Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CamScanner, a malicious Android app with more than 100M downloads in Google Play

kaspersky.com

Post reply on HN
Print view View original

51–60 of 155 posts

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#51

Post by GordonS »

dantheman wrote: post #6
GordonS wrote: post #2

For the past few days I've been seen spam events in my calendar about "free iPhones" and "webcam girls" - I couldn't figure out where they were coming from. I have CamScanner installed, so presumably that's the source... Now, I can remove CamScanner (which is a shame, it's a really good app), but how can I ensure the trojan is also removed? I tried the Avast AntiVirus app, but it didn't find anything. What does every…

The calendar thing is probably this: https://lifehacker.com/how-to-prevent-spammers-from-infiltra... check your emails

No, it wasn't that - I had the auto invite setting turned off already, and I didn't have any emails that matched the calendar entries.

I was fairly sure it must be malware, but I had no idea how to find out which app it was. I tried Avast AntiVirus, but it found nothing. After finding out about CamScanner I tried Kapersky AV, which did flag CamScanner as malware.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#53

Post by McGlockenshire »

mkolodny wrote: post #52
Deimorz wrote: post #13

Blogspam of https://www.kaspersky.com/blog/camscanner-malicious-android-... (Forbes contributor posts are almost always blogspam)

What's blogspam?

Blogspam happens when someone writes a blog article that sources or references something from a more authoritative source, such as this one linking to the Kaspersky story, without adding anything of significance to the original.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#54

Post by Kovah »

habosa wrote: post #35

I've been using this app for years and also telling other people to use it, so this sucks. If anyone else is looking for a replacement there's a Microsoft app called "Office Lens" that seems to do a really nice job and is as safe a bet as anything.

Scanbot is another working alternative.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#55

Post by dblohm7 »

AnssiH wrote: post #50
Abishek_Muthian wrote: post #44

PlayProtect is not detecting and warning users about CamScanner even when it has been removed from the Playstore. I've tested it via manual scan on PlayProtect as well, no dice. Isn't that what it is supposed to do? Has anyone ever got any app flagged by PlayProtect? If it's useless, then rather I would disable it than to give it access to all my installed apps. Google Engineers here, please ping your Google Play tea…

Do you have one of the affected versions installed? The versions since July 30th are not affected (according to https://news.ycombinator.com/item?id=20826213 ).

I did, and no, PlayProtect did nothing.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#56

Post by hathawsh »

AnssiH wrote: post #50
Abishek_Muthian wrote: post #44

PlayProtect is not detecting and warning users about CamScanner even when it has been removed from the Playstore. I've tested it via manual scan on PlayProtect as well, no dice. Isn't that what it is supposed to do? Has anyone ever got any app flagged by PlayProtect? If it's useless, then rather I would disable it than to give it access to all my installed apps. Google Engineers here, please ping your Google Play tea…

Do you have one of the affected versions installed? The versions since July 30th are not affected (according to https://news.ycombinator.com/item?id=20826213 ).

I have auto-update turned on, yet I just discovered CamScanner was apparently stuck on an unsafe version from July. Now CamScanner seems to be removed from the play store, yet I had to remove the app manually. Play Protect still thought everything was fine. I have a Google Pixel running stock firmware. I guess it's time for a factory reset.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#57

Post by mtgx »

Abishek_Muthian wrote: post #44

PlayProtect is not detecting and warning users about CamScanner even when it has been removed from the Playstore. I've tested it via manual scan on PlayProtect as well, no dice. Isn't that what it is supposed to do? Has anyone ever got any app flagged by PlayProtect? If it's useless, then rather I would disable it than to give it access to all my installed apps. Google Engineers here, please ping your Google Play tea…

Every few months, Google's Android team writes a new blog post patting themselves on the back about how good Android security is thanks to Play Protect and that you almost don't need security patches because Play Protect is that good.

And every time I call bullshit on that, but sadly it happens on Android fan forums, so few take it seriously, and instead prefer to cheer on for Google.

Play Protect is nothing but an antivirus, and as such it's as good/useless as all the other antiviruses. In other words, it won't catch the vast majority of new malware (because obviously malware creators would first test their malware against Play Protect before launching it into the wild, and release it only if it bypasses the antivirus). It's only really good (if that) at preventing other users from getting infected with malware it already knows about.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#58

Post by hathawsh »

buildzr wrote: post #34

> So a dropper might be used to install malware that steals banking credentials or generates fake advertising clicks or signs up for fake subscriptions. This is basically wrong, you can't modify a browser or charge someone's card without breaking out of the sandbox. Worst case they could burn your cellular data or encrypt your photos and such if you gave it permission. Is there any evidence they maliciously used this…

The exploit downloaded and executed code from some server, so there may have been targeted payloads that rooted specific devices. I hope I'm wrong, but that's the impression I get from the Kaspersky post:

https://securelist.com/dropper-in-google-play/92496/

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#59

Post by aflag »

sp332 wrote: post #16
blisterpeanuts wrote: post #8

Rather than disappear it from the Store entirely, it would be nice if Google could leave a placeholder with a warning; at least it would serve an educational purpose. Also, does the Play Store app have a way to notify users of a banned app that is still installed? I decided to check my wife's phone proactively, but I don't think she would otherwise have had a clue of malware (but has been getting weird and annoying p…

Or in this case, rolled back to a previous non-infected version.

The new versions are also unaffected. It only had malware for a period of time while the developers were using a 3rd pat library with the malware.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#60

Post by Abishek_Muthian »

AnssiH wrote: post #50
Abishek_Muthian wrote: post #44

PlayProtect is not detecting and warning users about CamScanner even when it has been removed from the Playstore. I've tested it via manual scan on PlayProtect as well, no dice. Isn't that what it is supposed to do? Has anyone ever got any app flagged by PlayProtect? If it's useless, then rather I would disable it than to give it access to all my installed apps. Google Engineers here, please ping your Google Play tea…

Do you have one of the affected versions installed? The versions since July 30th are not affected (according to https://news.ycombinator.com/item?id=20826213 ).

I had paid version installed with auto update and I didn't receive any warning via PlayProtect.

Kaspersky blog mentioned that the malware was part of the advertising module; so I assumed it gets activated only on the free version, so I manually scanned using PlayProtect in a mobile with free CamScanner installed.

Since both of the instances I've mentioned has auto update, it's likely they were >July 30. But Kaspersky did mention that the latest version was indeed affected.

Post reply on HN