely do not, this is an extremely healthy starting position for evaluating a corporations behavior. Any benefit you receive is incidental, if they made more money by worsening your experience they would.

> It's in OnePlus's interest to make their phones less appealing for theft,

I don't believe for a second that this benefits phone owners in any way. A thief is not going to sit there and do research on your phone model before he steals it. He's going to steal whatever he can and then figure out what to do with it.

It actually seems to work pretty well for iPhones.

Thieves these days seem to really be struggling to even use them for parts, since these are also largely Apple DRMed, and are often resorting to threatening the previous owner to remove the activation lock remotely.

Of course theft often isn't preceded by a diligent cost-benefit analysis, but once there's a critical mass of unusable – even for parts – stolen phones, I believe it can make a difference.

Yes thieves do, research on which phones to steal. Just not online more in personal talking with their network of lawbreakers. In short a thief is going to have a fence, and that person is going to know all about what phones can and cannot be resold.

Which is why I mentioned that carriers or Google might have that as a requirement for partnering with them. iPhones are rarely stolen these days because there's no resale market for them (to the detriment of third party repairs). It behooves large market players, like Google or carriers, to create the same perception for Android phones.

Thieves don't do that research to specific models. Manufacturers don't like it if their competitors' models are easy to hawk on grey markets because that means their phones get stolen, too.

> My understanding is there was a bug that let you wipe and re-enable a phone that had been disabled due to theft. This prevents a downgrade attack.

This makes sense and much less dystopia than some of the other commenters are suggesting.

That's even more dystopian.

Reply on news.ycombinator.com