Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware on My Android Phone

beust.com

Post reply on HN
Print view View original

131–140 of 237 posts

Re: Malware on My Android Phone

#131

Post by Daho0n »

oefrha wrote: post #56
pw6hv wrote: post #3

A QR code reader was the problem then... I am an Android user since the dawn of time and I was so surprised when my wife showed me that on her iPhone the QR code reader is embedded in her camera app... I wonder why it is not the same in any version of Android that I have used (now I am on Android One). This plus the native support for CardDav and CalDav are pushing me to try iOS next time I have to change my phone.

> on her iPhone the QR code reader is embedded in her camera app... I wonder why it is not the same in any version of Android that I have used Apple added a builtin QR code scanner to the camera app in iOS 11 due to the ridiculously widespread use of QR codes in China.[1] I guess (Google's version of) Android doesn't have that because Google doesn't derive much value from that market, and QR codes don't have as much…

Android has had a buil-in QR scanner for years. Looking in this thread at least OnePlus, Pixel, Motorola and Samsung has it in the default app. As far as I know it is part of android.

Re: Malware on My Android Phone

#132

Post by Daho0n »

Tokelin wrote: post #41
qu-everything wrote: post #30

Earlier quoted context omitted.

I just tried with my Samsung s9+ and the camera app picked up the qr code, don't know what you are saying

That's specific to the default Samsung Camera app.

It is in moto, pixel, oneplus, xiaomi, huwaei too. Likely default to Android 9+

Re: Malware on My Android Phone

#133

Post by Daho0n »

cam_l wrote: post #120
pw6hv wrote: post #3

A QR code reader was the problem then... I am an Android user since the dawn of time and I was so surprised when my wife showed me that on her iPhone the QR code reader is embedded in her camera app... I wonder why it is not the same in any version of Android that I have used (now I am on Android One). This plus the native support for CardDav and CalDav are pushing me to try iOS next time I have to change my phone.

After going through dozens of QR code scanners trying to find one that is open source and trustworthy enough looking to install, i realised there is just one right there in Firefox.

And in the default camera app.

Re: Malware on My Android Phone

#134

Post by EE84M3i »

timdaub wrote: post #92
EE84M3i wrote: post #82

Earlier quoted context omitted.

> The code is open source too: https://github.com/TimDaub/scan.lol Am I missing something or does your repo only contain the minified version of the javascript, and not contain the `index.js` referenced in the `package.json` nor the method to build to minified artifacts? This seems like it's not open source.

Hey, thanks for pointing that out. Rest assured, the site is 100% open source as I'm simply publishing the repo using GitHub Pages. There's no build step. Regarding package.json's main file: It's a mistake. I did not update it properly after I did `npm init`.

Where does https://github.com/TimDaub/scan.lol/blob/master/qr-scanner-w... come from then?

Re: Malware on My Android Phone

#135

Post by Daho0n »

varenc wrote: post #38
sloshnmosh wrote: post #27

Earlier quoted context omitted.

What I believe the author is saying is that he received a push notification to chrome from the malicious app. Coincidentally, I just spent my Saturday evening pouring over malicious JavaScript hosted on Cloudfront that does extensive browser fingerprinting and if a match is made to an Android device a fake Captcha pops up in Chrome which actually enables push notifications and from there a full screen pop-up appears…

> fake Captcha pops up in Chrome which actually enables push notifications Wow, this sounds like a classic clickjacking vulnerability. That’s still possible on modern[ish] Android? Definitely interested in your write up.

No, it is not.

Re: Malware on My Android Phone

#137

Post by Daho0n »

throwawaysea wrote: post #14

Scary. Is there such a thing as a malware scanner on Android? Are they effective or worthwhile at all? Why isn't Apple susceptible to this type of malware, seemingly?

A malware scanner won't find an app that you gave permission to show on-top on other apps and use this to show ads. It is not doing anything it isn't allowed to do.

Re: Malware on My Android Phone

#138

Post by Daho0n »

bzb6 wrote: post #111

It’s a joke that this happened. And even worse that he considered installing “malwarebytes”, one of those things that smell of windows 98 shareware, to fix it. This is why I buy iPhone.

If you install an app on iPhone that is allowed to make pop-ups and it shows ads in those pop-ups you get the same situation as here. This wasn't malware as it couldn't access anything except itself.

Re: Malware on My Android Phone

#139

Post by Daho0n »

Causality1 wrote: post #98

Can you explain how you managed to install malware while unlocking your bootloader? The only two methods for unlocking I've ever used are OEM applications like Odin for older phones and simple ADB commands for newer ones, neither of which put you at particular danger from malware.

He didn't. It was just an app that was updated and started showing ads. Not malware as it cannot access anything but still annoying.

Re: Malware on My Android Phone

#140

Post by goldcd »

Shivetya wrote: post #119
3pt14159 wrote: post #99

Earlier quoted context omitted.

I took away another lesson: One of the early developers of Android doesn't replace his phone even after being absolutely certain it had malware. That kinda blows my mind.

I do not use an Android phone, is there an easy means to restore one to factory condition? Is there a simple process to save and restore your phone to your PC/Mac similar to how Apple does it? (my father has an android phone and now I suddenly find myself curious about save/restore and how to find malware on his phone)

Yes - it's very easy to do a factory reset on your phone.

No - There is no 'easy' way to store/restore the entire phone as I believe Apple does. (I had a miserable day doing this, when my old Pixel started playing up and had to migrate across to a replacement) - and this was best case when I had the two phones next to each other.

Core 'google' stuff seems fine - either all tied to your account (e.g. contacts) or google app data (texts, pictures etc) which can be backed up to cloud, or directly migrated between phones.

What doesn't work is the logins/settings for all the random apps. Some do store on cloud. Some allow manual export/import of settings. Some you're going to have to setup again from scratch.

Back in the day when I did root my phone, TWRP and similar things let you image/restore the whole phone.

Post reply on HN