Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware on My Android Phone

beust.com

Post reply on HN
Print view View original

211–220 of 237 posts

Re: Malware on My Android Phone

#211

Post by ladyanita22 »

crossroadsguy wrote: post #207
j1elo wrote: post #69

The lesson here is not "oh look the author is stupid because they installed a shitty QR scanner app and didn't notice the obvious mistake". The lesson should be; even very experienced technical people fall onto the malware trap. We all have day-to-day problems, unexpected stuff happening, in short life doing its thing. We'll inevitably end up being victims of a scam that happens just the worst possible day of them al…

As an iPhone user and an Android developer my lessons learnt, over the time, are: 1. Do not trust Google to vet the apps in the play store. They won't; they don't even try. 2. Those shiny Play Protect and whatnot postured around by Google are practically utter useless bs/bloat 3. Stick to famous, really famous apps from the Play Store - as in well known - e.g. Facebook, Netflix, Evernote etc (you will be tracked of c…

You speak like if you were any kind of authority.

Nowadays anybody can be an Android developer, India is full of teenagers doing it.

Re: Malware on My Android Phone

#212

Post by SAI_Peregrinus »

marcodiego wrote: post #197
SAI_Peregrinus wrote: post #184

Earlier quoted context omitted.

It's not truly safer. It's just smaller, and only has open-source apps. So it's harder to hide malware, but still certainly possible (nobody checks most apps).

It seems much safer. F-droid apps are finely curated open-source apps and anti-features are marked and easily avoidable.

The issue is the "finely curated" statement. It's not a full code review, just "Wherever possible, applications in the repository are built from source, and that source code is checked for potential security or privacy issues. This checking is far from exhaustive though, and there are no guarantees."[1] After an app is added to F-Droid it gets built from source by the F-Droid build servers, but it does not generally get re-reviewed. It's perfectly possible to add the malware after the initial release. It's also possible (even easy) for malware to be missed by the limited code review. F-Droid is a little safer, but that doesn't mean it's particularly safe. It's no harder to get malware on F-droid than it is to get it into Arch or Debian or any other distro repository.

[1] https://f-droid.org/en/about/

Re: Malware on My Android Phone

#213

Post by anonnyj »

I really wish there was more granularity to the permissions. For the vast majority of apps, I don't want them to be able to use the internet. Seems pretty basic (other than the fact that is threatens the whole Ad ecosystem...)

Would be cool too if there was a shared file space for apps... And apps had to stay within that pen. Giving them access to all your phone's files is just wreckless. But I don't have the choice.

Re: Malware on My Android Phone

#214

Post by david_allison »

Schlaefer wrote: post #202
jm_l wrote: post #200

Earlier quoted context omitted.

They mention at the bottom of the article that they did enable side loading, that's how the app was installed.

If that would be the case what is the point of the article? Of course Google Play Protect shouldn't interfere with an side-loaded app. One major reason for side-loading (after giving explicit consent and ignoring all the warnings associated) is to allow applications Google wouldn't approve.

Google Play Protect also warned on unknown sideloaded apps (and requested an upload for a scan) when I tried it ~half a year ago. Documentation[0] implies this is still the case

> It checks your device for potentially harmful apps from other sources. These harmful apps are sometimes called malware.

> If you choose to install apps from unknown sources outside of the Google Play Store, turning on the “Improve harmful app detection” setting will allow Google Play Protect to send unknown apps to Google to protect you from harmful apps.

[0] https://support.google.com/googleplay/answer/2812853?hl=en

Re: Malware on My Android Phone

#215

Post by maxmalysh »

ladyanita22 wrote: post #211
crossroadsguy wrote: post #207

Earlier quoted context omitted.

As an iPhone user and an Android developer my lessons learnt, over the time, are: 1. Do not trust Google to vet the apps in the play store. They won't; they don't even try. 2. Those shiny Play Protect and whatnot postured around by Google are practically utter useless bs/bloat 3. Stick to famous, really famous apps from the Play Store - as in well known - e.g. Facebook, Netflix, Evernote etc (you will be tracked of c…

You speak like if you were any kind of authority. Nowadays anybody can be an Android developer, India is full of teenagers doing it.

http://www.paulgraham.com/disagree.html

Re: Malware on My Android Phone

#216

Post by andrepd »

pw6hv wrote: post #3

A QR code reader was the problem then... I am an Android user since the dawn of time and I was so surprised when my wife showed me that on her iPhone the QR code reader is embedded in her camera app... I wonder why it is not the same in any version of Android that I have used (now I am on Android One). This plus the native support for CardDav and CalDav are pushing me to try iOS next time I have to change my phone.

Simply get something from fdroid.

Re: Malware on My Android Phone

#217

Post by drcongo »

j1elo wrote: post #69

The lesson here is not "oh look the author is stupid because they installed a shitty QR scanner app and didn't notice the obvious mistake". The lesson should be; even very experienced technical people fall onto the malware trap. We all have day-to-day problems, unexpected stuff happening, in short life doing its thing. We'll inevitably end up being victims of a scam that happens just the worst possible day of them al…

My takeaway from this post is never use Android. Not that I ever would.

Re: Malware on My Android Phone

#218

Post by rxhernandez »

ladyanita22 wrote: post #211
crossroadsguy wrote: post #207

Earlier quoted context omitted.

As an iPhone user and an Android developer my lessons learnt, over the time, are: 1. Do not trust Google to vet the apps in the play store. They won't; they don't even try. 2. Those shiny Play Protect and whatnot postured around by Google are practically utter useless bs/bloat 3. Stick to famous, really famous apps from the Play Store - as in well known - e.g. Facebook, Netflix, Evernote etc (you will be tracked of c…

You speak like if you were any kind of authority. Nowadays anybody can be an Android developer, India is full of teenagers doing it.

I was a teenager doing Android Development in 2010. What difference does age make in this discussion?

Re: Malware on My Android Phone

#219

Post by splonk »

Cyykratahk wrote: post #151
georgyo wrote: post #62

Earlier quoted context omitted.

I've been using this one since the Android 1.0: https://play.google.com/store/apps/details?id=com.google.zxi... What's interesting, is that despite the app not being updated since 2018, open source, and containing no ads or tracking the reviews are saying it recently became adware. Searching for barcode scanner in the app store brings you to a horrible sea of ad supported crap ware, and it seems like that crap ware w…

Yeah, something's fishy. I scraped the latest 1000 reviews (coincidentally almost exactly 12 months worth). The "adware" reviews are all very recent with large amounts of votes. They seem to start on December 18, with 162 1-star reviews in the following 25 days -- more than all the 1-star reviews in the 6 months prior. I wouldn't be surprised if these reviews are not only automated spam, but are constantly being dele…

The malware app was also called "barcode scanner", published by "the space team", so it wouldn't surprise me if a lot of people just found the more popular zxing app on the store and left reviews in the wrong place. I had the malware version installed and went through the same process Cedric did to find out that an update they pushed around that time turned on the bad behavior.

Re: Malware on My Android Phone

#220

Post by gruez »

userbinator wrote: post #169
goldcd wrote: post #140

Earlier quoted context omitted.

Yes - it's very easy to do a factory reset on your phone. No - There is no 'easy' way to store/restore the entire phone as I believe Apple does. (I had a miserable day doing this, when my old Pixel started playing up and had to migrate across to a replacement) - and this was best case when I had the two phones next to each other. Core 'google' stuff seems fine - either all tied to your account (e.g. contacts) or goog…

Older Mediatek platform phones let you read/write the entire internal flash (eMMC) directly, which is AFAIK the full extent of persistent writable storage. That is the true "factory reset", as it's how they were first loaded with software in production. I believe the more widely-known and generic Android reset is merely restoring from an internal partition.

AFAIK since android uses read-only system partition, there's nothing to restore. It just wipes the data partition and that's it.
Post reply on HN