Question Root vulnerability Nord 2 - OnePlus Nord 2 5G

Greetings. My name is Vangelis. I ordered a Nord 2 from a reseller in Europe.
When the phone arrived it was perfect not a single scratch. But when I open the phone for the first time it booted to the android menu with the Czech language preinstalled. I know it should be open with the default setup. I immediately reset the phone to default and followed the setup guide. I also check the IMEI code with Oneplus and the phone is genuine.IMEI at the box and on the phone are the same. On The box, the manufacturing date is 25/11/2021. Code ##786# doesnt work to track RTN neither *#*#786#*#*. I said to myself that maybe the reseller in Europe opened it to see if it working and close it again somehow or it's refurbished and they sell it as new. The charger, cable, and all the things in the box were placed perfectly. The phone is working just fine as I can see. The phone was not updated and I updated it before I wipe it ( wipe all data from pressing down and power button). Now it's DN2103_11_A.14 but on the main screen of About phone writes OxygenOs Version V11.3.I checked an app called root checker and my phone is not rooted.
I just wonder with the Root vulnerability you guys in XDA discovered ( thumps up for that ) in the worst-case scenario let's imagine someone had physical access to a computer before they send me the phone is my data in danger? What do you suggest I do? Many thanks.

---

I would not bother, if your phone is rooted you'll see it as soon as you turn on the phone
You get a message saying your bootloader can not be trusted

---

Why are you worried about an imaginary situation which can steal your kind of data ? Anyway all android or windows platform have hidden/secret backdoor , Google track your browsing , movements , phone utilization , WhatsApp or Telegram despite encrypted conversation can be track by nations intelligence services , China is worst for this point of view . Nothing is concrete safe today ... All have vulnerabilities which can be exploited and for that exist month or less provided updates from manufacturers
Your phone seems to be usable and safe as all can be so don't trouble anymore .

---

muppetz said:
Why are you worried about an imaginary situation which can steal your kind of data ? Anyway all android or windows platform have hidden/secret backdoor , Google track your browsing , movements , phone utilization , WhatsApp or Telegram despite encrypted conversation can be track by nations intelligence services , China is worst for this point of view . Nothing is concrete safe today ... All have vulnerabilities which can be exploited and for that exist month or less provided updates from manufacturers
Your phone seems to be usable and safe as all can be so don't trouble anymore .
Click to expand...
Click to collapse
Is it not normal to worry if my phone has been opened before they send it to me? I know about google, government, Facebook, etc its a whole different discussion from a possible hack or the phone instead of new is refurbished.

---

ok , you're right

---

Vangelis kokkinakis said:
Is it not normal to worry if my phone has been opened before they send it to me? I know about google, government, Facebook, etc its a whole different discussion from a possible hack or the phone instead of new is refurbished.
Click to expand...
Click to collapse
Yes. When people buy a new phone many want it to be factory sealed. Retailers know this.
Not so much for fear of implanted rootkits etc as the concern some schmuck had their grubby hands on it.
You paid the big bucks to get a new phone, it should be factory sealed.
Is it a deal killer if the phone is mint and the price is right? Probably not, but it's your call.

---

It's extremely unlikely (nigh impossible) that there is any malware on your phone from what you have described. If there was, resetting your phone to stock would have removed it anyway.
The steps it would take to develop and preload a perfectly working copy that imitates the stock rom well, whilst having custom code injected would be phenomenal and completely unrealistic. Especially for a phone like the Nord2 with it's rather low userbase and fairly uncommon Mediatek processor.
If you're worried, just boot into recovery, wipe data and reformat, and any odds of spyware/malware on your phone should become about as close to zero as it can get for anyone with a modern smartphone.
Now, if you're talking about the stock rom's well documented vulnerability, that all Nord2's come loaded with, then yes, they're all vulnerable, but that literally requires the attacker to have your phone in their physical possession; So unless you're planning to physically mail your phone, with your data unwiped, to a malicious party you have nothing to worry about. I don't personally see the vulnerability as much of an issue, as your average joe won't know how to exploit it, and it's been useful to several tinkerers on these forums who've used it to pull a backup of their data off their own phones after a serious bootloop/softbrick scenario happened to them.

---

Zombnombs said:
It's extremely unlikely (nigh impossible) that there is any malware on your phone from what you have described. If there was, resetting your phone to stock would have removed it anyway.
The steps it would take to develop and preload a perfectly working copy that imitates the stock rom well, whilst having custom code injected would be phenomenal and completely unrealistic. Especially for a phone like the Nord2 with it's rather low userbase and fairly uncommon Mediatek processor.
If you're worried, just boot into recovery, wipe data and reformat, and any odds of spyware/malware on your phone should become about as close to zero as it can get for anyone with a modern smartphone.
Now, if you're talking about the stock rom's well documented vulnerability, that all Nord2's come loaded with, then yes, they're all vulnerable, but that literally requires the attacker to have your phone in their physical possession; So unless you're planning to physically mail your phone, with your data unwiped, to a malicious party you have nothing to worry about. I don't personally see the vulnerability as much of an issue, as your average joe won't know how to exploit it, and it's been useful to several tinkerers on these forums who've used it to pull a backup of their data off their own phones after a serious bootloop/softbrick scenario happened to them.
Click to expand...
Click to collapse
You're assuming it be in the user data. It could be in the firmware. That's where the nastiest rootkits nest. Physical access to the device would make it possible. It also would allow actual chipset swapping as well, ask the DOD, DEA, CIA etc about chipset based backdoors.
I doubt this is the case, but it's a wide, wild world.
It should have been sold as an open box special if that was the case.

---

Zombnombs said:
It's extremely unlikely (nigh impossible) that there is any malware on your phone from what you have described. If there was, resetting your phone to stock would have removed it anyway.
The steps it would take to develop and preload a perfectly working copy that imitates the stock rom well, whilst having custom code injected would be phenomenal and completely unrealistic. Especially for a phone like the Nord2 with it's rather low userbase and fairly uncommon Mediatek processor.
If you're worried, just boot into recovery, wipe data and reformat, and any odds of spyware/malware on your phone should become about as close to zero as it can get for anyone with a modern smartphone.
Now, if you're talking about the stock rom's well documented vulnerability, that all Nord2's come loaded with, then yes, they're all vulnerable, but that literally requires the attacker to have your phone in their physical possession; So unless you're planning to physically mail your phone, with your data unwiped, to a malicious party you have nothing to worry about. I don't personally see the vulnerability as much of an issue, as your average joe won't know how to exploit it, and it's been useful to several tinkerers on these forums who've used it to pull a backup of their data off their own phones after a serious bootloop/softbrick scenario happened to them.
Click to expand...
Click to collapse
Thank you so much for your detailed and thorough answer to my question. I appreciate it.

---

blackhawk said:
You're assuming it be in the user data. It could be in the firmware. That's where the nastiest rootkits nest. Physical access to the device would make it possible. It also would allow actual chipset swapping as well, ask the DOD, DEA, CIA etc about chipset based backdoors.
I doubt this is the case, but it's a wide, wild world.
It should have been sold as an open box special if that was the case.
Click to expand...
Click to collapse
I don't have enough experience on this that's why I asked , Is there anything I can do except root the device and lose the warranty in order to check the integrity of my phone system files?

---

Vangelis kokkinakis said:
I don't have enough experience on this that's why I asked , Is there anything I can do except root the device and lose the warranty in order to check the integrity of my phone system files?
Click to expand...
Click to collapse
Return it, don't worry about it or reflash the rom to the same version. Reflashing the rom will purge any rootkit in existence.
It's probably completely harmless, oh wait that's what started all this...
It's not your fault if you weren't sold a factory sealed unit... so there's that. I be irritated too.

---

This is a description of Android partitions.
Deeper than I ever go... make sure you know or get someone who knows exactly what they've doing if you go down this path.
I do not recommend doing this as a screw up could brick the device.
Really other than returning it I would simply observe it for abnormal behavior.
This setting mod will globally block ads.
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}

---

But again, the likelihood that any such kit has been developed for a phone like the nord2 is pretty slim. Generally malicious coders, hacktivists, whitehats, and all of those kind of security breaching personas are exponentially more focused on the more popular phones; That means if a phone model has double the users, it's probably dozens of times more likely it would catch the attention of these kind of coders.
While we don't know exact figures for total Nord2 sales; We have a rough estimate; Probably less than 5% than the amount of Iphones and Samsungs sold. Definitely even less than the amount of Oneplus 9's sold. So taking the exponential probability graph backwards, the chance of anything even remotely close to a "faux stock rom" existing for the Nord 2 is basically negligible. We've barely even had our first couple of custom roms released in the past few weeks, not to mention Oneplus does NOT release the stock rom for the Nord2. So basically, development time to create such a thing for the nord 2 is a waste of time. Why target a few thousand users when you could target millions for the same price/effort?
I would never claim anything has a completely "zero" chance, but as far as non-zero probabilities go, this is about as close as it gets; Assuming you wipe/reformat you should get rid of most nerfarious apps or spyware (probably like 99% gone, the stuff most average joes would have access to like shady apk's and so on), then a reflash should get rid of 99% of the remaining possibilities (rootkits and so on). Anything to survive those would be a pretty fundamental vulnerability that is yet unheard of, and unlikely to exist, nor even be found if it did exist. Especially one that puts your data in any kind of danger.
Just my opinion, so as with all things, take it with a grain of salt.