Live data from Hacker News

Barcode scanner app on Google Play infects 10M users with one update

blog.malwarebytes.com

151–160 of 465 posts

Re: Barcode scanner app on Google Play infects 10M users with one update

#151

Earlier quoted context omitted.

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…

It is 2021 and Android still doesn't have a QR code scanner by default.

It's built into the camera app

Re: Barcode scanner app on Google Play infects 10M users with one update

#153

Earlier quoted context omitted.

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…

It is 2021 and Android still doesn't have a QR code scanner by default.

I don't know if it differs from various vendor releases of android but certainly on my Samsung S20, QR codes can be read without an additional app just by pointing the camera app at one. I seem to recall my Pixel XL did the same.

Re: Barcode scanner app on Google Play infects 10M users with one update

#154
post #125

QR Reader are load of everything. I went mad to find one a decent one for my parents’ android phone and apparently it doesn’t exists. So in a weekend I’ve created one without any kind of tracking, ads, permission, whatever. Here it is if you guys need one -> https://play.google.com/store/apps/details?id=com.prof18.sec...

But this is the classic cycle don't you see? They almost always start as "here is an app I threw together, no ads, don't be evil". But then a lot of people like your app, and ask for a small extra feature. You support it, and then get a bit annoyed by all the features people are asking for. Then you have to update it for the latest release... then suddenly fix it when some obscure version of Android breaks on it. The…

If the OP open sources his QR code reader app then the "free" model is absolutely sustainable.

Re: Barcode scanner app on Google Play infects 10M users with one update

#155
post #43
post #33

Earlier quoted context omitted.

He is right in a sense, and cases like this give him proof, but on the other hand, most people don't see the point in patching their software. They'd just keep it around unpatched, while connecting it to the network. Is millions of vulnerable devices better than giving vendors of some software the ability to remotely patch their software?

There's a third possibility, and I think it's Stallman's ideal computing landscape: all users care deeply about the code running on their machines and they are competent in applying and vetting patches, building from source, etc. It's unrealistic, sure, but it sounds nice right about now.

I don't think it was ever Stallman's point. He is smart enough to recognize most users aren't going to be technically competent.

He's also smart enough to recognize is that most people are going to have someone technically competent in their circle of friends, or within few minutes of walking distance. So people need a set of rights that will allow them to ask or hire someone else to care for their computing. In this sense, Free Software is like Right to Repair - it isn't about making individuals technically competent; it's about enabling local markets of specialists.

Re: Barcode scanner app on Google Play infects 10M users with one update

#156
post #76

Earlier quoted context omitted.

Maybe I'm a luddite but updates are not always necessary. It's a barcode app, what updates does it need? Is there a cve that needs to be patched? No? Then I don't need a new version

I’m usually like this. Then my bank’s app refused to launch until I updated. They re-designed it. When I went to click my usual “schedule payment” button on a bill payment, it just said “Coming Soon”. I wasn’t a happy person about it. Big Canadian bank too. US$65b mkt cap.

It’s a bank app. Keep your bank apps up to date.

Complain about updates all you want but not keeping your bank apps up to date is the wrong solution.

Re: Barcode scanner app on Google Play infects 10M users with one update

#157
post #131

I stick to F-droid android app store. it asks developer to submit their code which gets compiled by the F-Droid team. apps with proprietary codes are flagged. few QR code apps from F-Droid. https://f-droid.org/en/packages/com.example.barcodescanner/ https://f-droid.org/en/packages/com.secuso.privacyFriendlyCo...

Additionally you can have two/three separate phones, linked to separate accounts for different purposes. I keep one phone separate for phone gaming.

Re: Barcode scanner app on Google Play infects 10M users with one update

#159
Quote from Malwarebytes site: "Peter V. Jaspers-Fayer - Why does this article not contain the publisher and the icon of the app in question? There are many called "Barcode Scanner", and by omitting this information, you have caused unwarranted panic by users of innocent apps of the same name."

The fact that Google allows applications on Google Play to have identical/duplicate names is a significant ongoing problem as it causes considerable confusion.

I'm not against apps that have similar functions having identical (duplicate) filenames as this stops developers having to dream up ridiculous names that have little or no bearing to an app's function but it would make sense to separate the apps in some simple way that users could easily identify. For instance, apps with identical names could be flagged in many ways such as, say, Google providing a sequence number to the end of the filename. And I'm sure there are many other suitable ways I've not thought of.

As for the fact that Google lets malware onto Google Play and that it has happened many times demonstrates the fact that Google doesn't consider the matter of highest importance. That's to say, keeping malware off users' Android phones is not as important as making money from its advertisers.

If keeping malware off apps were equally important to Google then this is malware would have unlikely escaped Google's monitoring, as Google has just about every technical measure at its disposal to monitor apps for malware—and I'd venture to say that even its AI technology could be brought bear.

Clearly, if both issues aren't of equal importance in Google's eyes then it raises questions as to why Google keeps changing or adding certain features to its Android operating system in the name of security but which annoy users (and in effect violate their privacy—in that users' data, etc are even more transparent to Google whether the user likes it or not).

Day by day, Google is proving itself to everyone to be more of a worry.

Note: I'm one of those who have an app on my phone named 'Barcode scanner' and it took me a while to determine (fortunately) that the one I have installed is not the app in question.

Re: Barcode scanner app on Google Play infects 10M users with one update

#160
post #76

Earlier quoted context omitted.

Maybe I'm a luddite but updates are not always necessary. It's a barcode app, what updates does it need? Is there a cve that needs to be patched? No? Then I don't need a new version

I’m usually like this. Then my bank’s app refused to launch until I updated. They re-designed it. When I went to click my usual “schedule payment” button on a bill payment, it just said “Coming Soon”. I wasn’t a happy person about it. Big Canadian bank too. US$65b mkt cap.

> Big Canadian bank too. US$65b mkt cap.

Well then, let me tell you about Toronto Dominion bank (TD, market cap ~$105B)

The app allows you to photograph a cheque to deposit from the app. This option is displayed for their TD USD chequing account.

I scanned a cheque from a US bank in the app (to deposit into my USD chequing account), only to be informed that cheques from US banks cannot be deposited using the app and that I'd have to go to a branch.

The same app is missing transactions and does not correctly display the current balance of some accounts (which are correctly shown in EasyWeb) The app has also blocked screenshots, so I was unable to provide their customer support with proof of the missing transactions.

Call me entitled, but I would expect all transactions and current account balances visible in the web interface to be accurately reflected in the bank's official app.

If you have ever experienced N26, Revolut, or any number of European "FinTech" banks, you will understand that Canadian banks are busy banging rocks together while telling you they're hot shit.

Post reply on HN