Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Barcode scanner app on Google Play infects 10M users with one update

blog.malwarebytes.com

Post reply on HN
Print view View original

421–430 of 465 posts

Re: Barcode scanner app on Google Play infects 10M users with one update

#421

Post by ashneo76 »

dyingkneepad wrote: post #420
bityard wrote: post #416

Earlier quoted context omitted.

The ZXing Barcode Scanner (which is the "official barcode/QR code scanner for Android, as far as _I_ am concerned) is also available on f-droid.org. There's no absolute guarantee that F-Droid apps are malware-free but they have at least been looked at by a competent team of humans, something that is not true of the Play Store. https://f-droid.org/en/packages/com.google.zxing.client.andr...

Does F-Droid compile the binaries themselves? Or do they just take a look at my github and then trust the .apk I build myself and send them? I mean, I could very well make an open source app and then load some malware in the apk in addition to the well behaved thing... Are they immune from this attack?

F-droid mostly compiles from source. https://f-droid.org/en/docs/FAQ_-_General/#whats-the-differe...

Re: Barcode scanner app on Google Play infects 10M users with one update

#422

Post by davchana »

ytjohn wrote: post #300

I was 100% impacted by this. I've used that barcode scanner app for pretty much forever. I can't be 100% certain, but it's one of the first apps I ever installed on my first android phone (around '08/'09). It was what I directed other people to since all the other barcode scanners had ads. Around the end of December started seeing web page notifications after my phone had been locked for a while. I clear those and it…

Were you using the app from ZXing team https://play.google.com/store/apps/details?id=com.google.zxi... app? Because this app was last updated in 2018, has a generic name Barcode Scanner, & has attracted hundreds of reviews like yours saying App was updated recently, & now causes Web Ads.

For a counter point, I am also using this app since 2016, & have all apps on auto update, & have never received any web add popup or notification because of this or any app.

Re: Barcode scanner app on Google Play infects 10M users with one update

#424

Post by khamba »

hammock wrote: post #414
tcldr wrote: post #413

Earlier quoted context omitted.

This review fraud has got way out of hand. Right now, it would be better to remove reviews entirely and for consumers to make a decision based on the product page alone. The consumer trust in reviews is at such a low that it’s adding friction to purchase decisions and starving honest businesses from being able to invest in quality products. One solution might be to only publish reviews/ratings from accounts with a mi…

Fake reviews are not that hard to spot. Why don't we focus on educating people on how to evaluate what they read, and making informed decisions, rather than taking information (even if misinformation) away from them? It would help with fake news as well.

> Fake reviews are not that hard to spot.

This statement seems very suspect to confirmation bias. How would you get to know if what you think is genuine was actually fake? This part of feedback loop is completely missing, and hence I find your above statement hard to believe.

Re: Barcode scanner app on Google Play infects 10M users with one update

#425

Post by thatguy0900 »

Nightshaxx wrote: post #401
xorcist wrote: post #283

Earlier quoted context omitted.

> they just aren't included in the base OS Both a QR-capable camera and a flashlight in the notification bar are in all my Android phones, and they've been for a very long time. I know the Nexus One didn't include it, but those will have problems with modern TLS anyway. The problem is likely elsewhere. It wouldn't surprise me if many of these users are tricked into installing these apps. It is quite popular for malwa…

I have a pixel but i don't have qr scanning built in to the camera. It was at one point built into the "google vision" thing, but i haven't seen it in the ui for a while.

In a very google move, Google goggles was rebranded as Google lens and the Google goggles app stopped doing anything. As far as I know Google lens still does everything goggles did, including bar code/qr codes.

Re: Barcode scanner app on Google Play infects 10M users with one update

#426

Post by tcldr »

hammock wrote: post #414
tcldr wrote: post #413

Earlier quoted context omitted.

This review fraud has got way out of hand. Right now, it would be better to remove reviews entirely and for consumers to make a decision based on the product page alone. The consumer trust in reviews is at such a low that it’s adding friction to purchase decisions and starving honest businesses from being able to invest in quality products. One solution might be to only publish reviews/ratings from accounts with a mi…

Fake reviews are not that hard to spot. Why don't we focus on educating people on how to evaluate what they read, and making informed decisions, rather than taking information (even if misinformation) away from them? It would help with fake news as well.

Most people don’t read many reviews though. Just the ‘most helpful’ and the review tally. Worse, the store search results pages use the review scores to rank apps too.

Re: Barcode scanner app on Google Play infects 10M users with one update

#427

Post by ProZsolt »

Nightshaxx wrote: post #401
xorcist wrote: post #283

Earlier quoted context omitted.

> they just aren't included in the base OS Both a QR-capable camera and a flashlight in the notification bar are in all my Android phones, and they've been for a very long time. I know the Nexus One didn't include it, but those will have problems with modern TLS anyway. The problem is likely elsewhere. It wouldn't surprise me if many of these users are tricked into installing these apps. It is quite popular for malwa…

I have a pixel but i don't have qr scanning built in to the camera. It was at one point built into the "google vision" thing, but i haven't seen it in the ui for a while.

You just have to point to a QR code and it will automatically scan it.

Re: Barcode scanner app on Google Play infects 10M users with one update

#428

Post by You-Are-Right »

ignoramous wrote: post #333
You-Are-Right wrote: post #323

Earlier quoted context omitted.

why is nebulo not on fdroid?

It is on the main developer's f-droid repo: https://github.com/Ch4t4r/Nebulo#f-droid

I do like the fdroid review process - private repos do not have that.

Re: Barcode scanner app on Google Play infects 10M users with one update

#429

Post by pieter_mj »

dividuum wrote: post #196
dolmen wrote: post #110

Earlier quoted context omitted.

And even when you choose to only manually upgrade, carefully looking at the changelog, but it just says "Bugs fixed." The Play Store doesn't give enough information to really judge if the upgrade is necessary.

"Bug fixes and performance improvements". ~AirBnB

My Nokia 7.2 has had so many performance improvement updates I fully expect it to be faster than the latest iPhone flagship.

Re: Barcode scanner app on Google Play infects 10M users with one update

#430

Post by notatoad »

PUSH_AX wrote: post #411
notatoad wrote: post #382

Earlier quoted context omitted.

App stores are no more terrible than the previous software distribution model where you Google the name of the software you want to install, find some site that "mirrors" the download, realize they've repackaged the original app with extra ads and toolbars, keep searching, find the official download link, scroll past all the misleading ads containing download buttons, download the package, and then hope the download…

Would you call it the "previous" software distribution model? I still Google software for Mac and Windows, but I can't remember the last time i had to use a dodgy mirror site. Storage and bandwidth are cheap and plentiful now, most everything has an official source.

i call it "previous" because windows and mac both have actual app stores now, even if many developers shun the app stores and still encourage people to find their software by searching for it on google.
Post reply on HN