Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Barcode scanner app on Google Play infects 10M users with one update

blog.malwarebytes.com

Post reply on HN
Print view View original

171–180 of 465 posts

Re: Barcode scanner app on Google Play infects 10M users with one update

#171

Post by nobodywasishere »

protoman3000 wrote: post #95

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…

This is why I get all of these kinds of apps from F-Droid instead of the Play Store. Here's the QR code scanner I use: https://f-droid.org/en/packages/de.t_dankworth.secscanqr/

Re: Barcode scanner app on Google Play infects 10M users with one update

#172

Post by pcthrowaway »

protoman3000 wrote: post #95

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…

I'm terrified of browser extensions for this very same reason (and yes, I still use them). I wish the browser vendors supported some kind of pinning to source code for open source extensions. Right now I have at least 2 extensions running that I know could access my passwords on any website as I enter them. One of those is Lastpass, which I use for storing/generating those passwords anyway, and the other is AdBlock Plus. Could other extensions access sensitive information? I'm not sure, but I hate not being able to see the source code of apps which need so many permissions.

Re: Barcode scanner app on Google Play infects 10M users with one update

#173

Post by laurent92 »

lucioperca wrote: post #97

I stopped using apps from companies or projects I don't know some time ago. Which left basically small local companies, the big global ones and FOSS-projects. This of course is not perfect but at least leaves some sort of accountability.

All my employees use a JSON formatter on Chrome. Such apps require permissions to view all sites...

I require them to create 2 profiles in Chrome (and a 3rd for personal purposes), one for dev and one for official purposes, but I know that, in remote work, they get less serious.

It’s a major security problem. I’m wondering whether I should purchase the Chrome extension’s source code and deploy it myself on the store.

Re: Barcode scanner app on Google Play infects 10M users with one update

#174

Post by karmahunting »

chordalkeyboard wrote: post #51
m463 wrote: post #31

Earlier quoted context omitted.

This happened on ios for me years ago. I had two apps that radically changed their business model (owner?) through updates with no recourse. I had an app called gas cubby, which let me locally - on the phone - keep track of all my vehicles. I could enter detailed information about each car such as year, make, model, vin, insurance policy, gas purchases, oil changes and the like. It would tell you gas mileage and remi…

School tried to make me use camscanner, glad I took the extra effort to do something else. Thanks for the anecdote.

Try OpenScan, open source document scanner app...

Source: I am a user

Re: Barcode scanner app on Google Play infects 10M users with one update

#175

Post by teekert »

bjarneh wrote: post #143
protoman3000 wrote: post #95

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…

Yeah, it's always in the flashlights, the barcode scanners, the background packs. They all address super basic functionality that many, many people seem to want (if I could just set a ringtone from YouTube, it'd save me from going through a bunch of shady apps, if I ever needed a ringtone that is). Yet they just aren't included in the base OS (or weren't always, my lineage OS has a flashlight currently). Therefore, they offer very low hanging fruit(super simple app, one can hardly ask money for it, so how does one make money?)

I heard from a friend that iOS has TOTP and indeed a barcode scanner build in, same goes for cal/carddav. To be fair, my wife's Pocophone also comes up with a QR-code icon when the cam detects a QR code. And, FireFox for mobile has a QC code scanner build in (although since I now have to open a new tab for each new page and I end up with many many tabs of the same 4 websites I find myself using FF less and less).

Maybe the experience on Pixel Phones is better? GCam makes a lot of difference in many aspects.

Re: Barcode scanner app on Google Play infects 10M users with one update

#177

Post by manderley »

bjarneh wrote: post #143
protoman3000 wrote: post #95

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…

My Moto G8 Power (G Power in the US) Android phone has it as part of the Camera app; when you point the camera at a code, a small bubble will pop up at the bottom allowing you to follow the link/see the content.

Re: Barcode scanner app on Google Play infects 10M users with one update

#178

Post by svara »

I was affected by this. Funny how Malwarebytes wants to turn this into positive PR about how they reacted "quickly".

I installed just about every Android anti-malware app that I could find in late January, and none detected the bad app.

Finally by googling some of the ad domains that kept popping up, I found the forum discussion that they mention. In other words it took them about two months to react!

Edit: either it took forever or there are multiple barcode scanner apps that are affected and they didn't find all of them.

Re: Barcode scanner app on Google Play infects 10M users with one update

#179

Post by mtrycz2 »

HenryBemis wrote: post #107
protoman3000 wrote: post #95

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…

> Imagine an authenticator app I will imagine that anyone who creates an authenticator is half-decent enough to NOT take that bribe and serve the greater good. I will also imagine that when people install authenticators, they would NOT trust one from HenryBemis but only from sources that they recognize (Google, Microsoft, Yubikey, etc.) It always amazes me how come all smartphone OS creators switch every connectivity…

> It would take a use another 3-4 seconds per app installation to prompt the user

I yes, I too rememeber the FirefoxOS. Good times.

Re: Barcode scanner app on Google Play infects 10M users with one update

#180

Post by perryizgr8 »

captn3m0 wrote: post #150
bjarneh wrote: post #143

Earlier quoted context omitted.

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…

It is 2021 and Android still doesn't have a QR code scanner by default.

Samsung phones have it in the camera, so I guess most Android users do have a barcode scanner built-in.
Post reply on HN