Unpatched OnePlus OxygenOS Root Flaw Chain (Also Affecting OPPO): Detection and Hardening Guide for Android Fleets

---
title: Android SU Binary Execution From Non-System Context
id: 3f8a1c94-2b7d-4e5a-9c16-8d4e2f7a1b35
status: experimental
description: Detects execution of su or common root-management binaries from an application UID on Android devices. Root escalation from an installed app is the end state of the unpatched OnePlus/OPPO OxygenOS privilege escalation chain reported September 2026.
references:
  - https://thehackernews.com/2026/09/unpatched-oneplus-flaws-let-installed.html
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection_image:
    Image|endswith:
      - '/su'
      - '/magisk'
      - '/busybox'
  selection_path:
    CommandLine|contains:
      - '/system/bin/su'
      - '/system/xbin/su'
      - '/sbin/su'
      - '/data/local/tmp/su'
  filter_system:
    User:
      - 'root'
      - 'shell'
      - 'system'
  condition: (selection_image or selection_path) and not filter_system
falsepositives:
  - Legitimate enterprise-rooted test devices
  - Developer/QA devices intentionally rooted for build validation
level: high
---
title: Android SELinux Permissive Mode or Enforcement Weakening
id: 91d2e7b4-5c3a-4f68-8b12-7e9a3d5c6f48
status: experimental
description: Detects attempts to set SELinux to permissive mode or remount system partitions writable on Android devices, a common post-root action following exploitation of vendor privilege escalation flaws such as the OnePlus/OPPO OxygenOS chain.
references:
  - https://thehackernews.com/2026/09/unpatched-oneplus-flaws-let-installed.html
  - https://attack.mitre.org/techniques/T1562/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.defense_evasion
  - attack.t1562.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_setenforce:
    CommandLine|contains:
      - 'setenforce 0'
      - 'setenforce permissive'
  selection_remount:
    CommandLine|contains:
      - 'mount -o remount,rw /system'
      - 'remount,rw /vendor'
      - 'remount,rw /product'
  condition: 1 of selection_*
falsepositives:
  - OEM factory diagnostics tooling (rare on production builds)
  - Intentionally rooted development devices
level: high
---
title: Sideloaded APK Installation Outside Managed Store on Corporate Android Fleet
id: 5e7b3a91-4d28-4c5f-9a47-2c8e1b6d3f52
status: experimental
description: Detects package installation via shell/package manager from non-managed sources on managed Android devices. The OnePlus/OPPO root chain is delivered via an installed application with no special permissions, making sideloaded install telemetry the earliest detectable stage of the attack.
references:
  - https://thehackernews.com/2026/09/unpatched-oneplus-flaws-let-installed.html
  - https://attack.mitre.org/techniques/T1476/
author: Security Arsenal
date: 2026/09/18
tags:
  - attack.initial_access
  - attack.t1476
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'pm install '
      - 'cmd package install'
      - 'adb install'
  filter_managed:
    User:
      - 'mdm_agent'
      - 'device_policy'
  condition: selection and not filter_managed
falsepositives:
  - Developer devices with ADB enabled for legitimate build deployment
  - IT staging/provisioning workflows (tune by provisioning window)
level: medium

// Hunt: root escalation artifacts on managed Android fleet (OnePlus/OPPO exposure)
// Tables: Syslog (MDM/MTD forwarded logcat + audit logs), fallback CommonSecurityLog
let rootIndicators = dynamic(["su", "setenforce 0", "magisk", "remount,rw", "avc: denied", "ro.secure=0", "Superuser.apk"]);
union isfuzzy=true
    (Syslog
    | where TimeGenerated > ago(7d)
    | where SyslogMessage has_any (rootIndicators)
    | extend Indicator = extract(@"(setenforce 0|magisk|remount,rw|avc: denied|ro\.secure=0|Superuser\.apk|/su\b)", 1, SyslogMessage)
    | project TimeGenerated, Computer, HostIP, ProcessName, Indicator, SyslogMessage, Source = "Syslog"),
    (CommonSecurityLog
    | where TimeGenerated > ago(7d)
    | where Message has_any (rootIndicators)
    | extend Indicator = extract(@"(setenforce 0|magisk|remount,rw|avc: denied|ro\.secure=0|Superuser\.apk|/su\b)", 1, Message)
    | project TimeGenerated, Computer = DeviceName, HostIP = SourceIP, ProcessName = ApplicationProtocol, Indicator, SyslogMessage = Message, Source = "CEF")
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
            Indicators = make_set(Indicator) by Computer, HostIP, ProcessName, Source
// Devices showing BOTH su execution and SELinux weakening are high-confidence rooted
| extend Confidence = iff(array_length(Indicators) >= 2, "High — probable rooted device", "Medium — single artifact, investigate")
| order by Confidence desc, Events desc;

// Timeline for a flagged device — replace <DEVICE_NAME>
let targetDevice = "<DEVICE_NAME>";
union isfuzzy=true
    (Syslog | where Computer == targetDevice),
    (CommonSecurityLog | where DeviceName == targetDevice)
| where TimeGenerated > ago(7d)
| where SyslogMessage has_any (dynamic(["pm install", "cmd package install", "su", "setenforce", "magisk", "avc", "mount", "remount"]))
   or Message has_any (dynamic(["pm install", "cmd package install", "su", "setenforce", "magisk", "avc", "mount", "remount"]))
| order by TimeGenerated asc
| project TimeGenerated, Computer, ProcessName, Message = coalesce(SyslogMessage, Message);

-- Hunt for Android rooting artifacts consistent with post-exploitation state
-- of the OnePlus/OPPO OxygenOS privilege escalation chain
-- Deploy against device filesystem mounts, backups, or on-device collectors

SELECT FullPath, Size, Mtime, Btime,
       CASE
         WHEN FullPath =~ 'su$' THEN 'su binary present'
         WHEN FullPath =~ '(?i)magisk|zygisk|kernelsu' THEN 'root manager framework'
         WHEN FullPath =~ '(?i)superuser|supersu' THEN 'root management APK'
       END AS ArtifactType
FROM glob(globs=[
  '**/system/bin/su',
  '**/system/xbin/su',
  '**/sbin/su',
  '**/data/local/tmp/su',
  '**/data/local/tmp/**magisk**',
  '**/data/adb/magisk/**',
  '**/data/adb/ksu/**',
  '**/*Superuser*.apk',
  '**/*SuperSU*.apk'
])
WHERE FullPath !~ '(?i)baseline|known_good'
ORDER BY Mtime DESC

-- Live process hunt for root managers and shell-with-root on instrumented Android/Linux endpoints
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(magiskd|kernelsu|/su\b|setenforce|daemonsu)'
   OR (Name =~ 'sh' AND Username =~ 'root' AND Ppid > 2)
ORDER BY CreateTime DESC

#!/usr/bin/env bash
# Security Arsenal — Android root-exposure audit for OnePlus/OPPO fleets
# Usage: ./android_root_audit.sh <device_serial>
# Requires: adb, device connected with ADB authorized (managed enrollment recommended)
set -euo pipefail
SERIAL="${1:?Usage: $0 <device_serial>}"
ADB="adb -s ${SERIAL} shell"
REPORT="root_audit_${SERIAL}_$(date +%Y%m%d_%H%M%S).txt"

echo "=== Android Root Exposure Audit: ${SERIAL} ===" | tee "${REPORT}"

# 1. Device identity — flag OnePlus/OPPO models pending the vendor fix
echo -e "\n[1] Device identity" | tee -a "${REPORT}"
${ADB} "getprop ro.product.manufacturer; getprop ro.product.model; getprop ro.build.version.release; getprop ro.build.version.security_patch" | tee -a "${REPORT}"
MFR=$(${ADB} "getprop ro.product.manufacturer" | tr -d '\r')
if echo "${MFR}" | grep -qiE 'oneplus|oppo'; then
  echo "[!] AFFECTED VENDOR — unpatched OxygenOS/ColorOS root chain applies. Treat as high-risk until patched." | tee -a "${REPORT}"
fi

# 2. SELinux enforcement state — anything but Enforcing is a red flag on production devices
echo -e "\n[2] SELinux state" | tee -a "${REPORT}"
${ADB} "getenforce" | tee -a "${REPORT}"

# 3. Root artifacts
echo -e "\n[3] Root artifact check (su / magisk / kernelsu)" | tee -a "${REPORT}"
for p in /system/bin/su /system/xbin/su /sbin/su /data/local/tmp/su /data/adb/magisk /data/adb/ksu; do
  if ${ADB} "[ -e ${p} ] && echo FOUND" | grep -q FOUND; then
    echo "[!] ROOT ARTIFACT: ${p}" | tee -a "${REPORT}"
  fi
done
${ADB} "pm list packages | grep -iE 'magisk|supersu|superuser|kernelsu|zygisk'" | tee -a "${REPORT}" || true

# 4. Sideloading posture — unknown sources should be off on managed devices
echo -e "\n[4] Unknown sources / install posture" | tee -a "${REPORT}"
${ADB} "settings get global install_non_market_apps; settings get secure install_non_market_apps" | tee -a "${REPORT}"

# 5. Recently installed packages (last 7 days) — review anything outside managed Play
echo -e "\n[5] Recently installed/updated packages" | tee -a "${REPORT}"
${ADB} "dumpsys package | grep -E 'Package \[|firstInstallTime|lastUpdateTime' | tail -n 120" | tee -a "${REPORT}"

# 6. Play Integrity hint — developer options / USB debugging should be off on prod fleet
echo -e "\n[6] Debug posture" | tee -a "${REPORT}"
${ADB} "settings get global adb_enabled; settings get global development_settings_enabled; getprop ro.debuggable; getprop ro.secure" | tee -a "${REPORT}"

echo -e "\n=== Audit complete: ${REPORT} ===" | tee -a "${REPORT}"