Hacker News Reader

Comment by GordonS | Hacker News Reader

For the past few days I've been seen spam events in my calendar about "free iPhones" and "webcam girls" - I couldn't figure out where they were coming from. I have CamScanner installed, so presumably that's the source...

Now, I can remove CamScanner (which is a shame, it's a really good app), but how can I ensure the trojan is also removed?

I tried the Avast AntiVirus app, but it didn't find anything.

What does everyone else do for AV on Android?

View on HN

Apparently calendar invite spam is on the rise, and CamScanner might not be related. See https://www.theverge.com/2019/8/23/20829615/google-calendar-...

The calendar thing is probably this: https://lifehacker.com/how-to-prevent-spammers-from-infiltra...

check your emails

I got hit by this exact one(free iphone X) recently, and couldn't find anything in my email.

Surely, that kind of email would just look like spam, so isn't the correct solution for google to just not auto-add calendar events if their source email is spam?

Yep, my wife got exactly the same thing. Apparently those entries will appear in your calendar even if the email was sent to spam. You have to configure gmail to not automatically add the entries.

This seems like a pretty big oversight on Gmail's part.

No, it wasn't that - I had the auto invite setting turned off already, and I didn't have any emails that matched the calendar entries.

I was fairly sure it must be malware, but I had no idea how to find out which app it was. I tried Avast AntiVirus, but it found nothing. After finding out about CamScanner I tried Kapersky AV, which did flag CamScanner as malware.

> how can I ensure the trojan is also removed?

The trojan is inside the app. Remove the app, and you remove the trojan.

Is this a solid guarantee? Usually on Windows a Trojan replicates itself outside of the main application it was installed through.

I think it would have to exploit a vulnerability in Android’s sandboxing mechanism (not hard considering how many people can’t or don’t update) to be able to become separate from its parent application. Win32 doesn’t do any kind of app sandboxing at all.

AVs for Android are themselves a privacy nightmare. You need to grant them all sorts of permissions and their privacy policies, oft times, leaves a lot to be desired. That said, Malwarebytes is decent, and so are some other offerings, but I wouldn't recommend using any.

Here's basic steps you can follow:

1. Uninstall apps you don't use.

2. Firewall apps that do not require internet access to function (Calculator, CamScanner, Alarm Clock etc)

3. Block trackers and ads (use pi-hole and set private-dns).

4. Remove permissions from apps that do not really require the permission (Bank apps with all sorts of permissions).

5. Disable notification for apps that do not really need to notify you of anything at all (most games).

6. Install apps you're not comfortable using in work-profile, or in a privacy friendly app-sandbox (parallel-space started as one, but alas, aren't privacy-friendly anymore).

Most antivirus software on Android is more like malware itself. You’re better off only using applications from F-Droid, very carefully vetting everything yourself, or not using Android. The Android security model is getting better, but it’s still really broken compared to anything on iOS.

Try Sophos Mobile Security

https://play.google.com/store/apps/details?id=com.sophos.sms...

Reply on news.ycombinator.com