OnePlus denies sending clipboard data to China

Phone-maker OnePlus has had a tough time of things in the press recently with claims about users' clipboard data being mined, and the problems following a credit card breach. A second suggestion that the company was sending clipboard data back to China surfaced recently, but the company has been quick to deny any wrongdoing.

Suspicions were raised when a OnePlus user noticed a file called badwords.txt which includes a list of words such as "chairman," "private message" and "address."

See also:

• OnePlus admits that up to 40,000 accounts were affected by a credit card breach
• Download Android 8.0 Oreo for OnePlus 5 now

The file was noticed by a French security researcher called Elliot Anderson. It was found in a compression archive called "pattern" along with a number of other files. Anderson explains that "all these files are used in an obfuscated package which seems to be an #Android library from Teddymobile," which is "a Chinese company" that works "with a lot of manufacturers including Oppo."

Anderson shared his findings on Twitter:

The @OnePlus #clipboard app contains a strange file called badword.txt ?

In these words, we can find: Chairman, Vice President, Deputy Director, Associate Professor, Deputy Heads, General, Private Message, shipping, Address, email, ...https://t.co/ePQvD1citn pic.twitter.com/3dCh0joVkH

— Elliot Alderson (@fs0c131y) January 25, 2018

OnePlus wasted little time in putting out a statement which reads:

There's been a false claim that the Clipboard app has been sending user data to a server. The code is entirely inactive in the open beta for OxygenOS, our global operating system. No user data is being sent to any server without consent in OxygenOS.

In the open beta for HydrogenOS, our operating system for the China market, the identified folder exists in order to filter out what data to not upload. Local data in this folder is skipped over and not sent to any server.

As explained by Android Police, it seems that OnePlus accidentally included code from its Chinese HydrogenOS (albeit inactive code) in OxygenOS in the rest of the world. While seemingly innocent, users have been increasingly wary of OnePlus of late.

Image credit: Kazick / Shutterstock