OnePlus 2 units from Kogan pre-loaded with malware; other phones may be affected

Well-known Australian online retailer Kogan, named for its founder Ruslan Kogan, appears to have had a bit of an issue of late. They do a lot of things that are really cool, like sourcing hard-to-get handsets and making them available to Australian consumers (amongst all the televisions and other things they do), but it seems more recently, they’ve run into some hot water with selling the OnePlus 2.

This all starts, you see, because the OnePlus 2 is harder to get hands on than most other phones. Kogan found success in selling more mainstream handsets that were widely available elsewhere, but not in Australia. The OnePlus 2, on the other hand, isn’t widely available anywhere, and that’s where this gets sticky.

Customers flocked to Kogan’s website when news hit that they’d sell the OnePlus 2, perhaps without wondering where Kogan would actually get their hands on the devices to sell to consumers.

We’ve heard stories of a few customers now, including Dev, who received the OnePlus 2 from Kogan and all was not well. In Dev’s words:

“The OnePlus 2 ships with Oxygen OS, which is a near-stock experience of Android with minor changes. However, scrolling through the pre-installed apps on the device, I found a surprising amount of bloatware. Apps like ‘Clean Master’, notorious for containing adware, and some others that I hadn’t previously heard of, such as ‘Magic Photo’, ‘DC Share’, ‘KK Browser’, and ‘Search’ (not Google Search, but a third party app) to name a few. I found this particularly odd, as Oxygen OS out of the box only contains the default Google Apps (Maps, Search, YouTube, Messenger, etc.) The number of third-party apps pre-installed on the device indicated something else. In addition to this, the “System Update” option usually in the “About” setting of the phone, was missing, so I could not even perform a software update.”

At first, Kogan didn’t pay much attention to Dev’s complaints when he tweeted them last week. Their response seemed a little flippant:

@tuesdev It’s normal of the telcos to preinstall Apps. They should be easily removed. Sorry for the inconvenience #WasntUs

— Kogan.com (@Kogan) October 8, 2015

Dev took the issue to Reddit, and quickly found that others had found the same kind of issues:

As if adware coming preinstalled on the phone wasn’t bad enough — it shouldn’t have had any — other users reported finding worse, including actual malware which could really compromise a device (though it’s noted this user did not buy their phone from Kogan):

This suggests that there was an issue further back in the supply chain, perhaps Kogan’s supplier was playing a risky game with handsets they were on-supplying to Kogan. There’s a bit of an explanation on Dev’s blog about the impact of this malware, but that’s really not the point here. What is the point, as Dev says:

“The sad truth of the matter is, of the tens of thousands of OnePlus 2 devices shipped from Kogan’s warehouses over the past few months, no one knows how many of them contained a modified firmware. Many users will never know what apps ‘should’ ship with their device, what is safe, and what is unsafe. It is the responsibility of the re-seller to ensure that the device they are selling is one which they are liable for.”

We’ve been following this story and speaking to Kogan to find out what’s going on. We didn’t want to write a story without digging a bit further, and so we raised our questions with Sling and Stone, who are Kogan’s public relations firm. We did this with integrity in mind; it’s not our practice to publish negative things about anyone without giving them an opportunity to comment.

Unfortunately, while we received a response, it didn’t give us much to work with. Kogan provided a quote from Ruslan, stating:

“We have been made aware of the issue and we take these things very seriously. We are investigating with the distributor and are asking the customer to return the phone to confirm the issue.”

A fairly generic response, but it showed that Kogan were doing something about it.

However, there’s been a bit more to it. Since Dev took to the Internet to resolve his issue, there have been two major developments:

• Firstly, as of 13 October, Kogan has removed the OnePlus 2 from sale from its website. This is good for customers going forward, but there’s two issues — what about the existing customers who’ve already bought one, and what about the other phones that appear to be affected from other manufacturers?
• As of 14 October, Kogan have decided it was their supplier of the OnePlus 2 (a new supplier, they add) that is responsible for adding malware and adware to the OnePlus 2 handsets, and so they’ve ceased dealings with that supplier. Further, customers who’ve bought a OnePlus 2 are being contacted by Kogan to be offered refunds, returns, or other options to repair their phones to a safe and saleable state.

It’s not exactly a good news story, and it highlights the risks of purchasing phones from unofficial channels. While in many instances the kinds of issues that Kogan has experienced with the OnePlus 2 probably won’t arise, it does show that without an official supply chain, there’s a number of places in the process where mischief can occur.

We’re investigating a further story related to this, which we’ll be reporting on shortly.

Ausdroid sought and received comment from Kogan via their PR firm as noted above. Ausdroid sought comment from OnePlus 2 but none was received by the time of publication.