Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Barcode scanner app on Google Play infects 10M users with one update

blog.malwarebytes.com

Post reply on HN
Print view View original

21–30 of 465 posts

Re: Barcode scanner app on Google Play infects 10M users with one update

#21

Post by mcpeepants »

marcinzm wrote: post #12

Thinking about it, Apple seems like they'd have better dealt with this sort of issue in four ways: * Stricter review process to catch this preemptively * Stricter app isolation to limit impact without a vulnerability explicit * Longer maintained and more forceful operating system updates to minimize the number of phones running with known exploits * Likely removing/disabling app from phones and not just the app store

I think you mean Google, but also noting that #4 is possible (supposedly) through Google Play Protect

Re: Barcode scanner app on Google Play infects 10M users with one update

#22

Post by [deleted] »

lvs wrote: post #6

The OG Barcode Scanner app is getting absolutely throttled with negative reviews. But this posting seems to be about a clone app by a different developer. https://en.wikipedia.org/wiki/Barcode_Scanner_(application) https://play.google.com/store/apps/details?id=com.google.zxi...

[deleted]

Re: Barcode scanner app on Google Play infects 10M users with one update

#24

Post by userbinator »

IgorBog61650384 wrote: post #11
ravenstine wrote: post #5

This is precisely why I have auto-updates turned off. No minor security or bug updates are worth getting an all-out infection(or unexpectedly losing features).

How do you decide when it is safe to update?

The short answer is "when the benefits outweigh the risks"; i.e. if there's a huge bugfix or new feature you need, but something like a barcode scanner is something whose change frequency should be very close to zero.

The "update culture" has unfortunately trained users to obediently "bend over and take it", which is horrible from both the security and change-management point of view; but is the dream of those who want to exert control over "the sheeple".

Re: Barcode scanner app on Google Play infects 10M users with one update

#25

Post by [deleted] »

lvs wrote: post #6

The OG Barcode Scanner app is getting absolutely throttled with negative reviews. But this posting seems to be about a clone app by a different developer. https://en.wikipedia.org/wiki/Barcode_Scanner_(application) https://play.google.com/store/apps/details?id=com.google.zxi...

[deleted]

Re: Barcode scanner app on Google Play infects 10M users with one update

#26

Post by swiley »

marcinzm wrote: post #12

Thinking about it, Apple seems like they'd have better dealt with this sort of issue in four ways: * Stricter review process to catch this preemptively * Stricter app isolation to limit impact without a vulnerability explicit * Longer maintained and more forceful operating system updates to minimize the number of phones running with known exploits * Likely removing/disabling app from phones and not just the app store

Stuff like this happens on iOS all the time and everyone just ignores it because it's mostly sandboxed. Apple is terrible at stopping malware until it ends up in the news.

Re: Barcode scanner app on Google Play infects 10M users with one update

#27

Post by bigiain »

lvs wrote: post #6

The OG Barcode Scanner app is getting absolutely throttled with negative reviews. But this posting seems to be about a clone app by a different developer. https://en.wikipedia.org/wiki/Barcode_Scanner_(application) https://play.google.com/store/apps/details?id=com.google.zxi...

I wonder if there's a coordinated effort to exploit barcode reader apps, because (at least where I'm from) its becoming a government mandated Covid tracing thing to use a QR code to "check in" to certain classes of businesses/venues?

I bet there's a _huge_ increase in use of QR code scanning apps compared to this the last year...

Re: Barcode scanner app on Google Play infects 10M users with one update

#28

Post by lstamour »

the_only_law wrote: post #17
est31 wrote: post #15

I don't get why no barcode scanner app is shipped with Android. It's such a basic functionality. Edit: apparently it IS shipped on iOS and at least my Lineage OS default camera app has a QR code reader too.

I don’t think my past two phones (one Android, one iOS) have built in QR scanning, or at least it’s not very discoverable. No fun to have to find something in an App Store when it all looks like 7 year old malware.

On iOS, you can use the Camera app on your iPhone or enable the Code Scanner button on the Control Panel: https://support.apple.com/en-ca/guide/iphone/iphe8bda8762/io...

It would be interesting if Apple added support articles or how-to videos for built-in features to their App Store search results though…

Re: Barcode scanner app on Google Play infects 10M users with one update

#29

Post by rwh86 »

lvs wrote: post #6

The OG Barcode Scanner app is getting absolutely throttled with negative reviews. But this posting seems to be about a clone app by a different developer. https://en.wikipedia.org/wiki/Barcode_Scanner_(application) https://play.google.com/store/apps/details?id=com.google.zxi...

My phone was affected by this, and I can confirm I had the original barcode scanner app in your first link installed, and I'd had it installed for years.

I now use Google Lens through the default phone app.

Re: Barcode scanner app on Google Play infects 10M users with one update

#30

Post by ntSean »

userbinator wrote: post #24
IgorBog61650384 wrote: post #11

Earlier quoted context omitted.

How do you decide when it is safe to update?

The short answer is "when the benefits outweigh the risks"; i.e. if there's a huge bugfix or new feature you need, but something like a barcode scanner is something whose change frequency should be very close to zero. The "update culture" has unfortunately trained users to obediently "bend over and take it", which is horrible from both the security and change-management point of view; but is the dream of those who wa…

Your dogmatic approach to updating would prevent you from installing a version _without_ malware attached. For example, a version of Xcode circulated in China was infected with malware and once Apple had detected it, they asked all developers to recompile and update their apps immediately.

https://www.zdnet.com/article/how-malware-finally-infected-a...

With your attitude, you wouldn't have necessarily seen the efficacy in updating the apps and could still be infected to this day.

Post reply on HN