Live data from Hacker News

Barcode scanner app on Google Play infects 10M users with one update

blog.malwarebytes.com

351–360 of 465 posts

Re: Barcode scanner app on Google Play infects 10M users with one update

#351

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…

The issue is not having a default app or not, the issue is having a qr reader external service.

Imagine you are an app developer of a really simple app that takes a number and tells you if that number is in a valid phone format or not. You have a textbox, the user enters it, you do the checking and display the result. Easy. Now imagine you want to allow scanning a qr which contains a number, to do the checking afterwards. You need to either ask your users to use an external app to scan and then open yours, include all the qr related library inside yours, or use a special intent from a third party app (that the users need to have already installed).

First solution is slow and inconvenience for users, the second is what almost all apps do, but then the code logic is duplicated on all of them (with the increment in app size). The third option is the best, both for the developer and for the user, however there is no official qr service so in the end this is basically option 1.

I mean, you already have a service to get a picture, a file and a contact, among others (you don't need to include all the code, simply do a call to the respective intent and wait for the result) so why don't extend this with the qr too?

Re: Barcode scanner app on Google Play infects 10M users with one update

#352

This is possibly tied to the recent assault on the ZXing Barcode scanner app[1]. This is a legit open source app that's been recently flooded by 1-star reviews claiming that the app contains malware, probably in order to get users to switch to the other apps. The funny thing is this app has not been updated since 2019 on the Play Store, so those reviews are clearly bogus. It takes a special kind of scum to slander an…

"Apps" and "algorithms" seem to be driving literally everything about society now. I don't think this is a good thing, nor do I see the trend reversing. These giant black boxes now control the levers of modern society, and the companies that own them get to hide behind their "terms of service" to avoid any responsibility for the damage being done.

Every significant review system is being gamed to the point of being unusable, and yet stories about not being able to trust them keep being reported as if this were somehow noteworthy. For every one of these stories that rises to a thread on HN, how many other small time vendors are getting screwed by someone who is willing to pay a room full of people in some 3rd-world country to debase their competitor's online presence?

Re: Barcode scanner app on Google Play infects 10M users with one update

#355
post #58
post #43

Earlier quoted context omitted.

There's a third possibility, and I think it's Stallman's ideal computing landscape: all users care deeply about the code running on their machines and they are competent in applying and vetting patches, building from source, etc. It's unrealistic, sure, but it sounds nice right about now.

I think back when he posted it, it might have been possible for sufficiently motivated and talented individuals to do such vetting, albeit even then it would have been a stretch. Nowadays the amount of code running on various devices in a single home has increased so dramatically... Think of TV remotes. They used to work with infrared. Nowadays, there are bluetooth remotes (not sure how widely deployed they are, but…

I agree it's unrealistic, but I think Stallman and many others like him would rather forego the benefits of a bluetooth remote than embrace the status quo.

OpenBSD for instance, was recently discussed on here for dropping a Bluetooth stack over concerns about the correctness of the implementation, and no one has bothered to write a better one.

Re: Barcode scanner app on Google Play infects 10M users with one update

#356

This is possibly tied to the recent assault on the ZXing Barcode scanner app[1]. This is a legit open source app that's been recently flooded by 1-star reviews claiming that the app contains malware, probably in order to get users to switch to the other apps. The funny thing is this app has not been updated since 2019 on the Play Store, so those reviews are clearly bogus. It takes a special kind of scum to slander an…

I reported a bunch as spam, but it probably netted me some negative reputation by their AI though.

Do you really want to do anything that looks like abuse with your Google account though?

When people don't know why Google banned their 15 year accounts I wonder if it's not from innocent stuff like this.

Re: Barcode scanner app on Google Play infects 10M users with one update

#357
post #342

Earlier quoted context omitted.

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…

My Android phone has the barcode scanner app built in. Also FM Radio, screen recorder and IR remote control.

Wow great phone what is the model

Re: Barcode scanner app on Google Play infects 10M users with one update

#358
post #125

QR Reader are load of everything. I went mad to find one a decent one for my parents’ android phone and apparently it doesn’t exists. So in a weekend I’ve created one without any kind of tracking, ads, permission, whatever. Here it is if you guys need one -> https://play.google.com/store/apps/details?id=com.prof18.sec...

4M for just a scanner??

I appreciate the app but...don't you think that's too much?

Re: Barcode scanner app on Google Play infects 10M users with one update

#359

Earlier quoted context omitted.

>yeah this is one reason why I can't take mobile app end to end encryption, or client side only, claims seriously. If it's a large company like Facebook that values these products like Whatsapp at billions I trust them at least on this issue. I'm pretty sure they're not going to put junk third party malware for 50k into the Whatsapp client. This is mostly an issue for apps done by individual developers who have huge…

>If it's a large company like Facebook that values these products like Whatsapp at billions I trust them at least on this issue. I'm pretty sure they're not going to put junk third party malware for 50k into the Whatsapp client. Zuck: They "trust me" Zuck: Dumb fucks.

That's a one dimensional way to think.

You may not be able to trust facebook with your privacy, but you can trust them not to install a malware that swipes your bitcoins.

That being said, I despise the current state of affairs with cellphones. I don't like needing to trust any corp. I'm jumping to a Linux native phone when my current device dies.

Re: Barcode scanner app on Google Play infects 10M users with one update

#360
post #342

Earlier quoted context omitted.

My Android phone has the barcode scanner app built in. Also FM Radio, screen recorder and IR remote control.

Wow great phone what is the model

It is this one:

https://www.gsmarena.com/xiaomi_redmi_note_9_pro-10217.php

Post reply on HN