Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Barcode scanner app on Google Play infects 10M users with one update

blog.malwarebytes.com

Post reply on HN
Print view View original

231–240 of 465 posts

Re: Barcode scanner app on Google Play infects 10M users with one update

#231

Post by bbarn »

protoman3000 wrote: post #216
varispeed wrote: post #212

Earlier quoted context omitted.

> Apps that offer what should have been offered by the OS vendor in the first place. Wouldn't that be anti-competitive? Similar situation when Microsoft was including IE on their system that made them a quasi monopolist with subpar product. I'd rather have Google having stricter rules when it comes to malware.

You’re right. How dare Microsoft abuses their monopoly and ships Windows with a clock in the taskbar! And why stop here? We should open the market for TCP implementations. The status quo is anti-competitive and stifles innovation!

Funny how Microsoft's including a useful tool for you know, getting on the internet, with their OS was the subject of an anti-trust suit just a few decades ago and now it's ok to force users to purchase all apps from the apple store, which takes 30% from every company wanting to sell an app on iOS.

Re: Barcode scanner app on Google Play infects 10M users with one update

#232

Post by yodelshady »

bjarneh wrote: post #215
teekert wrote: post #175

Earlier quoted context omitted.

Yeah, it's always in the flashlights, the barcode scanners, the background packs. They all address super basic functionality that many, many people seem to want (if I could just set a ringtone from YouTube, it'd save me from going through a bunch of shady apps, if I ever needed a ringtone that is). Yet they just aren't included in the base OS (or weren't always, my lineage OS has a flashlight currently). Therefore, t…

> Yeah, it's always in the flashlights, the barcode scanners, the background packs. Why are Google afraid to release a free non-harmful version of those popular apps. Is it to keep the illusion the app-store is a vibrant market place where tons of developers get rich? It just seems nuts to allow all those harmful apps (that does virtually nothing) to float among the top downloads.

FWIW I've not had an Android phone lacking a flashlight in the OS since... ever, I think. At a guess, the apps are preying on customers not aware of the OS-level functionality.

QR scanning seems a little more complicated. FF for Android integrates a QR scanner, but chrome does not. Google's default camera also opens links, if you allow Google Lens.

Re: Barcode scanner app on Google Play infects 10M users with one update

#233

Post by meibo »

herendin2 wrote: post #201

The developer's street address, as shown in the malwarebytes screenshot, is obviously either incomplete or bogus. There's no city or country, and a weird unit number. Is Google Play really approving apps from such dubious sources? Or does Google have the full address? Seems unlikely

You don't need to provide this publicly if you do not have any billing in your app, so no IAP or paid apps. They might just not verify it though.

Google has it, since publishing requires a $15 one-time fee. Of course, you can put bogus into the billing info for that as well.

Re: Barcode scanner app on Google Play infects 10M users with one update

#234

Post by dotancohen »

chordalkeyboard wrote: post #133
dotancohen wrote: post #92

Earlier quoted context omitted.

I absolutely love Camscanner, and I have been for over a year on the old version because I refuse to update to the new version which requires network permissions. I exactly suspected this is why it needs those permissions. To what did you switch? Camscanner is otherwise an excellent app, especially for combining multiple images and straightening them out.

I just continue to use the brother scanner in the other room. I don’t recommend brother, they updated the software and somehow took away features.

Unfortunately the HP scanner doesn't fit into my meeting bag!

Re: Barcode scanner app on Google Play infects 10M users with one update

#235

Post by dotancohen »

curiousgal wrote: post #112
dotancohen wrote: post #92

Earlier quoted context omitted.

I absolutely love Camscanner, and I have been for over a year on the old version because I refuse to update to the new version which requires network permissions. I exactly suspected this is why it needs those permissions. To what did you switch? Camscanner is otherwise an excellent app, especially for combining multiple images and straightening them out.

Adobe Scan is a solid option as well.

Adobe has lost my trust years ago, and I see that viewpoint vilified often enough to never use Adobe software again. The only Adobe product that I still use is Magento, and only that on client sites. I would love to find a non-Adobe alternative.

Re: Barcode scanner app on Google Play infects 10M users with one update

#236

Post by leonroy »

pcthrowaway wrote: post #172
protoman3000 wrote: post #95

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…

I'm terrified of browser extensions for this very same reason (and yes, I still use them). I wish the browser vendors supported some kind of pinning to source code for open source extensions. Right now I have at least 2 extensions running that I know could access my passwords on any website as I enter them. One of those is Lastpass, which I use for storing/generating those passwords anyway, and the other is AdBlock P…

Alas the Great Suspender just fell prey to malware after its creator sold it off: https://news.ycombinator.com/item?id=25846504

I think Apple have the right idea with app review on browser extensions for Safari.

Re: Barcode scanner app on Google Play infects 10M users with one update

#237

Post by dotancohen »

karmahunting wrote: post #174
chordalkeyboard wrote: post #51

Earlier quoted context omitted.

School tried to make me use camscanner, glad I took the extra effort to do something else. Thanks for the anecdote.

Try OpenScan, open source document scanner app... Source: I am a user

Thank you. Unfortunately, it seems that OpenScan does not have the feature to straighten out photographed documents. Cammscanner has its own camera app, which has features specific to photographing documents.

Re: Barcode scanner app on Google Play infects 10M users with one update

#238

Post by dotancohen »

zo1 wrote: post #147
m463 wrote: post #31

Earlier quoted context omitted.

This happened on ios for me years ago. I had two apps that radically changed their business model (owner?) through updates with no recourse. I had an app called gas cubby, which let me locally - on the phone - keep track of all my vehicles. I could enter detailed information about each car such as year, make, model, vin, insurance policy, gas purchases, oil changes and the like. It would tell you gas mileage and remi…

Camscanner was a blatant bait and switch. When I first started using it, I paid for a license to get full functionality with no ads/watermarks/etc. Magically, years later I got reverted to the ad-supported/free version, and my license was nowhere to be found. This was at the same time they moved to "cloud features" and a subscription model. Their reviews are littered with people having the same issue and the develope…

I haven't had this issue with Camscanner, but I've had it with other apps. One outright disappeared from my library, as if I have never had it installed.

Re: Barcode scanner app on Google Play infects 10M users with one update

#239

Post by rectang »

ignoramous wrote: post #187
aq3cn wrote: post #131

I stick to F-droid android app store. it asks developer to submit their code which gets compiled by the F-Droid team. apps with proprietary codes are flagged. few QR code apps from F-Droid. https://f-droid.org/en/packages/com.example.barcodescanner/ https://f-droid.org/en/packages/com.secuso.privacyFriendlyCo...

Open source apps can absolutely have trackers in them. F-Droid isn't a security solution by any measure. I have inspected code of at least one popular "privacy" app that absolutely tracks its users out in the open (I mean, the code is right there on GitHub), yet I see repeatedly that app (and F-Droid) being touted as some elixir that fixes security and privacy for one and all. It doesn't. Don't place your trust on F-…

What open source gives you is an audit trail, which is helpful but not sufficient. You still need to be able to trace malicious code to actual individuals. Then you need the ability to punish those individuals, ideally through criminal prosecution.

Re: Barcode scanner app on Google Play infects 10M users with one update

#240

Post by Ensorceled »

bbarn wrote: post #230
bjarneh wrote: post #204

Earlier quoted context omitted.

Is there anything you guys in New Zealand haven't done better during this pandemic? :-)

"Better" is certainly a point of view here. Having to tell the government all of your whereabouts when you already live on an Island with no spreading is an overreach, IMO.

The 21,000 dead here in Canada would like to argue that it is much, much better but, well, they can't.

I literally can not believe you are arguing it's not better.

Post reply on HN