Barcode scanner app on Google Play infects 10M users with one update • Hacker News Board

Re: Barcode scanner app on Google Play infects 10M users with one update

#211

Post by mpol » Mon, Feb 08, 2021, 10:32 AM UTC

greatgib wrote: post #122

One can say that the solution to this is more control/power for the app store, but te opposite, the solution for this problem on computer was solved decades ago: Open source software and more open and transparent platforms! Today users of common brands of Android and Apple devices are really restricted in control of their devices, so there is very few ways to check what the system or apps are doing, inspect, firewall…

Agreed. The only way reviews can be done is by stores doing the review based on source code, and have submitting source code be mandatory with automated builds before review. That is not something companies like Apple or Google would even care about, it is not in their interest, since it is not their problem.

The phone market is a duopoly, Google and Apple have the market shared between them. There is no need to really improve this situation for end-users. For me it feels like Windows XP all over again.

I am a happy user of a Linux phone. I very much enjoy and support Jolla and Sailfish OS, while also hoping for the Pinephone and the Librem 5 to take off and be available as an option for daily use.

Re: Barcode scanner app on Google Play infects 10M users with one update

#212

Post by varispeed » Mon, Feb 08, 2021, 10:32 AM UTC

protoman3000 wrote: post #95

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…

> Apps that offer what should have been offered by the OS vendor in the first place.

Wouldn't that be anti-competitive? Similar situation when Microsoft was including IE on their system that made them a quasi monopolist with subpar product. I'd rather have Google having stricter rules when it comes to malware.

Re: Barcode scanner app on Google Play infects 10M users with one update

#213

Post by varispeed » Mon, Feb 08, 2021, 10:33 AM UTC

martyvis wrote: post #165

captn3m0 wrote: post #150

Earlier quoted context omitted.

It is 2021 and Android still doesn't have a QR code scanner by default.

Actually they do if they have Google Assistant, which I imagine anyone with Android 7 or later will. If you use the Google Lens feature it will decode barcodes and QR codes. But unfortunately this feature is pretty much self-discovery rather than a publicised function

Not everyone wants to use more spying software.

Re: Barcode scanner app on Google Play infects 10M users with one update

#214

Post by mafuy » Mon, Feb 08, 2021, 10:35 AM UTC

pcthrowaway wrote: post #172

protoman3000 wrote: post #95

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…

I'm terrified of browser extensions for this very same reason (and yes, I still use them). I wish the browser vendors supported some kind of pinning to source code for open source extensions. Right now I have at least 2 extensions running that I know could access my passwords on any website as I enter them. One of those is Lastpass, which I use for storing/generating those passwords anyway, and the other is AdBlock P…

Re AdblockPlus, I can recommend Ublock Origin instead. The UBO developer (Raymond Hill) repeatedly chose ethical behavior over money.

Re: Barcode scanner app on Google Play infects 10M users with one update

#215

Post by bjarneh » Mon, Feb 08, 2021, 10:35 AM UTC

teekert wrote: post #175

bjarneh wrote: post #143

Earlier quoted context omitted.

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…

Yeah, it's always in the flashlights, the barcode scanners, the background packs. They all address super basic functionality that many, many people seem to want (if I could just set a ringtone from YouTube, it'd save me from going through a bunch of shady apps, if I ever needed a ringtone that is). Yet they just aren't included in the base OS (or weren't always, my lineage OS has a flashlight currently). Therefore, t…

> Yeah, it's always in the flashlights, the barcode scanners, the background packs.

Why are Google afraid to release a free non-harmful version of those popular apps. Is it to keep the illusion the app-store is a vibrant market place where tons of developers get rich? It just seems nuts to allow all those harmful apps (that does virtually nothing) to float among the top downloads.

Re: Barcode scanner app on Google Play infects 10M users with one update

#216

Post by protoman3000 » Mon, Feb 08, 2021, 10:35 AM UTC

varispeed wrote: post #212

protoman3000 wrote: post #95

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…

> Apps that offer what should have been offered by the OS vendor in the first place. Wouldn't that be anti-competitive? Similar situation when Microsoft was including IE on their system that made them a quasi monopolist with subpar product. I'd rather have Google having stricter rules when it comes to malware.

You’re right. How dare Microsoft abuses their monopoly and ships Windows with a clock in the taskbar!

And why stop here? We should open the market for TCP implementations. The status quo is anti-competitive and stifles innovation!

Re: Barcode scanner app on Google Play infects 10M users with one update

#217

Post by secondcoming » Mon, Feb 08, 2021, 10:41 AM UTC

Does any know what SDK they were using? I work in adtech and would like to review traffic from this SDK and potentially block it.

Edit: Seems they're using MoPub and AdMob

Re: Barcode scanner app on Google Play infects 10M users with one update

#218

Post by squealish » Mon, Feb 08, 2021, 10:42 AM UTC

monksy wrote: post #23

I found this behavior in the Barcode Scanner app by "the space team" That was not one that was mentioned by the article It's url: https://play.google.com/store/apps/details?id=com.qrcodescan... (See the reviews)

Glad you brought this one up. I also had the app you mentioned installed and noticed pop-up ads in Chrome.

I immediatly uninstalled the app and left a review. Like many other negative reviews I received some copy-pasted response stating they only have some in app ads.

It is beyond me that the developers just lie about including malware in their app while it is so obvious they are.

Re: Barcode scanner app on Google Play infects 10M users with one update

#219

Post by captn3m0 » Mon, Feb 08, 2021, 10:52 AM UTC

artifact_44 wrote: post #186

captn3m0 wrote: post #150

Earlier quoted context omitted.

It is 2021 and Android still doesn't have a QR code scanner by default.

the camera app scans qr codes on my pixels.

Limited to certain phones. Otherwise, how do we explain millions of installs on QR code apps?

Re: Barcode scanner app on Google Play infects 10M users with one update

#220

Post by captn3m0 » Mon, Feb 08, 2021, 10:53 AM UTC

martyvis wrote: post #165

captn3m0 wrote: post #150

Earlier quoted context omitted.

It is 2021 and Android still doesn't have a QR code scanner by default.

Actually they do if they have Google Assistant, which I imagine anyone with Android 7 or later will. If you use the Google Lens feature it will decode barcodes and QR codes. But unfortunately this feature is pretty much self-discovery rather than a publicised function

It isn't obvious, needs Lens installed, which needs Internet to work properly.