Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Barcode scanner app on Google Play infects 10M users with one update

blog.malwarebytes.com

Post reply on HN
Print view View original

361–370 of 465 posts

Re: Barcode scanner app on Google Play infects 10M users with one update

#361

Post by martin_a »

martin_a wrote: post #270
pcthrowaway wrote: post #172

Earlier quoted context omitted.

I'm terrified of browser extensions for this very same reason (and yes, I still use them). I wish the browser vendors supported some kind of pinning to source code for open source extensions. Right now I have at least 2 extensions running that I know could access my passwords on any website as I enter them. One of those is Lastpass, which I use for storing/generating those passwords anyway, and the other is AdBlock P…

AdBlock Plus is owned by a company who is selling ads. Use uBlock Origin instead, please.

To be more precise: You can pay them to get your ads listed as "acceptable ads" which will then pass the filter rules of ABP.

Would be a real shame if some software would block your ads because you didn't want to pay, wouldn't it?

Re: Barcode scanner app on Google Play infects 10M users with one update

#362

Post by bjarneh »

jefftk wrote: post #334
bjarneh wrote: post #215

Earlier quoted context omitted.

> Yeah, it's always in the flashlights, the barcode scanners, the background packs. Why are Google afraid to release a free non-harmful version of those popular apps. Is it to keep the illusion the app-store is a vibrant market place where tons of developers get rich? It just seems nuts to allow all those harmful apps (that does virtually nothing) to float among the top downloads.

> Why are Google afraid to release a free non-harmful version of those popular apps. They already did; these have both been built-in for years. The flashlight was added in Android 5.0 ( https://www.androidauthority.com/android-5-0-lollipop-offici... I'm having a harder time figuring out when the barcode scanner was added, but my phone does it automatically in the camera app now. (Disclosure: I work for Google, speaki…

> these have both been built-in for years.

If Android has a built-in QR scanner now, that must be something that came with Android 11, but September 8 2020 cannot qualify as "for years". It takes a while for OEM's to catch up as well.

There are certainly Android phones that ships with this feature (QR-scanner), but stock Android 10 does not. (Google lens != Standard Photo app).

If you know about it, you can start "Google lens" app, but that app does not even come up as a suggestion when you type QR scanner into the play store. I.e. even when you have a QR scanner available on your phone, you wouldn't know unless you somehow knew about "Google lens".

Re: Barcode scanner app on Google Play infects 10M users with one update

#363

Post by Scoundreller »

kogepathic wrote: post #160
Scoundreller wrote: post #84

Earlier quoted context omitted.

I’m usually like this. Then my bank’s app refused to launch until I updated. They re-designed it. When I went to click my usual “schedule payment” button on a bill payment, it just said “Coming Soon”. I wasn’t a happy person about it. Big Canadian bank too. US$65b mkt cap.

> Big Canadian bank too. US$65b mkt cap. Well then, let me tell you about Toronto Dominion bank (TD, market cap ~$105B) The app allows you to photograph a cheque to deposit from the app. This option is displayed for their TD USD chequing account. I scanned a cheque from a US bank in the app (to deposit into my USD chequing account), only to be informed that cheques from US banks cannot be deposited using the app and…

> I scanned a cheque from a US bank in the app (to deposit into my USD chequing account), only to be informed that cheques from US banks cannot be deposited using the app and that I'd have to go to a branch.

Dunno if Canadian banks would be game for this, but back when AdSense only mailed cheques in US$, and inexplicably refused to e-deposit to my US-based bank account, I’d mail my cheques in.

Re: Barcode scanner app on Google Play infects 10M users with one update

#364

Post by jorvi »

prima-facie wrote: post #296

This is possibly tied to the recent assault on the ZXing Barcode scanner app[1]. This is a legit open source app that's been recently flooded by 1-star reviews claiming that the app contains malware, probably in order to get users to switch to the other apps. The funny thing is this app has not been updated since 2019 on the Play Store, so those reviews are clearly bogus. It takes a special kind of scum to slander an…

Gotta love that those bogus 1-star reviews stay up, but Google instantly came to the rescue of Robinhood when it was getting flooded by 1-star reviews that had an actual legitimate basis.

Re: Barcode scanner app on Google Play infects 10M users with one update

#365

Post by wsc981 »

protoman3000 wrote: post #95

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…

One or two years ago a Chinese guy contacted me asking me if I wanted to put an app or multiple apps on the AppStore for his company. In return I would receive 1.000 USD per month or so. I found this really suspicious, so I never accepted the offer. I also didn't want to risk getting banned by Apple for an offence like distributing malware.

I wouldn't be surprised if there are app developers that actually do accept these kinds of offers though.

Re: Barcode scanner app on Google Play infects 10M users with one update

#366

Post by machrider »

sunnyam wrote: post #224
teekert wrote: post #175

Earlier quoted context omitted.

Yeah, it's always in the flashlights, the barcode scanners, the background packs. They all address super basic functionality that many, many people seem to want (if I could just set a ringtone from YouTube, it'd save me from going through a bunch of shady apps, if I ever needed a ringtone that is). Yet they just aren't included in the base OS (or weren't always, my lineage OS has a flashlight currently). Therefore, t…

Yeah, on Pixel phones you can just scan the barcode from the camera app, or from Google Lens

I just tried the camera app with a QR code (on a Pixel 5) and nothing happened.

Re: Barcode scanner app on Google Play infects 10M users with one update

#367

Post by jk7tarYZAQNpTQa »

drderidder wrote: post #335

My first ever mobile app was an experimental bit of Android Malware. It got demo'd by my colleague at Blackhat [1]. I'm definitely not a hacker, but with a few basic tricks I was able to create a pretty effective trojan which we then injected into a popular game (again only for experimental purposes, it was never released in the wild). In our lab we had literally millions of samples of Android malware, but for iOS we…

Apple's iOS is way more secure than Android in several aspects. The best example is their 5 years of guaranteed security (and features!) updates, versus 2-3 tops in Android (even <1 with Chinese cheap brands than are very common in Europe, such as Xiaomi).

Re: Barcode scanner app on Google Play infects 10M users with one update

#368

Post by miohtama »

bjarneh wrote: post #143
protoman3000 wrote: post #95

Even legitimate app developers have no incentive to keep their apps sterile. Someone just has to approach you with your 10+ million users barcode scanner app and offer you +50,000$ in order to install some automated ad clicker for them. Don’t be naive, the majority will accept the money and gladly. I believe that particularly makeshift applications such as e.g. barcode scanners are susceptible to this kind of overtak…

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…

Patents

Re: Barcode scanner app on Google Play infects 10M users with one update

#369

Post by jk7tarYZAQNpTQa »

ntSean wrote: post #36

When the Apple App Store contained malware compiled by unsuspected Chinese developers using a local cache of Xcode [1], Apple emailed the developers to prompt them to update their application immediately and removed them from sale. Apple also contacted users directly to alert them of whatever apps they had purchased on the App Store were compromised so they could monitor for updates, or remove the app entirely. Has G…

> Neither Apple or Google have the ability to directly remove apps on a users device

I'm pretty sure both can. But it's a legal problem, not a technical one.

Re: Barcode scanner app on Google Play infects 10M users with one update

#370

Post by Wowfunhappy »

ntSean wrote: post #38
m463 wrote: post #34

Earlier quoted context omitted.

Apple does not let you back out an update you made and regret. Apple does not block apps from using the network or give you any way to find out what they are doing and who they are talking to. In fact, apple does the opposite - it blocks apps that let you firewall your phone.

Applications like Charles [1] allow you monitor network connections and data closely. Apple do not actively prevent this. You can also setup a VPN to route traffic and strictly firewall. [1] https://www.charlesproxy.com

This works as long as the app does not enforce certificate pinning. But if it does, there's no way to override it and inspect what's actually going on, as I can on my desktop.
Post reply on HN