Live data from Hacker News

Barcode scanner app on Google Play infects 10M users with one update

blog.malwarebytes.com

201–210 of 465 posts

Re: Barcode scanner app on Google Play infects 10M users with one update

#201
The developer's street address, as shown in the malwarebytes screenshot, is obviously either incomplete or bogus. There's no city or country, and a weird unit number. Is Google Play really approving apps from such dubious sources?

Or does Google have the full address? Seems unlikely

Re: Barcode scanner app on Google Play infects 10M users with one update

#202
post #41

Earlier quoted context omitted.

Stallman is almost always right but nothing he says is particularly surprising or useful. Yes auto updates allow delivery of malware but its not like manual updating was any better. No user was auditing changes before hitting the update.

Give a user a choice though, and they dismiss the update notification because it's naggy and annoying and usually involves restarting your app or OS (I'm mainly thinking of operating systems here). Microsoft went in hard / aggressively and are forcing update installs and restarts, which IMO is going the wrong direction. Wasn't there a Linux project where they could update the OS / kernel without a restart? I feel lik…

> update the OS / kernel without a restart

https://wiki.archlinux.org/index.php/Kernel_live_patching

Re: Barcode scanner app on Google Play infects 10M users with one update

#203
post #31

The only reason this was detected was very overt behavior - opening AD popups. So I guesstimate for each one of these we have 10 that go undetected. This means the whole ecosystem is broken, as there is no reason this will happen only for updates and not for new apps as well. Apple's ecosystem is somewhat better, but I can't imagine they go through every line of code in each package, so most of their review is probab…

This happened on ios for me years ago. I had two apps that radically changed their business model (owner?) through updates with no recourse. I had an app called gas cubby, which let me locally - on the phone - keep track of all my vehicles. I could enter detailed information about each car such as year, make, model, vin, insurance policy, gas purchases, oil changes and the like. It would tell you gas mileage and remi…

I gave Slacker Radio the big heave-ho when they decided they wanted to help themselves to my contact list. They did that just before I was about to pony up for a paid subscription. Bullet dodged.

Re: Barcode scanner app on Google Play infects 10M users with one update

#204

Earlier quoted context omitted.

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…

> To make matters worse, scanning a barcode when you enter a store/cafe (to register your location), is now begin done everywhere in order to track potential covid19 spreaders. This forces anyone without an iPhone to install at least one of these potentially harmful apps. Our (New Zealand) Covid tracing app scans QR codes itself. What jurisdictions are requiring to scan an arbitrary QR code using random apps? https:/…

Is there anything you guys in New Zealand haven't done better during this pandemic? :-)

Re: Barcode scanner app on Google Play infects 10M users with one update

#205

Earlier quoted context omitted.

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…

It is 2021 and Android still doesn't have a QR code scanner by default.

Google lens does it, is it not part of stock android? My phone runs Android One, so I think it's all stock but I could've missed a subtlety.

Re: Barcode scanner app on Google Play infects 10M users with one update

#206

Earlier quoted context omitted.

Most apps never need to be updated, problem solved. Especially stuff like barcode scanners, authenticator apps and other apps that I'd call phone infrastructure can just be static from the time of install.

And then the app isn't working anymore due to newer os breaking change Or it suddenly gone from app / play store

If it's gone from the play store that doesn't matter, you have it installed.

Breaking OS changes are a problem, it's true. Thankfully they basically never happen on phones (certainly if you have a phone that stopped updates ~4-5 years ago it will still work).

Re: Barcode scanner app on Google Play infects 10M users with one update

#207

Earlier quoted context omitted.

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…

> To make matters worse, scanning a barcode when you enter a store/cafe (to register your location), is now begin done everywhere in order to track potential covid19 spreaders. This forces anyone without an iPhone to install at least one of these potentially harmful apps. Our (New Zealand) Covid tracing app scans QR codes itself. What jurisdictions are requiring to scan an arbitrary QR code using random apps? https:/…

I recall back in the early days (before NZ Covid Tracer was released) we had the same system where every shop had a QR code that linked to its own guestbook type website.

Re: Barcode scanner app on Google Play infects 10M users with one update

#208
post #41

Earlier quoted context omitted.

Stallman is almost always right but nothing he says is particularly surprising or useful. Yes auto updates allow delivery of malware but its not like manual updating was any better. No user was auditing changes before hitting the update.

Give a user a choice though, and they dismiss the update notification because it's naggy and annoying and usually involves restarting your app or OS (I'm mainly thinking of operating systems here). Microsoft went in hard / aggressively and are forcing update installs and restarts, which IMO is going the wrong direction. Wasn't there a Linux project where they could update the OS / kernel without a restart? I feel lik…

Windows is in an even worse position because of NTFS file locking shenanigans. A lot of the time you can't even update the userspace without rebooting.

Re: Barcode scanner app on Google Play infects 10M users with one update

#209
Most apps on Android behave like a malware. The most annoying ones are those who randomly take over the screen and play ads with annoying music and you have no way to close it quickly and you don't know which app is displaying those. Only solutions so far is to actually disable apps one by one and see if the problem appear. I think Google should remove all apps that do that. My friend's phone who is not IT literate, essentially looks as the IE6 back in the day.

Re: Barcode scanner app on Google Play infects 10M users with one update

#210

Earlier quoted context omitted.

> Apps that offer what should have been offered by the OS vendor in the first place. This is really it. The Google/Android team have already made the "Zebra" library that actually reads barcodes; why on earth do they not include this as a standard app. Instead we get this myriad of different barcode scanner apps with all sorts of harmful features. All the heavy lifting is done by the Android team anyway (the actual b…

> To make matters worse, scanning a barcode when you enter a store/cafe (to register your location), is now begin done everywhere in order to track potential covid19 spreaders. This forces anyone without an iPhone to install at least one of these potentially harmful apps. Our (New Zealand) Covid tracing app scans QR codes itself. What jurisdictions are requiring to scan an arbitrary QR code using random apps? https:/…

[deleted]
Post reply on HN