Slashdot Mirror
Recent Blu Update Locks Users out of Their Phones (bleepingcomputer.com)
An Android update that Blu shipped to Blu One Life X2 smartphones yesterday, November 28, has locked people out of their phones. From a report: On forums, Reddit, and Blu's official Facebook page, users are complaining that after applying the update and rebooting the device, their phone won't recognize their password, PIN code, or pattern lock, even if users are 100% sure they are entering the correct data. Bleeping Computer has independently verified this bug. "I updated my BLU Life One X2 around 2 hours ago. It asks for a password in order to access Android," said one of the Blu users facing this problem. "I am completely locked out of my phone. Ever single password used is marked incorrect." After ten "failed" login attempts, the user's data is wiped from the device, according to the standard Android OS behavior.
we learned earlier today that you can spoof login to become root on macOS -- this android feature makes it much, much more secure than macOS - you cannot login as root (or anything else) :-).
For those who don't know BLU, I had never heard of them either, so I assumed it is some sort of small Chinese OEM, but actually it seems BLU (Bold Like Us) phones are popular with the Latin population in the Americas. They have been known to to send data to China, so I guess their reputation is not top notch...
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
BLU Started out to be one of the GSM Good Guys. They offered a MediaTek based, inexpensive, near Stock Android experience I own two BLU Studio 5.0C devices, and two BLU R1 HD. They didn't have locked bootloaders. They supported proper FastBoot and Recovery. Most applications were not installed in the system parition. Root was easy.
Then you found out that BLU either couldn't, or wouldn't update the version of Android on their devices, instead they would patch KitKat or Lollipop against whatever vulnerabilities they have. This was because their MediaTek Drivers made updatng the roms very likely to break things. Then, after a few years, they started dropping support for devices entirely.
Then came things like the Sponsorship deals with Amazon to put Ads on lock screens... and this started with the R1 HD... and... oh boy... here we go. Here came the locked bootloaders. Here came the Amazon Preloads of whatever App they had. When people started rooting them to get rid of that garbage, they responded by altering their Preloaders to patch out Fast Boot Access, and disable SP Flash tools. By this time there were TWRP recoveries, Alternate Stock roms, and LineageOS Builds.
They not only disabled SP Flash Tools for their Amazon suppoerted models, but every model post the R1 HD that wasn't Ad supported.
The last straw for me was the ADUPS Debacle, and the MTK Logger vulnerability, and I promise you, I will not buy another device from BLU.
I'm surprised Blu is still around. Surely after the multiple spyware discoveries and all the other crap surrounding Blu, there isn't anyone left that doesn't know to avoid Blu.
"That's the way to do it" - Punch
I've had a Blu Vivo 6 for a fraction over a year now (bought on Black Friday 2016 - its actual release day here in the UK) and there's not been a *single* update for it (not even a minor one). So it's stuck on Android 6.0 and an Android security patch level from way back in September 2016! Looking at Blu's Facebook/Twitter, it's full of people with Blu phones begging for any sort of updates...and getting right royally fobbed off by Blu staff every time ("we're working on it", "it's coming soon"...for a full year?!). It seems Blu just abandon a phone on launch and release its successor 6-12 months later with the updates instead (yep, there's a Blu Vivo 8 with Android 7 available in the US now, but the specs aren't that much better than the Vivo 6).
This annoyed me so much, I've just bought a Umidigi Z1 (more RAM, faster CPU/GPU, Android 7, dual rear cameras, multiple updates this year, costs 50 pounds less) to replace it. A shame really, because the Vivo 6 is actually a nice phone - if it had gone to Android 7 like the Vivo 8 has, I'd have kept it for much longer.