Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Barcode scanner app on Google Play infects 10M users with one update

blog.malwarebytes.com

Post reply on HN
Print view View original

221–230 of 465 posts

Re: Barcode scanner app on Google Play infects 10M users with one update

#221

Post by MrPatan »

Barrin92 wrote: post #111
vmception wrote: post #103

Earlier quoted context omitted.

yeah this is one reason why I can't take mobile app end to end encryption, or client side only, claims seriously. a single update at any time could undermine all of that and secondly, they or an analytics package can just read everything client side and upload it to a server anyway doesn't matter if its whatsapp, or signal, or some protonmail client if such a thing exists I just don't use them with that assurance in…

>yeah this is one reason why I can't take mobile app end to end encryption, or client side only, claims seriously. If it's a large company like Facebook that values these products like Whatsapp at billions I trust them at least on this issue. I'm pretty sure they're not going to put junk third party malware for 50k into the Whatsapp client. This is mostly an issue for apps done by individual developers who have huge…

I get what you're saying, but it's funny because what the dodgy small players do with the data is actually sell it to facebook. You're just cutting out the middleman here.

Re: Barcode scanner app on Google Play infects 10M users with one update

#222

Post by captn3m0 »

simias wrote: post #205
captn3m0 wrote: post #150

Earlier quoted context omitted.

It is 2021 and Android still doesn't have a QR code scanner by default.

Google lens does it, is it not part of stock android? My phone runs Android One, so I think it's all stock but I could've missed a subtlety.

Lens isn't AOSP, so it gets different treatment depending on your manufacturer.

Re: Barcode scanner app on Google Play infects 10M users with one update

#223

Post by captn3m0 »

perryizgr8 wrote: post #180
captn3m0 wrote: post #150

Earlier quoted context omitted.

It is 2021 and Android still doesn't have a QR code scanner by default.

Samsung phones have it in the camera, so I guess most Android users do have a barcode scanner built-in.

Why are Android users installing all these apps then? https://play.google.com/store/search?q=QR%20scanner&c=apps&h...

Re: Barcode scanner app on Google Play infects 10M users with one update

#224

Post by sunnyam »

teekert wrote: post #175
bjarneh wrote: post #143

Earlier quoted context omitted.

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…

Yeah, it's always in the flashlights, the barcode scanners, the background packs. They all address super basic functionality that many, many people seem to want (if I could just set a ringtone from YouTube, it'd save me from going through a bunch of shady apps, if I ever needed a ringtone that is). Yet they just aren't included in the base OS (or weren't always, my lineage OS has a flashlight currently). Therefore, t…

Yeah, on Pixel phones you can just scan the barcode from the camera app, or from Google Lens

Re: Barcode scanner app on Google Play infects 10M users with one update

#225

Post by kuschku »

moritonal wrote: post #148
prof18 wrote: post #125

QR Reader are load of everything. I went mad to find one a decent one for my parents’ android phone and apparently it doesn’t exists. So in a weekend I’ve created one without any kind of tracking, ads, permission, whatever. Here it is if you guys need one -> https://play.google.com/store/apps/details?id=com.prof18.sec...

But this is the classic cycle don't you see? They almost always start as "here is an app I threw together, no ads, don't be evil". But then a lot of people like your app, and ask for a small extra feature. You support it, and then get a bit annoyed by all the features people are asking for. Then you have to update it for the latest release... then suddenly fix it when some obscure version of Android breaks on it. The…

That’s why you should try to use apps from reputable developers, who’ve already had countless such offers and refused them all.

The usual "400$/month per 1k users" stuff, just integrate an ad network is common, but sometimes as dev you even get offers like "we hire you, with a contract, you can’t be fired, legally you’re a consultant to us for 2 years, at a few hours per week officially, for a silicon valley wage, unofficially you just don’t do anything and collect but we get full control over your apps".

Personally I’ve had quite a few such offers, and I’ve rejected them in the past and will also reject them in the future

Trust devs who’ve proven themselves :)

Re: Barcode scanner app on Google Play infects 10M users with one update

#226

Post by mschuster91 »

bjarneh wrote: post #215
teekert wrote: post #175

Earlier quoted context omitted.

Yeah, it's always in the flashlights, the barcode scanners, the background packs. They all address super basic functionality that many, many people seem to want (if I could just set a ringtone from YouTube, it'd save me from going through a bunch of shady apps, if I ever needed a ringtone that is). Yet they just aren't included in the base OS (or weren't always, my lineage OS has a flashlight currently). Therefore, t…

> Yeah, it's always in the flashlights, the barcode scanners, the background packs. Why are Google afraid to release a free non-harmful version of those popular apps. Is it to keep the illusion the app-store is a vibrant market place where tons of developers get rich? It just seems nuts to allow all those harmful apps (that does virtually nothing) to float among the top downloads.

> Why are Google afraid to release a free non-harmful version of those popular apps.

Fear of anti-competition lawsuits and complaints. They're seeing what happens when Apple integrates stuff into iOS / OS X core that previously were third party provided, or the flak that Amazon gets for pushing AmazonBasics products.

Re: Barcode scanner app on Google Play infects 10M users with one update

#227

Post by bjarneh »

mschuster91 wrote: post #226
bjarneh wrote: post #215

Earlier quoted context omitted.

> Yeah, it's always in the flashlights, the barcode scanners, the background packs. Why are Google afraid to release a free non-harmful version of those popular apps. Is it to keep the illusion the app-store is a vibrant market place where tons of developers get rich? It just seems nuts to allow all those harmful apps (that does virtually nothing) to float among the top downloads.

> Why are Google afraid to release a free non-harmful version of those popular apps. Fear of anti-competition lawsuits and complaints. They're seeing what happens when Apple integrates stuff into iOS / OS X core that previously were third party provided, or the flak that Amazon gets for pushing AmazonBasics products.

> Fear of anti-competition lawsuits and complaints.

They could just create an open source variant that suddenly shows up top when people search for QR or barcode scanner. It would be in their best interest, and it would not violate any anti-competition laws, nobody can demand to see how these apps are ranked I guess?

Re: Barcode scanner app on Google Play infects 10M users with one update

#228

Post by hilbert42 »

nobodywasishere wrote: post #171
protoman3000 wrote: post #95

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…

This is why I get all of these kinds of apps from F-Droid instead of the Play Store. Here's the QR code scanner I use: https://f-droid.org/en/packages/de.t_dankworth.secscanqr/

Right, I'm an avid user of F-Droid and a large percentage of my apps come via this route. The trouble is that I have found that QR code scanners are very significantly different in both their feature sets and in their ability to recognize different barcode/QR code scans.

That's to say:

(a) The time for a given barcode to be accurately detected varies considerably from app to app.

(b) And various apps have different detection capabilities with respect to one another (i.e.: the detection performance varies from app to app depending on the contrast across the barcode image, camera focus or lack thereof, etc.).

(c) For a given app, the detection capability for different types of barcode scans can vary considerably.

For that reason, I have five different QR scanners installed including SecScanQR that you've mentioned and the one with the same namesake as mentioned in this Malwarebytes article.

It seems there's a great deal of variability in the detection algorithms between apps. Unfortunately, from my experience I've found that some of the commercial apps have better detection performance than those on F-Droid—but granted that's only from my limited testing. Which app I use sometimes depends on other features, for instance, the fact that it has a better database or export ability, etc. is more important than the fact that it's insensitive in the detection department.

I wish someone with more knowledge and experience could give others and me the good oil on this. Reckon it'd save us considerable time experimenting.

Re: Barcode scanner app on Google Play infects 10M users with one update

#229

Post by meibo »

captn3m0 wrote: post #223
perryizgr8 wrote: post #180

Earlier quoted context omitted.

Samsung phones have it in the camera, so I guess most Android users do have a barcode scanner built-in.

Why are Android users installing all these apps then? https://play.google.com/store/search?q=QR%20scanner&c=apps&h...

Because most Android users don't know about Google Lens/their camera app and google "Barcode Scanner app" when they get their phone.

Re: Barcode scanner app on Google Play infects 10M users with one update

#230

Post by bbarn »

bjarneh wrote: post #204
EdwardDiego wrote: post #199

Earlier quoted context omitted.

> To make matters worse, scanning a barcode when you enter a store/cafe (to register your location), is now begin done everywhere in order to track potential covid19 spreaders. This forces anyone without an iPhone to install at least one of these potentially harmful apps. Our (New Zealand) Covid tracing app scans QR codes itself. What jurisdictions are requiring to scan an arbitrary QR code using random apps? https:/…

Is there anything you guys in New Zealand haven't done better during this pandemic? :-)

"Better" is certainly a point of view here. Having to tell the government all of your whereabouts when you already live on an Island with no spreading is an overreach, IMO.
Post reply on HN