Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CamScanner, a malicious Android app with more than 100M downloads in Google Play

kaspersky.com

Post reply on HN
Print view View original

141–150 of 155 posts

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#141

Post by scarface74 »

lern_too_spel wrote: post #140
scarface74 wrote: post #138

Earlier quoted context omitted.

Also irrelevant. Most people don't use phones that old. There is a vibrant official second hand market for iPhones where people sell their phones and the hand me down market. It really helps when you can still use an older device with the newest operating system. Anecdotally, my son is still using my circa 2015 iPhone 6s with the latest OS. According to many benchmarks, it was faster than high end Android phones up u…

> There is a vibrant official second hand market for iPhones where people sell their phones and the hand me down market. Irrelevant. I'm not buying from the second hand market. If you want to push that benefit, push it on somebody who will. > We know that your conjecture is probably false. We know I'm right. It takes weeks for iOS users to update their phones if iMessage or Safari has an update. On Android, the SMS a…

Irrelevant. I'm not buying from the second hand market. If you want to push that benefit, push it on somebody who will.

It might come as a surprise, but the world doesn’t revolve around you and this is a general discussion forum...

We know I'm right. It takes weeks for iOS users to update their phones if iMessage or Safari has an update.

Do you have statistics?

For users who upgrade devices frequently like me, these Android devices are strictly better than iOS devices in security.

Well, since I couldn’t find any statistics about HN users named “lern_too_spel”, I had to rely on information I could find on the internet....

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#142

Post by lern_too_spel »

scarface74 wrote: post #141
lern_too_spel wrote: post #140

Earlier quoted context omitted.

> There is a vibrant official second hand market for iPhones where people sell their phones and the hand me down market. Irrelevant. I'm not buying from the second hand market. If you want to push that benefit, push it on somebody who will. > We know that your conjecture is probably false. We know I'm right. It takes weeks for iOS users to update their phones if iMessage or Safari has an update. On Android, the SMS a…

Irrelevant. I'm not buying from the second hand market. If you want to push that benefit, push it on somebody who will. It might come as a surprise, but the world doesn’t revolve around you and this is a general discussion forum... We know I'm right. It takes weeks for iOS users to update their phones if iMessage or Safari has an update. Do you have statistics? For users who upgrade devices frequently like me, these…

> I had to rely on information I could find on the internet....

Which is? I pointed out why it is that these new Android devices are better from a security update perspective than iOS devices. Your response is to point to non-existent statistics. No amount of wishful thinking is going to make statistics appear that violate common sense.

> It might come as a surprise, but the world doesn’t revolve around you and this is a general discussion forum...

Users who don't upgrade phones frequently have no good options. Users who upgrade frequently have Android devices that fit the bill. I don't consider iOS's security updates reasonable, as I have already explained.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#143

Post by scarface74 »

lern_too_spel wrote: post #142
scarface74 wrote: post #141

Earlier quoted context omitted.

Irrelevant. I'm not buying from the second hand market. If you want to push that benefit, push it on somebody who will. It might come as a surprise, but the world doesn’t revolve around you and this is a general discussion forum... We know I'm right. It takes weeks for iOS users to update their phones if iMessage or Safari has an update. Do you have statistics? For users who upgrade devices frequently like me, these…

> I had to rely on information I could find on the internet.... Which is? I pointed out why it is that these new Android devices are better from a security update perspective than iOS devices. Your response is to point to non-existent statistics. No amount of wishful thinking is going to make statistics appear that violate common sense. > It might come as a surprise, but the world doesn’t revolve around you and this…

Your response is to point to non-existent statistics. No amount of wishful thinking is going to make statistics appear that violate common sense.

Well...

10%

https://www.theverge.com/2019/5/7/18535811/google-android-9-...

Vs

88%

https://www.digitaltrends.com/mobile/ios-distribution-news/

But I guess we should be satisfied because...

Irrelevant. I'm not buying from the second hand market. If you want to push that benefit, push it on somebody who will.

Because you upgrade frequently

Users who don't upgrade phones frequently have no good options. Users who upgrade frequently have Android devices that fit the bill. I don't consider iOS's security updates reasonable, as I have already explained.

Well your “explanation” that iOS security is not acceptable because you have to reboot. Compared to not getting a full update at all is laughable.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#144

Post by btrettel »

tabjsina wrote: post #21
jimrandomh wrote: post #11

Does anyone have information on affected and unaffected version numbers? I have a version of this installed, but it's an old one, and may not have updated to the malware one because I disabled automatic updates. (Specifically because I was afraid of this, in fact.)

May 22, 2019: 5.10.6.20190522 – safe June 6, 2019: 5.11.0.20190611 – safe June 14, 2019: 5.11.3.20190614 – safe June 16, 2019: 5.11.3.20190616 – unsafe June 24, 2019: 5.11.5.20190624 – unsafe July 10, 2019: 5.11.7.20190710 – unsafe July 23, 2019: 5.12.0.20190723 – unsafe July 25, 2019: 5.12.0.20190725 – unsafe July 30, 2019: 5.12.0.20190730 – safe August 8, 2019: 5.12.3.20190809 – safe August 14, 2019: 5.12.3.2019081…

I don't think that list is accurate. I installed CamScanner on Aug. 23, got a text about apparently being signed up for a $5/month service called GameZone at about 4:30 am on Aug. 24, and factory reset my phone the afternoon of Aug. 24 after an investigation. CamScanner was the only app I installed recently, and I saw other discussion connecting GameZone to the app. I'd say CamScanner was responsible with about 90% confidence.

In addition to factory resetting my phone, I've changed account passwords for all accounts I used on my phone, rotated every entry in my TOTP app, and logged out of all other active sessions on quite a few different services.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#145

Post by btrettel »

flyGuyOnTheSly wrote: post #29

Can an "app with Malware" access my Google Authenticator credentials? Or read my screen while I am viewing them?

I believe my phone was compromised via CamScanner, and I factory reset my phone, changed the passwords to every account I used on my phone, and rotated every entry in my TOTP app. Not sure if any of that was necessary, but better safe than sorry as far as I'm concerned.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#147

Post by lern_too_spel »

scarface74 wrote: post #143
lern_too_spel wrote: post #142

Earlier quoted context omitted.

> I had to rely on information I could find on the internet.... Which is? I pointed out why it is that these new Android devices are better from a security update perspective than iOS devices. Your response is to point to non-existent statistics. No amount of wishful thinking is going to make statistics appear that violate common sense. > It might come as a surprise, but the world doesn’t revolve around you and this…

Your response is to point to non-existent statistics. No amount of wishful thinking is going to make statistics appear that violate common sense. Well... 10% https://www.theverge.com/2019/5/7/18535811/google-android-9-... Vs 88% https://www.digitaltrends.com/mobile/ios-distribution-news/ But I guess we should be satisfied because... Irrelevant. I'm not buying from the second hand market. If you want to push that bene…

> 10%

I already pointed out why lumping all Android devices together is nonsensical in my very first comment. The rest of your points crumble after you remove this nonsensical foundation.

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#148

Post by scarface74 »

lern_too_spel wrote: post #147
scarface74 wrote: post #143

Earlier quoted context omitted.

Your response is to point to non-existent statistics. No amount of wishful thinking is going to make statistics appear that violate common sense. Well... 10% https://www.theverge.com/2019/5/7/18535811/google-android-9-... Vs 88% https://www.digitaltrends.com/mobile/ios-distribution-news/ But I guess we should be satisfied because... Irrelevant. I'm not buying from the second hand market. If you want to push that bene…

> 10% I already pointed out why lumping all Android devices together is nonsensical in my very first comment. The rest of your points crumble after you remove this nonsensical foundation.

Right because every part of the OS consist of the apps. First you said that there weren’t any statistics and now that I post statistics from Google they are “nonsensical”.

Do you have any more reliable numbers or just more conjecture?

Because in your world, it is more secure to not be able to update the entire OS than to have to do a reboot.....

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#149

Post by Marsymars »

Abishek_Muthian wrote: post #139
Marsymars wrote: post #112

Earlier quoted context omitted.

> Has anyone ever got any app flagged by PlayProtect? Yes, it started flagging all the apps my company distributes internally for testing purposes. Getting it to stop seemed impractical, so my company's guidance is now to disable Play Protect on any test device.

Is it certificate issue? Or a phonegap build like another user has said.

Not PhoneGap. Been a while since I investigated it and don't have more time to waste on it. shrug

Re: CamScanner, a malicious Android app with more than 100M downloads in Google Play

#150

Post by lern_too_spel »

scarface74 wrote: post #148
lern_too_spel wrote: post #147

Earlier quoted context omitted.

> 10% I already pointed out why lumping all Android devices together is nonsensical in my very first comment. The rest of your points crumble after you remove this nonsensical foundation.

Right because every part of the OS consist of the apps. First you said that there weren’t any statistics and now that I post statistics from Google they are “nonsensical”. Do you have any more reliable numbers or just more conjecture? Because in your world, it is more secure to not be able to update the entire OS than to have to do a reboot.....

> now that I post statistics from Google they are “nonsensical”.

Your statistics are for a nonsensical metric as I have repeatedly pointed out. The correct statistic is how quickly Android devices that are known to get updates get updates because those are the only devices that anybody who cares about security updates should buy.

> Because in your world, it is more secure to not be able to update the entire OS than to have to do a reboot.....

Once again, you are completely ignoring the point. It is more secure to have a device that updates the base system quickly and updates the apps instantly without the user noticing. There are devices that do that, and there are devices that don't. The devices that don't are so inferior to the devices that do that they shouldn't be used.

Do I need to draw a Venn diagram for you, or do you finally understand?

Post reply on HN