Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Barcode scanner app on Google Play infects 10M users with one update

blog.malwarebytes.com

Post reply on HN
Print view View original

31–40 of 465 posts

Re: Barcode scanner app on Google Play infects 10M users with one update

#31

Post by m463 »

IgorBog61650384 wrote: post #13

The only reason this was detected was very overt behavior - opening AD popups. So I guesstimate for each one of these we have 10 that go undetected. This means the whole ecosystem is broken, as there is no reason this will happen only for updates and not for new apps as well. Apple's ecosystem is somewhat better, but I can't imagine they go through every line of code in each package, so most of their review is probab…

This happened on ios for me years ago.

I had two apps that radically changed their business model (owner?) through updates with no recourse.

I had an app called gas cubby, which let me locally - on the phone - keep track of all my vehicles. I could enter detailed information about each car such as year, make, model, vin, insurance policy, gas purchases, oil changes and the like. It would tell you gas mileage and remind you of upcoming maintenance. One day, I updated the app and all my local data was uploaded to the cloud.

Another app I updated was camscanner from tencent that basically did the same thing. Think of all the PDFs you scan going to their cloud.

Re: Barcode scanner app on Google Play infects 10M users with one update

#32

Post by renewiltord »

est31 wrote: post #15

I don't get why no barcode scanner app is shipped with Android. It's such a basic functionality. Edit: apparently it IS shipped on iOS and at least my Lineage OS default camera app has a QR code reader too.

Switch to Google Lens in the Camera app. It's way less reliable but it usually gets the job done.

Re: Barcode scanner app on Google Play infects 10M users with one update

#33

Post by est31 »

em3rgent0rdr wrote: post #9

Stallman calls autoupdates a "universal backdoor".

He is right in a sense, and cases like this give him proof, but on the other hand, most people don't see the point in patching their software. They'd just keep it around unpatched, while connecting it to the network. Is millions of vulnerable devices better than giving vendors of some software the ability to remotely patch their software?

Re: Barcode scanner app on Google Play infects 10M users with one update

#34

Post by m463 »

LordOfWolves wrote: post #8

Apple’s (often critical) review process for app updates is shining right now! Edit: /s

Apple does not let you back out an update you made and regret.

Apple does not block apps from using the network or give you any way to find out what they are doing and who they are talking to.

In fact, apple does the opposite - it blocks apps that let you firewall your phone.

Re: Barcode scanner app on Google Play infects 10M users with one update

#35

Post by admax88q »

bigiain wrote: post #27
lvs wrote: post #6

The OG Barcode Scanner app is getting absolutely throttled with negative reviews. But this posting seems to be about a clone app by a different developer. https://en.wikipedia.org/wiki/Barcode_Scanner_(application) https://play.google.com/store/apps/details?id=com.google.zxi...

I wonder if there's a coordinated effort to exploit barcode reader apps, because (at least where I'm from) its becoming a government mandated Covid tracing thing to use a QR code to "check in" to certain classes of businesses/venues? I bet there's a _huge_ increase in use of QR code scanning apps compared to this the last year...

Its kind of amazing that there isnt an official qr code scanner app preinstalled on phones given how ubiquitous QR codes are.

Re: Barcode scanner app on Google Play infects 10M users with one update

#36

Post by ntSean »

When the Apple App Store contained malware compiled by unsuspected Chinese developers using a local cache of Xcode [1], Apple emailed the developers to prompt them to update their application immediately and removed them from sale.

Apple also contacted users directly to alert them of whatever apps they had purchased on the App Store were compromised so they could monitor for updates, or remove the app entirely.

Has Google done the same? Neither Apple or Google have the ability to directly remove apps on a users device, but simply removing it from the store and then having users rely on a solution like MalwareBytes seems like Google is abnegating their responsibility of a safe marketplace.

[1] https://en.wikipedia.org/wiki/XcodeGhost

Re: Barcode scanner app on Google Play infects 10M users with one update

#37

Post by wiml »

est31 wrote: post #15

I don't get why no barcode scanner app is shipped with Android. It's such a basic functionality. Edit: apparently it IS shipped on iOS and at least my Lineage OS default camera app has a QR code reader too.

My boring AndroidOne phone does. If there's a clear QR code in the field of view of the camera app it'll recognize it.

Re: Barcode scanner app on Google Play infects 10M users with one update

#38

Post by ntSean »

m463 wrote: post #34
LordOfWolves wrote: post #8

Apple’s (often critical) review process for app updates is shining right now! Edit: /s

Apple does not let you back out an update you made and regret. Apple does not block apps from using the network or give you any way to find out what they are doing and who they are talking to. In fact, apple does the opposite - it blocks apps that let you firewall your phone.

Applications like Charles [1] allow you monitor network connections and data closely. Apple do not actively prevent this.

You can also setup a VPN to route traffic and strictly firewall.

[1] https://www.charlesproxy.com

Re: Barcode scanner app on Google Play infects 10M users with one update

#39

Post by shadowofneptune »

other_herbert wrote: post #20
the_only_law wrote: post #17

Earlier quoted context omitted.

I don’t think my past two phones (one Android, one iOS) have built in QR scanning, or at least it’s not very discoverable. No fun to have to find something in an App Store when it all looks like 7 year old malware.

Try your plain camera... this seems like such a hidden anti-feature though... no one I know has tried just the camera

I discovered this week when fooling around with QR code makers that the Android camera app, at least the one released on Samsung phones, does not read QR codes. That was very surprising to me.

Re: Barcode scanner app on Google Play infects 10M users with one update

#40

Post by bigiain »

bigiain wrote: post #27
lvs wrote: post #6

The OG Barcode Scanner app is getting absolutely throttled with negative reviews. But this posting seems to be about a clone app by a different developer. https://en.wikipedia.org/wiki/Barcode_Scanner_(application) https://play.google.com/store/apps/details?id=com.google.zxi...

I wonder if there's a coordinated effort to exploit barcode reader apps, because (at least where I'm from) its becoming a government mandated Covid tracing thing to use a QR code to "check in" to certain classes of businesses/venues? I bet there's a _huge_ increase in use of QR code scanning apps compared to this the last year...

Interestingly, I just checked the QR code scanner app I have on one of my Android devices (A Samsung S6Edge abandoned and unupdateable from Android7 - without jumping through some hoops I've not been inclined to do yet).

As soon as I opened it, it popped up a dialog box with non ascii text in it (Arabic or maybe Thai script?) with yes/no options, for all I know asking fro permission to steal my contact list... I just closed the app and uninstalled it.

It was "QR code scanner free" by Application4u. It does disclose "Contains ads". 4.5 stars, 10million+ downloads. Has some expected permissions (camera) and a few less expected ones (storage/sd card) and a few very suspicious ones (full network access, prevent phone from sleeping, connect and disconnect from wifi, view wifi connections - I guess maybe these are needed for the ad serving in the free version? Seems like over reach to me...)

Post reply on HN