Barcode scanner app on Google Play infects 10M users with one update

Arguably manual curation doesn't scale to google play store or apple app store size and automated scanning only gets you so far.

You have several possible threats.

1. Apps that are malicious from the start.

Best addressed by better automated testing.

2. Apps that become malicious particularly when the app changes hands.

Best addressed by making this impossible. James/foo should never be transferred ownership should result in Jane/foo which users would have to download.

3. Apps that aren't malicious but include a component that is user hostile. Virtually always included for money.

Best addressed by just forbidding apps with ads. We wont do this but not much of value would be lost.

4. Apps that include a component that isn't malicious but itself becomes malicious later.

Requires due diligence by the developer. Arguably one could imagine better automated enumeration of the constituent components to discern what might have been compromised so that developers could have their apps automatically pulled and informed that they were compromised. One could also imagine a statutory fine for paid that earn developer revenue wherein their product harms users. This couldn't accrue to free apps without making foss impossible. Eliminating apps paid for with ads would eliminate a gray area.

An interesting point for those who presently avoid ad laden apps is whether your paid for apps are infected with the same potential malware vectors as the ad supported version as whether or not to show ads may be solely a function of an in app purchase you have made. Your paid for app might therefore be just as vulnerable.

What reasonable measures would one expect Google to actually take? Probably only reactive measures like removing this particular app while making no meaningful moves to correct any systemic problems. In the longer term one might expect them to do a better job of finding malware automatically.

If you value not getting hacked in the longer term it looks like this is insufficient. If for example Fdroid is insufficient in scope of applications then perhaps we should work on improving this situation as Google is unlikely to fix this for us.

It took me a bit of digging to make the distinction. I have both of them listed in my App Library, and both with the same name. At some point, I believe I went to install ZXing on a new phone and Android warned me that the app may be incompatible, so I went to the space team one. It makes sense that if people aren't looking directly in their app library that they can get these mixed up and leave the bad reviews.

However, since the space team version got infected, I did try the ZXing app - no pop-ups, and it works just fine (despite the age warning).

https://play.google.com/store/apps/details?id=com.qrcodescan...

Guess this is why some walled gardens look a lot nicer from the inside...