Barcode scanner app on Google Play infects 10M users with one update • Hacker News Board

Re: Barcode scanner app on Google Play infects 10M users with one update

#391

Post by mynameisvlad » Mon, Feb 08, 2021, 5:07 PM UTC

xorcist wrote: post #283

teekert wrote: post #175

Earlier quoted context omitted.

Yeah, it's always in the flashlights, the barcode scanners, the background packs. They all address super basic functionality that many, many people seem to want (if I could just set a ringtone from YouTube, it'd save me from going through a bunch of shady apps, if I ever needed a ringtone that is). Yet they just aren't included in the base OS (or weren't always, my lineage OS has a flashlight currently). Therefore, t…

> they just aren't included in the base OS Both a QR-capable camera and a flashlight in the notification bar are in all my Android phones, and they've been for a very long time. I know the Nexus One didn't include it, but those will have problems with modern TLS anyway. The problem is likely elsewhere. It wouldn't surprise me if many of these users are tricked into installing these apps. It is quite popular for malwa…

Discoverability is just as much an issue as feature including. If you have to go into a special QR mode (which a lot of cameras did), you’re never going to use the feature, and it’s hard to break those mental models if the feature gets silently added in later iterations; you’re always going to remember that first encounter where something didn’t work seamlessly.

Re: Barcode scanner app on Google Play infects 10M users with one update

#392

Post by trevor-e » Mon, Feb 08, 2021, 5:08 PM UTC

prima-facie wrote: post #296

This is possibly tied to the recent assault on the ZXing Barcode scanner app[1]. This is a legit open source app that's been recently flooded by 1-star reviews claiming that the app contains malware, probably in order to get users to switch to the other apps. The funny thing is this app has not been updated since 2019 on the Play Store, so those reviews are clearly bogus. It takes a special kind of scum to slander an…

FWIW the updated date doesn't necessarily mean anything, the app could be loading code remotely via some endpoint which the article does mention as a possibility in general.

Re: Barcode scanner app on Google Play infects 10M users with one update

#393

Post by waiseristy » Mon, Feb 08, 2021, 5:11 PM UTC

Crazy to see this on HN. I was affected by this malware earlier this month and have both reported the app via the app store phone UI and submitted a full report w/ screenshots via the play stores web interface. Absolutely insane that I can still download this app from the play store and the devs account hasn't been nuked.

Re: Barcode scanner app on Google Play infects 10M users with one update

#394

Post by jboydyhacker » Mon, Feb 08, 2021, 5:15 PM UTC

We've built a QR Code and Barcode Scanner that is fully privacy compliant. It focuses on product search and providing local and online prices but the QR code Scanning is incredibly fast here: https://play.google.com/store/apps/details?id=com.biggu.shop...

If you guys have any features you'd like to see in a stand alone QR code Reader, let us know.

Re: Barcode scanner app on Google Play infects 10M users with one update

#395

Post by f430 » Mon, Feb 08, 2021, 5:23 PM UTC

waiseristy wrote: post #393

Crazy to see this on HN. I was affected by this malware earlier this month and have both reported the app via the app store phone UI and submitted a full report w/ screenshots via the play stores web interface. Absolutely insane that I can still download this app from the play store and the devs account hasn't been nuked.

When did you first notice it?

Re: Barcode scanner app on Google Play infects 10M users with one update

#396

Post by g_p » Mon, Feb 08, 2021, 5:24 PM UTC

Silhouette wrote: post #132

g_p wrote: post #118

Earlier quoted context omitted.

> We are at a point where auto-updates are more risky than the security flaw itself - especially since iOS has a pretty good sandbox, especially since its impossible for one app to access the data of another. Additionally, the App usually connects to a pretty limited set of servers, and is not publicly reachable. So the attack vector is pretty small. I'd have to say that most apps now connect to a rather large number…

hopefully Apple will require consent soon for the ID for advertisers Just think through the implications of that phrase for a moment, though. Your own device comes with a built-in mechanism specifically designed for advertisers to track you. Why was that ever a good idea in the first place?

Agreed - it really is absurd. One time I tried to design as a thought experiment a "platform" where each execution environment of the app was absolutely indistinguishable from any other.

Unfortunately to make it work you can't give it network access (easily, at least). But you have a whole host of stuff in /proc and /sys that you also need to block (at least on Android) - there's just too much unique per-device information available to apps. Clearly ensuring runtimes are indistinguishable was never a design goal (as some simple chroot'ing together a virtual filesystem would help to prevent a lot of this, as long as the APIs are limited enough).

But alas, when your phone OS comes from an adtech company, that is probably a hint they are not interested in making it indistinguishable from others.

Re: Barcode scanner app on Google Play infects 10M users with one update

#397

Post by f430 » Mon, Feb 08, 2021, 5:26 PM UTC

ytjohn wrote: post #300

I was 100% impacted by this. I've used that barcode scanner app for pretty much forever. I can't be 100% certain, but it's one of the first apps I ever installed on my first android phone (around '08/'09). It was what I directed other people to since all the other barcode scanners had ads. Around the end of December started seeing web page notifications after my phone had been locked for a while. I clear those and it…

So just to be aware, what was the root cause of this incident? Was it permission settings? How did it slip through the release process on Google Play, or is there none at all?

What does this mean for other apps with overreaching permissions?

Re: Barcode scanner app on Google Play infects 10M users with one update

#398

Post by waiseristy » Mon, Feb 08, 2021, 5:29 PM UTC

f430 wrote: post #395

waiseristy wrote: post #393

Crazy to see this on HN. I was affected by this malware earlier this month and have both reported the app via the app store phone UI and submitted a full report w/ screenshots via the play stores web interface. Absolutely insane that I can still download this app from the play store and the devs account hasn't been nuked.

When did you first notice it?

The app was updated Jan 29th. I noticed probably on the 1st or 2nd of February. I had a hard time tracking down where the spam tabs were coming from, but the app luckily gave me a spam notification from which I was able to see the app name and uninstall it.

Re: Barcode scanner app on Google Play infects 10M users with one update

#399

Post by g_p » Mon, Feb 08, 2021, 5:32 PM UTC

Silhouette wrote: post #346

sjwright wrote: post #304

Earlier quoted context omitted.

Such mechanisms have already existed and never needed OS-level sanction. It’s pretty clear that Apple is employing the strategy of “embrace, extend, extinguish” against tracking and privacy compromising dark patterns. In other words, force developers to use a special API, then give consumers the ability to block it. The current stoush with Facebook is only the most formidable hurdle Apple has encountered so far.

That is the usual argument, but I don't see how it stands up to scrutiny. Either there are alternative ways to track a user of an Apple device without IDFA or there are not. If there are, then it is reasonable to assume that unethical advertisers will return to using them if their access to IDFA is gated. So, whether or not IDFA exists, the only robust way to protect users is to block apps from having access to anyth…

It does seem like when IDFA goes, apps will be struggling for identifers, at least on iOS. I've seen a few articles suggesting they will be back to trying to fingerprint devices (in manners that break the App Store terms of service).

I agree entirely - it seems that the solution going forwards is to prevent any access to any kind of persistent identifier that is part of the runtime environment. This might get in the way of some security mitigations (which seem pretty weak to begin with) and some monetisation models (i.e. enabling pervasive tracking across apps), but the end result feels more "clean" and like users would expect - the app runs in a sandbox where there's no access to anything to distinguish the app from any other instance of it.

Clearly keeping this up at the network level is far harder (and some app developers will probably fall back to using the WAN IP and other factors), but perhaps there are even solutions here - perhaps TCP relay servers mix user traffic (while leaving it HTTPS-protected) to prevent services from seeing user IPs, and a virtual network interface internally in the runtime ensures apps only see an IP of 10.0.0.1.

It seems a worthy goal to try to ensuer that runtime environments are indistinguishable, at least to end cross-service ad tracking once-and-for-all. Handling it within apps probably comes down to policy - not sure any technical mitigations can prevent this while apps can remain Turing complete (as they can simply store their own identifier).

Re: Barcode scanner app on Google Play infects 10M users with one update

#400

Post by f430 » Mon, Feb 08, 2021, 5:34 PM UTC

waiseristy wrote: post #398

f430 wrote: post #395

Earlier quoted context omitted.

When did you first notice it?

The app was updated Jan 29th. I noticed probably on the 1st or 2nd of February. I had a hard time tracking down where the spam tabs were coming from, but the app luckily gave me a spam notification from which I was able to see the app name and uninstall it.

I just don't understand how Google Play could've let this slip. Was this like the cyberattack now to long ago where they were able to infiltrate the CI/CD process to slip in updates? Is this the fault of the developers not securing it or is this willful neglect or incompetence at Google Play store level?