Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware on My Android Phone

beust.com

Post reply on HN
Print view View original

91–100 of 237 posts

Re: Malware on My Android Phone

#91

Post by ignitionmonkey »

climb_stealth wrote: post #75
slezyr wrote: post #49

Earlier quoted context omitted.

Or anything from FDroid. I use Barcode Scanner ( https://f-droid.org/en/packages/com.google.zxing.client.andr... ) as it scans even damaged codes.

I feel like this is a good example of how difficult it is to find a good barcode scanner. It mentions permissions for contacts and full network access. I would have thought that those two permissions should not be necessary for a barcode scanner and point toward something dodgy going on.

It's actually not that difficult. F-Droid has a few offline scanners. It depends of course on how much of your experience you want automated. Though it would be nice if Android let you control the more granular permissions like network access.

https://f-droid.org/en/packages/com.secuso.privacyFriendlyCo...

https://f-droid.org/en/packages/de.t_dankworth.secscanqr/

Re: Malware on My Android Phone

#92

Post by timdaub »

EE84M3i wrote: post #82
timdaub wrote: post #40

FYI: I created a website that quickly scans QR codes so that you won't have to download or open any ads-filled QR code apps anymore: - https://scan.lol The code is open source too: https://github.com/TimDaub/scan.lol

> The code is open source too: https://github.com/TimDaub/scan.lol Am I missing something or does your repo only contain the minified version of the javascript, and not contain the `index.js` referenced in the `package.json` nor the method to build to minified artifacts? This seems like it's not open source.

Hey,

thanks for pointing that out. Rest assured, the site is 100% open source as I'm simply publishing the repo using GitHub Pages. There's no build step.

Regarding package.json's main file: It's a mistake. I did not update it properly after I did `npm init`.

Re: Malware on My Android Phone

#93

Post by ciceryadam »

Sander_Marechal wrote: post #10
pw6hv wrote: post #3

A QR code reader was the problem then... I am an Android user since the dawn of time and I was so surprised when my wife showed me that on her iPhone the QR code reader is embedded in her camera app... I wonder why it is not the same in any version of Android that I have used (now I am on Android One). This plus the native support for CardDav and CalDav are pushing me to try iOS next time I have to change my phone.

I have a Pixel 2. It scans QR codes with the default camera app just fine. When it detects a QR code you get a little popup you can click. It even works with regular 1D barcodes.

Same here with a semi-recent Motorola One Zoom

Re: Malware on My Android Phone

#94

Post by pja »

rozab wrote: post #42
oakwhiz wrote: post #33

Earlier quoted context omitted.

I was going to recommend the open source "Barcode Scanner" app also known as "zxing" on GitHub. However when looking at the app's page, I noticed that someone seems to be engaging in some kind of review-bombing with that app. There are tons of reviews claiming that it was recently updated and has highly intrusive full page popup ads. But looking at the version info, the app hasn't seen an update for over 2 years and…

If you say "OK Google, scan a QR code", it opens up Google Lens which does the job but only seems to be accessible through voice on my device

On my Android phone if you open the camera App there's a Google Lens icon at top left next to the menu hamburger icon.

Re: Malware on My Android Phone

#95

Post by dbrgn »

prof18 wrote: post #13
pw6hv wrote: post #3

A QR code reader was the problem then... I am an Android user since the dawn of time and I was so surprised when my wife showed me that on her iPhone the QR code reader is embedded in her camera app... I wonder why it is not the same in any version of Android that I have used (now I am on Android One). This plus the native support for CardDav and CalDav are pushing me to try iOS next time I have to change my phone.

QR Reader are load of everything. I went mad to find one a decent one for my parents’ android phone and apparently it doesn’t exists. So in a weekend I’ve created one without any kind of tracking, ads, permission, whatever. Here it is if you guys need one -> https://play.google.com/store/apps/details?id=com.prof18.sec...

Just wondering: Since you're using zxing library, why not go for the zxing barcode scanner directly? https://play.google.com/store/apps/details?id=com.google.zxi...

Another option would be to use Google's MLKit. I think they've added support for scanning QR codes in there. It requires Google Play Services though, which is not ideal.

Re: Malware on My Android Phone

#96

Post by jedimastert »

pw6hv wrote: post #3

A QR code reader was the problem then... I am an Android user since the dawn of time and I was so surprised when my wife showed me that on her iPhone the QR code reader is embedded in her camera app... I wonder why it is not the same in any version of Android that I have used (now I am on Android One). This plus the native support for CardDav and CalDav are pushing me to try iOS next time I have to change my phone.

There is native support now with Lens, although I agree it's kinda nutty that it took so long.

Re: Malware on My Android Phone

#97

Post by tallanvor »

georgyo wrote: post #62
prof18 wrote: post #13

Earlier quoted context omitted.

QR Reader are load of everything. I went mad to find one a decent one for my parents’ android phone and apparently it doesn’t exists. So in a weekend I’ve created one without any kind of tracking, ads, permission, whatever. Here it is if you guys need one -> https://play.google.com/store/apps/details?id=com.prof18.sec...

I've been using this one since the Android 1.0: https://play.google.com/store/apps/details?id=com.google.zxi... What's interesting, is that despite the app not being updated since 2018, open source, and containing no ads or tracking the reviews are saying it recently became adware. Searching for barcode scanner in the app store brings you to a horrible sea of ad supported crap ware, and it seems like that crap ware w…

Either it's a campaign to try and lower the ratings or a bunch of people have managed to get separately installed malware and thought this was the cause.

The last update I see available is what I have installed - 4.7.8 from September 2018. Definitely no strange behavior from it.

Re: Malware on My Android Phone

#98

Post by Causality1 »

Can you explain how you managed to install malware while unlocking your bootloader? The only two methods for unlocking I've ever used are OEM applications like Odin for older phones and simple ADB commands for newer ones, neither of which put you at particular danger from malware.

Re: Malware on My Android Phone

#99

Post by 3pt14159 »

j1elo wrote: post #69

The lesson here is not "oh look the author is stupid because they installed a shitty QR scanner app and didn't notice the obvious mistake". The lesson should be; even very experienced technical people fall onto the malware trap. We all have day-to-day problems, unexpected stuff happening, in short life doing its thing. We'll inevitably end up being victims of a scam that happens just the worst possible day of them al…

I took away another lesson: One of the early developers of Android doesn't replace his phone even after being absolutely certain it had malware.

That kinda blows my mind.

Re: Malware on My Android Phone

#100

Post by Daniel_sk »

simonmales wrote: post #89
hadrien01 wrote: post #64

Earlier quoted context omitted.

You can use AuroraStore from F-Droid, it allows you to download apps from the Play Store without a Google account.

Nice tip!

It will probably be not good enough, many banking apps are using Google Safety Net to detect rooted or not Google certified devices with Google Play installed indirectly. AFAIK it's now quite difficult to break. I sort of understand the bank decision on this. There is a lot of malware on Android and users are easily tricked into installing some side-loaded APKs, and there is also a lot of hidden malware on Google Play which is hard to find (e.g. it downloads a payload after the store review is done). This would be a disaster since on Android you can for example use accessibility services to read any input from the user and also control the device. So you can circumvent 2FA and make transactions on behalf of the user on the device. There has been a lot banking malware on Google Play. I think they are getting it a bit under control now, but it's still very dangerous.
Post reply on HN