Barcode scanner app on Google Play infects 10M users with one update

I mean, I could very well make an open source app and then load some malware in the apk in addition to the well behaved thing... Are they immune from this attack?

But it's still not stabilized, society has not yet found out how to deal with all this.

It's like when there were no speed limits for cars or standard signage. There was more freedom but it was way more dangerous and unpredictable and also as a result, not yet as useful as it could be.

It's not necessarily anybody's fault. A company like Google maybe sees itself as a company but it's way past that. It really provides quite essential platforms for people, families, cities, you name it. And also the platform for content creators and developers and businesses. Many of these don't have a proper contract with the platform. It doesn't scale to have lawyers to be involved in every point to point dealing either.

My assumption is that there is going to be maturation of these platforms, common rules and terms. Governments and WTO could be involved.

https://play.google.com/store/apps/details?id=com.srowen.bs....

The sheer scale of situations where the top review is negative describes something that ... is not a bug, is actually supposed to be that way, is how the dang app works by design for good reason ... is bonkers.

It seems like reviews are driven by people who don't know, and respond reviews by to people who don't know who describe what sounds like fundamentally broken things... so they give it a thumbs up and they're both completely ignorant.

The volume of people who do know the app and would see / write a review seems like it is MUCH smaller.

I had a game app update recently. I went to update it (one of the few times I go directly to the play store app). There at the top is a review that described how they saw opposing players "just disappear" during the game and raged about that 'bug'. But it's not a bug the game has some fog of war and view distance type mechanic. It's entirely expected / appropriate.... but there it is the top review.

When people don't know why Google banned their 15 year accounts I wonder if it's not from innocent stuff like this.

Anybody complaining about app stores has forgotten how bad the alternatives are. And community-maintained repositories aren't a solution, that's just the app store model but on a smaller scale so it's less of a Target for bad actors. If ubuntu's universe repo had to suffer the same amount of abuse as the play store does, it would crumble in a day.

It is just 'protection'.

https://play.google.com/store/apps/details?id=com.robinhood....

I heard from a friend that iOS has TOTP and indeed a barcode scanner build in, same goes for cal/carddav. To be fair, my wife's Pocophone also comes up with a QR-code icon when the cam detects a QR code. And, FireFox for mobile has a QC code scanner build in (although since I now have to open a new tab for each new page and I end up with many many tabs of the same 4 websites I find myself using FF less and less).

Maybe the experience on Pixel Phones is better? GCam makes a lot of difference in many aspects.

Platform providers are also criticized when natively offering features that apps offer. You sort of can't win.

Our (New Zealand) Covid tracing app scans QR codes itself. What jurisdictions are requiring to scan an arbitrary QR code using random apps?

https://www.health.govt.nz/our-work/diseases-and-conditions/...

Imagine you are an app developer of a really simple app that takes a number and tells you if that number is in a valid phone format or not. You have a textbox, the user enters it, you do the checking and display the result. Easy. Now imagine you want to allow scanning a qr which contains a number, to do the checking afterwards. You need to either ask your users to use an external app to scan and then open yours, include all the qr related library inside yours, or use a special intent from a third party app (that the users need to have already installed).

First solution is slow and inconvenience for users, the second is what almost all apps do, but then the code logic is duplicated on all of them (with the increment in app size). The third option is the best, both for the developer and for the user, however there is no official qr service so in the end this is basically option 1.

I mean, you already have a service to get a picture, a file and a contact, among others (you don't need to include all the code, simply do a call to the respective intent and wait for the result) so why don't extend this with the qr too?

When we sit down they just say, "use your camera app to scan the barcode". It seemed to work for everyone at the table. Samsung, Pixel, and iPhone.

Also FM Radio, screen recorder and IR remote control.

what do you recon would be included?

- barcode scanner, - auth app, - calculator of some kind, - wifi management, dns/network/firewall management.

I think Apple have the right idea with app review on browser extensions for Safari.

Chrome used to. You used to be able to just download the source code of an extension, point Chrome at it, and done you are.

Well, you still can. But Chrome will CONSTANTLY nag you about it and try to forget you added that extension using source, like it's some vile crime.

They removed it because of "security", which is a hilarious reason because it just made everything so much worse.

That's to say:

(a) The time for a given barcode to be accurately detected varies considerably from app to app.

(b) And various apps have different detection capabilities with respect to one another (i.e.: the detection performance varies from app to app depending on the contrast across the barcode image, camera focus or lack thereof, etc.).

(c) For a given app, the detection capability for different types of barcode scans can vary considerably.

For that reason, I have five different QR scanners installed including SecScanQR that you've mentioned and the one with the same namesake as mentioned in this Malwarebytes article.

It seems there's a great deal of variability in the detection algorithms between apps. Unfortunately, from my experience I've found that some of the commercial apps have better detection performance than those on F-Droid—but granted that's only from my limited testing. Which app I use sometimes depends on other features, for instance, the fact that it has a better database or export ability, etc. is more important than the fact that it's insensitive in the detection department.

I wish someone with more knowledge and experience could give others and me the good oil on this. Reckon it'd save us considerable time experimenting.

I'm very happy with it

Recently Google Authenticator app added the ability to move all codes to next phone by displaying multiple sequence of QR codes, but I coded a simple no internet just local storage & javascript app to to utilize otpauth:// protocol to eadily readd the codes on new phone https://spa.bydav.in/otp.html

And why stop here? We should open the market for TCP implementations. The status quo is anti-competitive and stifles innovation!

Or it suddenly gone from app / play store

Dear HenryBemis,

As a CEO of TRC, I would like to extend you an offer to purchase source and distribution rights to your app, SummerChildAuthenticator, to the form of $500,000 (five hundred thousand US dollars). We are a fast growing SV startup that wants to make it easier for people to secure their papers and money on-line. We have developed a streamlined, easy-to-use, user interface for authenticator applications and are looking for a way to quickly put it in front of a wide audience. We believe that your SummerChildAuthenticator, with its established base of over 50 000 users, is the gateway we are looking for.

If you are interested in this offer, please reply to this e-mail.

Sincerely yours,

TeMPOraL, CEO, TRC

<smallfont>Temporal's Rackets and Cons is a startup registered in Southern Vescillo, Arstotzka.</smallfont>

--

You think to yourself: "this is a good deal! The app is unlikely to grow more, it isn't making you any money anyway. Here is this hot new startup with great ideas, what's the worst that could happen? They'll just inject an ad here and there. Meanwhile, I have medical expenses, and..."

So you agree, and I take your app, and run a "growth hacking" campaign on Reddit to blow its userbase up to 500 000 people, and then proceed with my main business plan, which is selling access to OTP codes to the mob running phishing scams.

(Oh, dear reader, you've noticed Arstotzka and thought I'll be selling data to evil government? Nope, we registered there only because it'll make it mighty hard for anyone to sue us.)

And a lot of reputable software companies have sold out to peddling adware. Adobe is one, and there are a lot of others. Abandoned shareware or open source often resurface with adware installers.

I yes, I too rememeber the FirefoxOS. Good times.

I suppose I should be grateful that I can turn off a lot of permissions for apps at all these days, unlike the malware built into recent versions of the major desktop operating systems. :-(

A while back, I was approached by a [NATION OBFUSCATED] developer, asking to buy up one of my older apps (they are all open-source).

I ignored the request, and reported the approach to Apple, as I'm sure that this actor has been doing the same for many other apps.

This is apparently a common method for malware-slingers. They buy established, older apps, that they assume the developer has abandoned (I hadn't abandoned it, but it's a simple app that hardly ever needs tweaking. If I stop supporting an app, I remove it from the store).

They then "update" the app, with a little "extra flavoring."

This happened to me with Chrome. It auto-updated, then automatically synced browser history, passwords, and who knows what else, to Google. They soon changed it to opt-in sync, but it was too late for me at that point; they had already hoovered up my personal data. That was when I stopped using Chrome and switched fully to Firefox.

and secondly, they or an analytics package can just read everything client side and upload it to a server anyway

doesn't matter if its whatsapp, or signal, or some protonmail client if such a thing exists

I just don't use them with that assurance in mind, I use them for other things.

Neither of the 2 scenarios you describe are even remotely what's happened here. Not sure how you got from 'malicious ad popups' to 'app added cloud feature'.

Nobody said blanket trust anything. F-Droid is a community project with a framework that allows for disclosing user hostile behavior in apps. By using it and paying attention, we can all make it even better - the exact opposite of Google, whose incentives do not align at all with these goals.

https://play.google.com/store/apps/details?id=com.secuso.pri...

It could also be both of course.

Another point is the often complete change in UI or app behavior and you only find out about when you want it the least. I once had the case where I came out of a bar in the middle of a cold night, tired, had some beers and just wanted to use my Bikesharing app to unlock a freefloating bike to get home - whilst the app decided that it had to introduce a completely new UI and forced me to take an unskippable "guided tour" through the new features right at the spot.

This separation should be the price of admission for software developers who want to use online updates, and by now there is probably a need for real laws to regulate the industry since firstly it is very clear that it will not regulate itself effectively and secondly it is no longer just random applications but essentials like operating systems, web browsers and even the software controlling your car that are being treated in this cavalier way.

The Play Store doesn't give enough information to really judge if the upgrade is necessary.

We are not talking about patching. We are talking about updating.

> They'd just keep it around unpatched, while connecting it to the network. Is millions of vulnerable devices better than giving vendors of some software the ability to remotely patch their software?

Yes. Vendors do not patch their SW. For the average SW developer fixing bugs is like castor oil. Remember the forced transition from Win 7 to Win 10 when a good OS was replaced by an abomination ? And no, 10 is not better securitywise than 7. There are lot of RCEs in 10. Did you ever play an EA game ? With Origin doing a 4GB update before playing ? On a 25 Mbps internet connection ?

So for me if you have a security patch for your sw i will apply it. Maybe after some buffer period in the case of known offenders (MS) depending on severity. If it's "performance and usability improvements" just forgetit. If you did't bother to write a changelog for your SW i will not waste my time and money (an internet connection is not free ) updating it.

Microsoft went in hard / aggressively and are forcing update installs and restarts, which IMO is going the wrong direction.

Wasn't there a Linux project where they could update the OS / kernel without a restart? I feel like this is what all OSes should aim for. I like to think Android is going in one direction, moving shared libraries (Play Services) outside of the core OS so it can be updated independently.

You can turn it off, but you have to dig in settings. During initial iOS 14 setup it has a screen telling you it's turning autoupdates on, but you're not allowed to opt out there.

Unattended upgrades are a remote code execution vulnerability.

Buy Nokia 3310.

These types of things literally never happen.

Or maybe people have a lot of reasons for why they chose what they chose and this isn't productive.

It took me a bit of digging to make the distinction. I have both of them listed in my App Library, and both with the same name. At some point, I believe I went to install ZXing on a new phone and Android warned me that the app may be incompatible, so I went to the space team one. It makes sense that if people aren't looking directly in their app library that they can get these mixed up and leave the bad reviews.

However, since the space team version got infected, I did try the ZXing app - no pop-ups, and it works just fine (despite the age warning).

https://play.google.com/store/apps/details?id=com.qrcodescan...

The key here is that the author had a properly working, trusted, non-invasive application for years and then they pushed an updated version that was less so. Fortunately, it was an app with minimal permissions - it could only open web pages. In my case, running ublock, those pages came up blank. But for others not running an ad filter, they got pop-ups prompting them to install even more malware.

As for Google Play release process, I can't speak on that too much. They do scan for malicious code, but this code may not be malicious enough. If part of an application's purpose is to open web links, more code that opens links would not be as noticeable. Apple has a more intensive process to review new apps, and they spot-check app updates, but it's going to be somewhat similar. We hear about Apple pulling existing applications all the time for random reasons, but it's often after an update or report. Google pulled some of these apps after they were reported, but it was also after.

I'm not defending Google Play - they have a more relaxed review process than Apple, relying more on automation. But both have "legitimate" apps pulled for obscure reasons (and the only recourse seems to be getting attention on HN/Twitter/other), and both have let scam apps through. Apple seems to catch more of the "bad" apps, but also drops more legitimate apps that compete with Apple's business interest.

Play protect is a complete joke, it can't even detect malicious chinese apps that request every single permission that exists.

The "update culture" has unfortunately trained users to obediently "bend over and take it", which is horrible from both the security and change-management point of view; but is the dream of those who want to exert control over "the sheeple".

I seriously ask the question what damage could a potential malicious app on iOS cause? There is no running in the background, so no exploiting while I don't use the app, no being part of a botnet when the app is closed. There is a FS sandbox that will not let you access another Apps data without being able to jailbreak etc. I think an auto-update is more risky on iOS than to live with an older version of the app that does its job (you never know what an update changes/breaks for you, and downgrading is not an option in the appstore).

The zxing one seems to not have been updated in years (plus it's still on the store).

The usual "400$/month per 1k users" stuff, just integrate an ad network is common, but sometimes as dev you even get offers like "we hire you, with a contract, you can’t be fired, legally you’re a consultant to us for 2 years, at a few hours per week officially, for a silicon valley wage, unofficially you just don’t do anything and collect but we get full control over your apps".

Personally I’ve had quite a few such offers, and I’ve rejected them in the past and will also reject them in the future

Trust devs who’ve proven themselves :)

I think that if the app is open source, it's harder to hide such behavior.

You're right, displaying the fact would solve most things. The question is why such an obvious matter—which also would have been even more obvious to Google—wasn't enacted as such.