Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Barcode scanner app on Google Play infects 10M users with one update

blog.malwarebytes.com

Post reply on HN
Print view View original

441–450 of 465 posts

Re: Barcode scanner app on Google Play infects 10M users with one update

#441

Post by benibela »

aq3cn wrote: post #131

I stick to F-droid android app store. it asks developer to submit their code which gets compiled by the F-Droid team. apps with proprietary codes are flagged. few QR code apps from F-Droid. https://f-droid.org/en/packages/com.example.barcodescanner/ https://f-droid.org/en/packages/com.secuso.privacyFriendlyCo...

I once tried to get my app in F-Droid, but they refused, because they did not want to install the dependencies because the dependencies were too big. Turns out you cannot compile something without dependencies. I wrote my app in FPC/Lazarus to make a truly cross platform app that runs natively on anything from a Raspberry PI to Windows 2000, and they did not like that tech stack.

Re: Barcode scanner app on Google Play infects 10M users with one update

#442

Post by DrScump »

stedaniels wrote: post #65
DrScump wrote: post #45

Earlier quoted context omitted.

Every Google Play update prompt in My Apps has a description provided by the publisher. If there is an urgency to update and they don't say so, I'm not going to blithely accept every update. Ior example, had there not been the exploit risk, I would have left Chrome at the older version, as their new tabgroup implementation is horrible, and it doesn't even allow you to open a new tab without creating a group or going…

> Every Google Play update prompt in My Apps has a description provided by the publisher. I hate to reply like this but, the vast majority of Google Play app updates go something like this: "Updates." "Fixes" "..." Having genuine changelogs would be glorious. Apple and Google should require proper source and issue management, they could then generate changelogs automatically. Having that, they could then use machine…

  the vast majority of Google Play app updates go something like this
That's exactly my point. Unless they state something that accurately communicates risk and urgency, I don't upgrade.

Most updates of embedded-ad apps just seem to be changes in ads or ad engines.

Re: Barcode scanner app on Google Play infects 10M users with one update

#443

Post by jsmith45 »

zerocrates wrote: post #145
hulunon wrote: post #78

Earlier quoted context omitted.

I also found this pop-up add behaviour Saturday (6th) morning. I distinctly remember looking at this app last year when a different barcode scanner had an issue and it was not owned by "the space team" then,maybe a takeover? App now uninstalled

The one I remember being popular before on Android was the "zxing" one: it's still on the Play Store but has tons of recent reviews complaining about adware... confused users (and/or competitors taking advantage) leaving reviews on the wrong one? The zxing one seems to not have been updated in years (plus it's still on the store).

Right. Space Team's app was a fork of the zxing demo app updated to newer SDK versions, but with the same name and basically identical interface. It had a malicious version uploaded recently, and was nuked by Google.

People then found the original, that looks the same, and started leaving negative reviews, attacking the "maintainer" (who does not really maintain it anymore, since Google no longer pays him to do so and it is no longer possible to update for the play store without some substantial code changes to target the newer android API versions) on Github, etc.

Re: Barcode scanner app on Google Play infects 10M users with one update

#444

Post by bjarneh »

jefftk wrote: post #379
bjarneh wrote: post #362

Earlier quoted context omitted.

> these have both been built-in for years. If Android has a built-in QR scanner now, that must be something that came with Android 11, but September 8 2020 cannot qualify as "for years". It takes a while for OEM's to catch up as well. There are certainly Android phones that ships with this feature (QR-scanner), but stock Android 10 does not. (Google lens != Standard Photo app). If you know about it, you can start "Go…

I have a Pixel 3a, and I'm pretty sure it's done this since it was new (Spring 2019). I also thought my previous phone (Pixel 1) did it, though I don't have anymore and can't check.

There are many phones that have it (and have had it for a while like the Pixel it seems). Some can also enable Google lens from within the camera app, I cannot though on stock Android version 10.

Re: Barcode scanner app on Google Play infects 10M users with one update

#445

Post by TeMPOraL »

HenryBemis wrote: post #387
TeMPOraL wrote: post #142

Earlier quoted context omitted.

> I will imagine that anyone who creates an authenticator is half-decent enough to NOT take that bribe and serve the greater good. Dear HenryBemis, As a CEO of TRC, I would like to extend you an offer to purchase source and distribution rights to your app, SummerChildAuthenticator, to the form of $500,000 (five hundred thousand US dollars). We are a fast growing SV startup that wants to make it easier for people to s…

I hear you. Any developer knows/understands if the offer comes from a legit source or scumbag. I cannot make other people's choices for them. My answer would be 'no' even for 100k, BUT I am in HN and I suggest people get off facebook and google because they are privacy nightmares (also certified in a couple of audit/security areas - so there's that). Btw I did have an app on Apple store, target audience was children…

I did offer $500k though, not $50k :).

And while I don't think you personally will sell out like this, I wanted to highlight that a) it's easy to make such an offer sounding legit enough (particularly to developers with little experience with the world at large), and b) an Authenticator app is a perfectly valid target for such offer. I'd even say it's more lucrative target than most.

Re: Barcode scanner app on Google Play infects 10M users with one update

#446

Post by usr1106 »

renewiltord wrote: post #388
usr1106 wrote: post #126

Earlier quoted context omitted.

What do you mean by way less reliable? While Google will not start any overly obnoxious ad-serving, who tells you they will not upload all or a bit more stealthily some pictures for some AI user profiling thingie? Cannot happen? They collected WiFi access points when doing Streetview back when their motto was "Don't be evil".

Sometimes it decides that I'm actually searching for pictures of QR codes and gives me Google Search results for similar pictures of QR codes, which is kind of useless. As for the second part, that's your personal risk tolerance so I'm going to leave that to you. Google is generally a high-trust brand in America, so most people will find the risk tolerable. If you don't find it tolerable, you shouldn't use it.

> Google is generally a high-trust brand in America, so most people will find the risk tolerable

Sure, nobody doubts that. Whether the trust is deserved, that's another story.

They scan your email to find out where you traveled and what you bought. I guess most people don't know and many are shocked once they find out.

https://news.ycombinator.com/item?id=19942219

Re: Barcode scanner app on Google Play infects 10M users with one update

#447

Post by BoorishBears »

krageon wrote: post #206
fendy3002 wrote: post #194

Earlier quoted context omitted.

And then the app isn't working anymore due to newer os breaking change Or it suddenly gone from app / play store

If it's gone from the play store that doesn't matter, you have it installed. Breaking OS changes are a problem, it's true. Thankfully they basically never happen on phones (certainly if you have a phone that stopped updates ~4-5 years ago it will still work).

You're on HN. You should say such blatantly false things like

"Thankfully they basically never happen on phones"

There has probably never been a phone OS update that didn't break things. And not in a "technically something broke so haha gotcha! way"

Broken in a "half the apps out there need to be rebuilt with a new SDK version and/or deprecated or there'll be obvious bugs" way

Re: Barcode scanner app on Google Play infects 10M users with one update

#449

Post by netflixandkill »

bjarneh wrote: post #362
jefftk wrote: post #334

Earlier quoted context omitted.

> Why are Google afraid to release a free non-harmful version of those popular apps. They already did; these have both been built-in for years. The flashlight was added in Android 5.0 ( https://www.androidauthority.com/android-5-0-lollipop-offici... I'm having a harder time figuring out when the barcode scanner was added, but my phone does it automatically in the camera app now. (Disclosure: I work for Google, speaki…

> these have both been built-in for years. If Android has a built-in QR scanner now, that must be something that came with Android 11, but September 8 2020 cannot qualify as "for years". It takes a while for OEM's to catch up as well. There are certainly Android phones that ships with this feature (QR-scanner), but stock Android 10 does not. (Google lens != Standard Photo app). If you know about it, you can start "Go…

I even have a pixel3 and forgot Lens existed; the first time I was exposed to it by the phone it looked like yet another Google scans all your stuff and gives you questionable suggestions feature. It never occurred to me it would do something as straightforward as decode QRs.

Re: Barcode scanner app on Google Play infects 10M users with one update

#450

Post by hnick »

duxup wrote: post #415
tcldr wrote: post #413

Earlier quoted context omitted.

This review fraud has got way out of hand. Right now, it would be better to remove reviews entirely and for consumers to make a decision based on the product page alone. The consumer trust in reviews is at such a low that it’s adding friction to purchase decisions and starving honest businesses from being able to invest in quality products. One solution might be to only publish reviews/ratings from accounts with a mi…

Even non fake reviews suck. The sheer scale of situations where the top review is negative describes something that ... is not a bug, is actually supposed to be that way, is how the dang app works by design for good reason ... is bonkers. It seems like reviews are driven by people who don't know, and respond reviews by to people who don't know who describe what sounds like fundamentally broken things... so they give…

To mangle the phrase about politicians: The type of person who feels compelled to leave a review is probably the type of person who should not leave a review.

I've left online reviews a total of maybe 5 times ever. It was only ever to help very small businesses with very few reviews who gave me an exceptional and unexpected result in one way or another.

Post reply on HN