Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CamScanner, a malicious Android app with more than 100M downloads in Google Play

kaspersky.com

Post reply on HN
Print view View original

41–50 of 155 posts

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#41

Post by emmelaich »

habosa wrote: post #35

I've been using this app for years and also telling other people to use it, so this sucks. If anyone else is looking for a replacement there's a Microsoft app called "Office Lens" that seems to do a really nice job and is as safe a bet as anything.

It's amazing to me that so few people are not aware of the excellent scanning apps from Google.

They work better, you're not expanding your privacy risk ... and they're free and integrated with Google docs etc.

* namely, Drive Scan and Photoscan

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#43

Post by a254613e »

So what exactly did this malware do most of the time?

In the original kaspersky report it says "For example, an app with this malicious code may show intrusive ads and sign users up for paid subscriptions.".

So how/did it sign up users for paid subscriptions without user interaction? Does android allow something like that? Aren't all apps sandboxed?

In general how is the android sandboxing and permission system nowadays? I'm considering switching back to it from iOS, but reports like this are kinda discouraging.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#44

Post by Abishek_Muthian »

PlayProtect is not detecting and warning users about CamScanner even when it has been removed from the Playstore.

I've tested it via manual scan on PlayProtect as well, no dice. Isn't that what it is supposed to do?

Has anyone ever got any app flagged by PlayProtect? If it's useless, then rather I would disable it than to give it access to all my installed apps.

Google Engineers here, please ping your Google Play team reg PlayProtect.

Edit: More detail.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#45

Post by jeroenhd »

asveikau wrote: post #40
tabjsina wrote: post #21

Earlier quoted context omitted.

May 22, 2019: 5.10.6.20190522 – safe June 6, 2019: 5.11.0.20190611 – safe June 14, 2019: 5.11.3.20190614 – safe June 16, 2019: 5.11.3.20190616 – unsafe June 24, 2019: 5.11.5.20190624 – unsafe July 10, 2019: 5.11.7.20190710 – unsafe July 23, 2019: 5.12.0.20190723 – unsafe July 25, 2019: 5.12.0.20190725 – unsafe July 30, 2019: 5.12.0.20190730 – safe August 8, 2019: 5.12.3.20190809 – safe August 14, 2019: 5.12.3.2019081…

Any speculation why they would only leave in the malicious code for about a month? Changed their mind? Done without full knowledge? Achieved some high value heist and rolled it back?

An update to an ad library is what caused the malicious code in the first place. Presumably either the infected library was updated again or the developers switched libraries.

The developers behind this app did not add any malicious code they wrote themselves. The attack either came from the ad library or the ad library was hacked.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#46

Post by jeroenhd »

flyGuyOnTheSly wrote: post #29

Can an "app with Malware" access my Google Authenticator credentials? Or read my screen while I am viewing them?

Google auth credentials: not without root (which malware might get if your device isn't up to dage ons security patches)

Read screen: not without permission, even then not on protected screens, unless the malware has gained root access

If the app doesn't get root, the Android sandbox should protect you sufficiently against attacks on the key store of Google Authenticator.

However, if you copy the code to the device clipboard, the malware might read the code from there.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#48

Post by briandear »

m463 wrote: post #32
sp332 wrote: post #7

Just to clarify the headline: the app didn't have malware when most of the users installed it. A recent update added the malware.

in regard to iOS: When tencent bought the iOS version, the "user contract" was grossly changed. Just uninstall it and use the native iOS Notes app to scan your .pdf documents.

Scanning in iOS Notes is also vastly better.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#49

Post by naruciakk »

habosa wrote: post #35

I've been using this app for years and also telling other people to use it, so this sucks. If anyone else is looking for a replacement there's a Microsoft app called "Office Lens" that seems to do a really nice job and is as safe a bet as anything.

I had been using it until a FLOSS alternative showed up (Open Note Scanner), it was very annoying in terms of ads, but I'm surprised that is has some kind of malware inside

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#50

Post by AnssiH »

Abishek_Muthian wrote: post #44

PlayProtect is not detecting and warning users about CamScanner even when it has been removed from the Playstore. I've tested it via manual scan on PlayProtect as well, no dice. Isn't that what it is supposed to do? Has anyone ever got any app flagged by PlayProtect? If it's useless, then rather I would disable it than to give it access to all my installed apps. Google Engineers here, please ping your Google Play tea…

Do you have one of the affected versions installed? The versions since July 30th are not affected (according to https://news.ycombinator.com/item?id=20826213).
Post reply on HN