Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CamScanner, a malicious Android app with more than 100M downloads in Google Play

kaspersky.com

Post reply on HN
Print view View original

61–70 of 155 posts

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#61

Post by vardump »

lern_too_spel wrote: post #18
JustSomeNobody wrote: post #15

Earlier quoted context omitted.

Because 80+% of users are on the latest os version and the inverse is true of Android.

This doesn't use an exploit in Android and instead runs payloads with the permissions of the app. The same can happen on iOS and very likely does in many apps but is reported less often because there is no economic incentive (the App Store doesn't allow antivirus services). For an example, see how Xcodeghost went unnoticed by Apple.

So can you somehow load external (from a file or network, etc.) executable code into memory on iOS now? Last I checked, that was not possible, no way to even map executable pages in memory.

XcodeGhost was a compromised compiler suite. See https://en.wikipedia.org/wiki/XcodeGhost#Attack_vector

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#62

Post by 0xfaded »

habosa wrote: post #35

I've been using this app for years and also telling other people to use it, so this sucks. If anyone else is looking for a replacement there's a Microsoft app called "Office Lens" that seems to do a really nice job and is as safe a bet as anything.

I was about to write something cocky like "I thought facebook had more installs than that" since the title didn't name the malware app.

But damn, I'm (sort of) affected. I've had the paid version of CamScanner for years before the alternative existed. Apparently the paid version isn't affected, but it's still gone from my phone.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#63

Post by Daniel_sk »

m463 wrote: post #32
sp332 wrote: post #7

Just to clarify the headline: the app didn't have malware when most of the users installed it. A recent update added the malware.

in regard to iOS: When tencent bought the iOS version, the "user contract" was grossly changed. Just uninstall it and use the native iOS Notes app to scan your .pdf documents.

Wow, I never knew you can use the Notes app to scan documents.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#64

Post by wolfd »

abrookewood wrote: post #30
oh_sigh wrote: post #20

Earlier quoted context omitted.

I got hit by this exact one(free iphone X) recently, and couldn't find anything in my email. Surely, that kind of email would just look like spam, so isn't the correct solution for google to just not auto-add calendar events if their source email is spam?

Yep, my wife got exactly the same thing. Apparently those entries will appear in your calendar even if the email was sent to spam. You have to configure gmail to not automatically add the entries.

This seems like a pretty big oversight on Gmail's part.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#65

Post by fauigerzigerk »

habosa wrote: post #35

I've been using this app for years and also telling other people to use it, so this sucks. If anyone else is looking for a replacement there's a Microsoft app called "Office Lens" that seems to do a really nice job and is as safe a bet as anything.

I use Genius Scan on my iPhone to scan documents that I need to archive (I think it's also available for Android).

In addition to automatic cropping it fixes any distortions so the documents look as if they had been scanned with a flatbed scanner. It works really well for my purpose.

(I have no affiliation with them, just love the app)

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#66

Post by panpanna »

> CamScanner was actually a legitimate app, with no malicious intensions whatsoever, for quite some time. It used ads for monetization and even allowed in-app purchases. However, at some point, that changed, and recent versions of the app shipped with an advertising library containing a malicious module.

IMO, this is more a legal matter than a technical one.

Google needs to sue this company, not engage in a whack-a-mole game with their AI algorithm and useless scanner.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#67

Post by panpanna »

a254613e wrote: post #43

So what exactly did this malware do most of the time? In the original kaspersky report it says "For example, an app with this malicious code may show intrusive ads and sign users up for paid subscriptions.". So how/did it sign up users for paid subscriptions without user interaction? Does android allow something like that? Aren't all apps sandboxed? In general how is the android sandboxing and permission system nowad…

I don't know this particular case, but "malware" seems to be used to describe "adware" these days by some blogs to generate more clicks.

Android is just as secure/unsecure as iOS. Some recent "malware" campaigns targeted both platforms but in general Apple silently removes them while Android gets scrutinized to death.

Edit: to answer your questions, these apps still operate within the limits of the sandbox. Which is maybe a reason the term "malware" should not be used.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#68

Post by panpanna »

doggydogs94 wrote: post #42

Maybe Google should pay more attention to their own ecosystem and less focus on embarrassing other vendors.

I too wish they should stop using their resources to find security problems Apple should have found themselves.

But I very much disagree this is about embarrassing Apple. In fact, Google is doing them a huge favor.

(The iMessage bug for example could have been turned into a worm and infected ALL iPhones on the planet in matter of minutes if it was found by blackhat hackers instead. Apple should be thankful)

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#69

Post by saiya-jin »

baroffoos wrote: post #26
sp332 wrote: post #7

Just to clarify the headline: the app didn't have malware when most of the users installed it. A recent update added the malware.

This seems like such a common occurrence, not only with android apps but anything with auto updates. It seems like the only solution right now is to purely limit yourself to apps from f-droid. Not necessarily because open source is resistant to this, but because no spammer would bother attacking such a small group.

a non-perfect solution of mine - update only android apps that actually make sense, or author is Google. There is no reason my simple calculator app should get an update every few weeks (since nothing visibly changed in it for last X years), or linkedin having almost weekly updates.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#70

Post by panpanna »

vardump wrote: post #61
lern_too_spel wrote: post #18

Earlier quoted context omitted.

This doesn't use an exploit in Android and instead runs payloads with the permissions of the app. The same can happen on iOS and very likely does in many apps but is reported less often because there is no economic incentive (the App Store doesn't allow antivirus services). For an example, see how Xcodeghost went unnoticed by Apple.

So can you somehow load external (from a file or network, etc.) executable code into memory on iOS now? Last I checked, that was not possible, no way to even map executable pages in memory. XcodeGhost was a compromised compiler suite. See https://en.wikipedia.org/wiki/XcodeGhost#Attack_vector

The code does not need to be native, JavaScript works just fine (which is exactly what was used in the click-fraud thingy from a few months ago)
Post reply on HN