The lesson here is not "oh look the author is stupid because they installed a shitty QR scanner app and didn't notice the obvious mistake".
The lesson should be; even very experienced technical people fall onto the malware trap. We all have day-to-day problems, unexpected stuff happening, in short life doing its thing. We'll inevitably end up being victims of a scam that happens just the worst possible day of them all, because reasons.
Thus the problem is not if we'll also fall on the trap, but what tools we'll have at our disposal when we do, and to what extent the Operating System will be there helping to protect us (and/or help us diagnose the issue...)
As an iPhone user and an Android developer my lessons learnt, over the time, are:
1. Do not trust Google to vet the apps in the play store. They won't; they don't even try.
2. Those shiny Play Protect and whatnot postured around by Google are practically utter useless bs/bloat
3. Stick to famous, really famous apps from the Play Store - as in well known - e.g. Facebook, Netflix, Evernote etc (you will be tracked of course, you won't be hacked - you pay this price by using Googled Android anyway)
5. Do not, just do not download any other app on your phone (treat it as a no exception rule) unless you know what you are doing and possibly can look at the code - find something decent as an APK from GitHub et al.
6. Be very miserly when it comes to doling out permissions to apps. Your default should be "no".
7. Privacy (not really) and safety are just superficial polish by Google on Android OS - their core and only focus developing the OS is: making it as much of an ad platform as they can and on top of that how to get a bigger and bigger cut of the overall ad revenue with every release.
The part of pg's comments that relates to your comments is this part:
"Saying that an author lacks the authority to write about a topic is a variant of ad hominem—and a particularly useless sort, because good ideas often come from outsiders. The question is whether the author is correct or not. If his lack of authority caused him to make mistakes, point those out. And if it didn't, it's not a problem."
But in general, Paul Graham isn't saying anything that is novel to this site's comment guidelines:
Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community.
Comments should get more thoughtful and substantive, not less, as a topic gets more divisive.
"Don't be a dick, because plenty of people are smarter than you, and even people who are not smarter than you can come up with really good ideas and perspectives."
Why isn't it? Teenagers in India can have authority on a subject and more experience in certain areas than I do.
I'm not taking their post completely on faith. It matches up with my previous experiences, including the article we're currently talking about and related articles I've read.
Is there a specific issue you have with their point, or did you just want to point out that they're not special for making apps?
I've had the same issue as the author of the post.
The barcode scanner wasn't any shitty app, it was the one that was recommended a long time ago by Google authenticator. I had left it installed on my phone and it must had had the dodgy update that got it banned from the app store.
I think those bad reviews on https://play.google.com/store/apps/details?id=com.google.zxi... are because the malware probably used the zxing qr library, and there might be traces left in it, or these users are just confused (or the malware app deliberately pointed low star reviewers to the github competitor app in the play store). As others have stated, this github app with the bad reviews hasn't been updated for a long time.
Hang on a second, something is fishy here. I had an issue that the mirrors what was happening on the zxing reviews. I was getting a full page ad every 15 minutes or so after unlocking my phone.
The rub? It wasn't this app. It was another one that was also called barcode scanner. It was also beginning to garner negative reviews, which the developer (had a Ukranian email address) had begun responding to saying the app was perfectly legal because it was serving ads only inside the app itself.
I'm wondering if that deluge of bad reviews is directed at the wrong app? I'll look to see if I can still find the google play page for the one I had.
Also, I had that app for a LONG time before it started displaying this kind of behavior just last month, which also corresponds to the bad reviews starting on the zxing app.
That would be reasonable if the phone owner was likely the victim of some targeted attack (beeing politician or something similar). But if it's just regular malware that was installed with a drive by download, I would trust the android security model that much.
Doing so would mean you don't trust the Android security model. No app can be granted permission to affect the OS or other apps unless the phone is rooted and you give it root.
I mean, I don't trust as a binary. I have continuums of trust from very little to very much. I know that people are capable of privilege escalation and persistence. I've seen it with my own eyes. I know it's unlikely that that specific piece of malware was able to get persistent root, but it could have and it also could have exfiltrated cryptographic keys or certificate or bearer tokens while it was on there. Better to just get a new phone if you're such an experienced software developer that you literally helped build Android.
At the very least, yes. But I read something from a former NSA hacker once and he mentioned he replaces his computer and phone every quarter, in addition to a bunch of other paranoid things.
I'm not that extreme, but I did replace my computer once I got back from Kiev. I'd rather not worry about it.
I do not use an Android phone, is there an easy means to restore one to factory condition? Is there a simple process to save and restore your phone to your PC/Mac similar to how Apple does it?
(my father has an android phone and now I suddenly find myself curious about save/restore and how to find malware on his phone)
Yes - it's very easy to do a factory reset on your phone.
No - There is no 'easy' way to store/restore the entire phone as I believe Apple does.
(I had a miserable day doing this, when my old Pixel started playing up and had to migrate across to a replacement) - and this was best case when I had the two phones next to each other.
Core 'google' stuff seems fine - either all tied to your account (e.g. contacts) or google app data (texts, pictures etc) which can be backed up to cloud, or directly migrated between phones.
What doesn't work is the logins/settings for all the random apps. Some do store on cloud. Some allow manual export/import of settings. Some you're going to have to setup again from scratch.
Back in the day when I did root my phone, TWRP and similar things let you image/restore the whole phone.
Older Mediatek platform phones let you read/write the entire internal flash (eMMC) directly, which is AFAIK the full extent of persistent writable storage.
That is the true "factory reset", as it's how they were first loaded with software in production. I believe the more widely-known and generic Android reset is merely restoring from an internal partition.
If you look at the storage requirements of an app, you can see it's split between "App Size" and "User Data" (along with a cache).
AFAIK there's no way to actually backup/move the user data without rooting. Now I can see why Google might not want to store all that (and why I might not want them to) - but it's somewhat silly not to have any options.
> No - There is no 'easy' way to store/restore the entire phone as I believe Apple does.
I think Android phones with the Google Services Framework installed do provide such a way. Alternatively, if you're using a custom ROM (like GrapheneOS on Pixel devices), you can use Seedvault[0] for full backups of your phone. It basically acts as a drop-in replacement of the backup service provided by Google.
I had a QR scanner installed for _years_ before it started (in December) giving me chrome pop-ups for spammy links. The dev is even on the app store lying saying the ads are in the app when the app is actually covertly waking itself up to open chrome.
IMO: the lesson here is that restricting people to the OS vendor's software repository doesn't prevent malware. The only way to even help that is via community review (note that apple doesn't review internal behavior of the apps or instrument them in any way, they just have someone try using them behind a proxy) and enforcing public available source code like fdroid.
A QR code reader was the problem then... I am an Android user since the dawn of time and I was so surprised when my wife showed me that on her iPhone the QR code reader is embedded in her camera app... I wonder why it is not the same in any version of Android that I have used (now I am on Android One).
This plus the native support for CardDav and CalDav are pushing me to try iOS next time I have to change my phone.
QR Reader are load of everything. I went mad to find one a decent one for my parents’ android phone and apparently it doesn’t exists. So in a weekend I’ve created one without any kind of tracking, ads, permission, whatever. Here it is if you guys need one -> https://play.google.com/store/apps/details?id=com.prof18.sec...
Same here. Generally when looking for good quality Android apps, F-Droid should come first. I think about 95% of the apps I use on my phone are covered with F-Droid. Only banking apps and public transit apps are from the Play Store.
This is the best heuristic to apply not just for QR code scanning, but for pretty much everything. To avoid malware, avoid the Play Store.
When using f-droid, also check out the project web site and git repo (at least in a cursory way, even if you can't fully audit the code, you can get a sense of who the developer is and the project's overall health from the commit log and issue tracker).
It's not truly safer. It's just smaller, and only has open-source apps. So it's harder to hide malware, but still certainly possible (nobody checks most apps).
The issue is the "finely curated" statement. It's not a full code review, just "Wherever possible, applications in the repository are built from source, and that source code is checked for potential security or privacy issues. This checking is far from exhaustive though, and there are no guarantees."[1] After an app is added to F-Droid it gets built from source by the F-Droid build servers, but it does not generally get re-reviewed. It's perfectly possible to add the malware after the initial release. It's also possible (even easy) for malware to be missed by the limited code review. F-Droid is a little safer, but that doesn't mean it's particularly safe. It's no harder to get malware on F-droid than it is to get it into Arch or Debian or any other distro repository.
I believe these bad reviews might be a result of the malware app pushing bad reviews to the zxing app page on google play, using an in app 'rate this app?' -> low rating -> send to the zxing app in Google Play (instead of the malware app in google play).
As noted above, I believe this to be the case. I had the other app and started receiving full page ads for it. Totally different developer, but same app name. I am no longer able to find that app in the play store.
I've installed from Google Play, and never seen any ads. It has contacts permission, but that's because sharing contacts with a QR code is something I use it for frequently (it can generate codes as well as scan them).
I feel like this is a good example of how difficult it is to find a good barcode scanner. It mentions permissions for contacts and full network access. I would have thought that those two permissions should not be necessary for a barcode scanner and point toward something dodgy going on.
It's actually not that difficult. F-Droid has a few offline scanners. It depends of course on how much of your experience you want automated. Though it would be nice if Android let you control the more granular permissions like network access.
Error correction is inherent in processing the QR code itself. That is, QR codes are generated with varying levels of redundancy, and any reader must be able to interpret the Reed-Solomon code.
What's interesting, is that despite the app not being updated since 2018, open source, and containing no ads or tracking the reviews are saying it recently became adware.
Searching for barcode scanner in the app store brings you to a horrible sea of ad supported crap ware, and it seems like that crap ware wants to ensure you don't download something that might be decent.
I scraped the latest 1000 reviews (coincidentally almost exactly 12 months worth).
The "adware" reviews are all very recent with large amounts of votes.
They seem to start on December 18, with 162 1-star reviews in the following 25 days -- more than all the 1-star reviews in the 6 months prior.
I wouldn't be surprised if these reviews are not only automated spam, but are constantly being deleted and reposted to keep them "fresh", and at the top of the "relevant reviews".
The malware app was also called "barcode scanner", published by "the space team", so it wouldn't surprise me if a lot of people just found the more popular zxing app on the store and left reviews in the wrong place. I had the malware version installed and went through the same process Cedric did to find out that an update they pushed around that time turned on the bad behavior.
Either it's a campaign to try and lower the ratings or a bunch of people have managed to get separately installed malware and thought this was the cause.
The last update I see available is what I have installed - 4.7.8 from September 2018. Definitely no strange behavior from it.
But I also use this app for QR-codes, since I was never able to find an alternative. The vast permissions required make me nervous every time I install it... Good to know it is on F-Droid as well, built from a source tarball, so should be OK [1]?
Another option would be to use Google's MLKit. I think they've added support for scanning QR codes in there. It requires Google Play Services though, which is not ideal.
> No issues initially but now it will give full screen ads often that either force open your browser to a shady site...
> ...thought I should update it. That's when I started getting full page ads and browser redirects. I don't know who hijacked this app...
> Avoid!! Used to be great. Now opens adware, and pops it over the lockscreen. Goes to great lengths to cover its tracks, calling the process "partners" and removing itself from recent applications. I had to use "popup ad detector" to find it. Appalling behaviour. Very underhanded.
The zxing library is open source and different from the app. So looks like something fishy happened to the app recently. From the description of problems, this might even be the app referred to in the article.
Google makes one themselves, Google lens. It's quite a bit more than just a qr code reader, though, kind of a generic computer vision app https://lens.google.com/
I went mad trying to find a decent voice recorder for my mom. Eventually settled on some ad-littered app, but at least it didn't request any extraneous permissions. Every other app asked for every single permission under the sun... to record voice.
The one thing I've noticed about the iOS store is that apps are more up-front. Many have a price tag attached to them, which I prefer. Android apps are all about giving you something for free and then in the back doing god knows what to make pennies off of you.
The whole ads-in-apps situation is from some sci-fi novel. Let's make screens bigger, so we can fill more of it with ads.
I use the built-in QR-code scanner available in Opera Mini beta. Also, its the only browser I know that has a built-in RSS Feed reader. I use an old APK, as the newer version of Opera Mini removed the RSS functionality.
I was going to recommend the open source "Barcode Scanner" app also known as "zxing" on GitHub. However when looking at the app's page, I noticed that someone seems to be engaging in some kind of review-bombing with that app. There are tons of reviews claiming that it was recently updated and has highly intrusive full page popup ads. But looking at the version info, the app hasn't seen an update for over 2 years and the repository is in maintenance mode, and I nor anybody else that I know has seen a single ad when using it.
I wonder if this is a concerted effort to steer impressionable people away from a "real" FOSS QR code reader app and direct them to a malicious one instead, using scare tactics.
I also use Lense for QR and like any typical app just installed through Play and launch normally.
Voice Assist is yet another privacy invasion vector imho, there are too many anecdotal first hand accounts of someone talking about fishing and suddenly getting banner adds for boat trips everywhere.
You don’t think it’s more likely that a person who talked about fishing also searched for fishing gear using Google? Or “Likes” fishing on Facebook? Or follows a fishing person on Twitter?
The technology and storage that would be required to parse non-device-directed speech doesn’t exist and wouldn’t be profitable since there are so many other reliable signals that are much cheaper.
I have a Pixel 2. It scans QR codes with the default camera app just fine. When it detects a QR code you get a little popup you can click. It even works with regular 1D barcodes.
It wasn't a QR code reader that was the problem, it was a malware posing as a QR code reader. It didn't sound like the author downloaded a QR code reader and happened to get malware. He got malware from some source which installed itself that way.
I had a QR reader in my camera app on some old Androids, around 2011 or so, but maybe it was because I then often was running custom ROMs? Or because back then QR codes were hyped and used for everything? Anyways, in 2019 or so it was included again in the native camera app on all Samsungs.
While I get the allure of "it just works", having a niche feature that's basically never used and easily installed anyway seems like a weird hill to die on.
I recently discovered Firefox on Android has one if you focus on the address bar there is an option to scan, you just need to give Firefox permission to access the your camera
> on her iPhone the QR code reader is embedded in her camera app... I wonder why it is not the same in any version of Android that I have used
Apple added a builtin QR code scanner to the camera app in iOS 11 due to the ridiculously widespread use of QR codes in China.[1] I guess (Google's version of) Android doesn't have that because Google doesn't derive much value from that market, and QR codes don't have as much mindshare in other major markets.
[1] They specifically called out the Chinese market when introducing the feature in WWDC 2017 keynote:
> Of course, there's much more than we have time to talk about today, but I want to highlight some features of special interest to our customers in China, like QR codes that are integrated right into the main camera, accessible from the lock screen, super use Yes, super useful for customers in China.
Android has had a buil-in QR scanner for years. Looking in this thread at least OnePlus, Pixel, Motorola and Samsung has it in the default app. As far as I know it is part of android.
Xiaomi's Android distro MIUI has QR code scanning in the Camera app by default.
Most asian target markets do that, because QR codes are more common here.
+1 to the answers here. Mine offers QR reading as another selectable mode, in addition to the "Still photo" and "Movie" modes. My previous phone had it integrated in the "Still photo" mode: it would simply detect and read QR codes automatically when pointing the camera towards one.
But, the phone I had before those two, had a Camera app which didn't read QR codes. So maybe it's a matter of expectations now: old Camera apps were just for Camera, while modern ones are now generally expected to be able to read QR codes? (I would, anyway)
It is on my pixel (so worth a try on whatever's shipping with Android One).
I thought it was a bit 'hit or miss' at first - if you hold the camera over the code, after a bit it decides to pop up a link over the QR in preview. Then realized if you tap on the code, it instantly displays the link. Just had a fun few minutes on https://www.google.com/search?q=qr+codes&tbm=isch - as the tap allows it to handle multiple ones within the same frame.
My Firefox on Android has a QR code scanner, I typically use that even when I know it's not a website. When you open a new tab and select the address bar you get to see the button for the QR code scanner.
After going through dozens of QR code scanners trying to find one that is open source and trustworthy enough looking to install, i realised there is just one right there in Firefox.
I have an Honor5C on Android 7 (with EMUI5) and there's a QR code reader built in, but I only found it by accident.
After taking a picture of a QR code, view the image, tap 'more', wait 10s, if the image is good enough (and it really needs perfect focus and placement, it's very pinickety) then it will show "read QR code", if you choose that option it will then take you to a URL/text preview, and then you can open your browser to that URL, etc..
This is basically the problem I have with Windows (well, had, maybe it's gotten better): a bunch of basic tools are third-party utilities. Microsoft will even point you to them?! On macOS either the basic things are build in or easy to find from a website that isn't trying to push a new toolbar at you. On Linux you just use your package manager to install whatever it is…
I don’t think you really need any 3rd party utility on Windows anymore, for the basic tasks. Any hrowser has PDF viewing, .zip support is already there (since Win2000), it has basic image manipulation and text editing, screenshot editor, and i think even desktop-recording. Sure, none of these things is a “best in class” app, but that’s normal (and leaves market space for developers). Anything beyond that is not “basic” and I wouldn’t expect it on MacOS either.
On my Moto E4 (Android 7.1.1) the default Android camera app also reads QR codes. But nothing in the app. nor app. help actually tells anyone that it will do this. The only way one discovers it is by pointing the camera at a QR code to see what happens, and realizing that the app just decoded the QR code it was viewing.
I read somewhere the native camera app also does but many including Samsung have their own app instead. Cannot vouch for that.
On the flip side there are QR apps in the top 100 App Store apps because the built-in support in camera is not really obvious unless someone tells you.
Firefox android has a QR code reader. I also recently noticed that the Google App (Discover ?) has a QR code reader and I think the Google assistant too.
But these are all behind app, not readily accessible.
Yes, on my Samsung the camera app is great, and it gets better all the time. I know people like to crap on Samsung but they do some great things in some regards.
I trust the F-Droid store more due to its curated (FOSS-software-only/no-trackers) maintainer based model and default to them if there's an app that I need, especially simple stuff that tends to mostly be adware on the playstore
On a side note, my bank is now forcing me to use their app which can only be downloaded from the Play Store (which I will never install). When I complained they told me it's because they think it's more secure than their current method which is a card reader, I tried to explain to them the average phone is teeming with malware, but they simply wouldn't believe me.
It will probably be not good enough, many banking apps are using Google Safety Net to detect rooted or not Google certified devices with Google Play installed indirectly. AFAIK it's now quite difficult to break. I sort of understand the bank decision on this. There is a lot of malware on Android and users are easily tricked into installing some side-loaded APKs, and there is also a lot of hidden malware on Google Play which is hard to find (e.g. it downloads a payload after the store review is done). This would be a disaster since on Android you can for example use accessibility services to read any input from the user and also control the device. So you can circumvent 2FA and make transactions on behalf of the user on the device. There has been a lot banking malware on Google Play. I think they are getting it a bit under control now, but it's still very dangerous.
I wonder if it would be possible to have something like qubes or maybe like docker that could run a full-fledged, sandboxed Android instance for a single app, while running FOSS like a sane person as your primary ecosystem.
Thats happening a lot, switching your bank wont help at least not for long. I guess "[x] force smartphone users to use the app" is part of some security checklist now.
I got a workaround by switching to desktop mode, when that didnt work anymore by using Fennec (FF mobile fork with relaxed addon support) + useragent switcher
kinda similar for me. When I look for a small app like a QR code scanner or a flashlight I search for "QR code scanner open source" or "QR code scanner github" to easily find the open source ones that likely dont contain ads or malware
"Google Play Protect was also completely unhelpful, which was a big disappointment. First because Google certainly knows which applications they removed from their store for malware reasons, but even so, I would expect Google Play Protect to at least flag any app it finds on my phone that is not on their store. Such an app is not necessarily malware, but it should certainly be flagged.
Google Play Protect could also do some behavior profiling to analyze what apps are doing in the background. A service launching recurring VIEW intents on web sites in the background should have raised a flag to the system."
Sounds good.
I sense that there so many teams involved such a feature is not on their radar. So "they already know they blocked it" and "the existing installed app should be blocked" imply that two teams know what the others are doing.
I'm guessing that the team that does the removal from the store has no communications path to those who would add a flagging mechanism for already installed apps.
" I would expect Google Play Protect to at least flag any app it finds on my phone that is not on their store. Such an app is not necessarily malware, but it should certainly be flagged."
seems like Google is between a rock and a hard place here, they already catch so much heat over their treatment of third party app stores there would certainly be a lot of outrage over this if they started doing it
Very true, but instead of reaching in and removing your app giving a message saying "we pulled this app from the store for such and such reasons, maybe you want to review it" would be pretty nice.
> Listing the apps installed on my phone should give me the option to sort them by “Latest installed”. I am pretty sure that if I had had this option and I had seen a QR Code Scanner installed just a few days ago, it would have immediately grabbed my attention. As it is, the way Android lists the installed apps is pretty useless for this purpose.
I was able to find it pretty quickly by going to:
Settings > Battery > Usage Details > Battery Usage Since Full Charge
This showed me the most recent app used. As I hadn't used the QR scanner app in quite some time, it seemed a reasonable place to look first.
I unlocked my phone and two
accidental clicks led me to
agree to a dialog that my brain
immediately registered as suspicious
What type of dialog can pop up on your Android screen after unlocking and install "malware"? What is "malware" here? It looks like they mean an app from the play store?
The next day, I picked up my phone and
when I launched Chrome, I immediately
noticed it was displaying a spammy URL.
What I believe the author is saying is that he received a push notification to chrome from the malicious app.
Coincidentally, I just spent my Saturday evening pouring over malicious JavaScript hosted on Cloudfront that does extensive browser fingerprinting and if a match is made to an Android device a fake Captcha pops up in Chrome which actually enables push notifications and from there a full screen pop-up appears that vibrates the devices and claims the phone is infected with (N) viruses and the “repair now” button pulls up the Play Store app to install DFNDR antivirus/cleaner.
If you look at the reviews of that app you’ll see all the angry reviews of users having their browsers hijacked.
The app itself is just an advertising server wrapped around Avast’s detection engine and is funded by the Chinese Qihoo.
It harvests users social media data and charges the users almost $10 a month after a 3 day trial period.
Novice users are unable to delete the app if “advanced protection” is enabled because it becomes a device administrator and uses deceptive language to confuse the user trying to remove the app.
If the app gets installed it will not let you clear the storage of the app from within settings even if you had never opened the app and before you agree to any terms and conditions.
The fake virus warnings that lead to DFNDR have been going on every single day since 2013.
I’m putting together a webpage that will include the JavaScript and other details as we speak.
The Google Play Store is a dumpster fire full of scam apps and Scummy developers.
Not GP, but my interpretation: app sent a general push notification which, when tapped, opened a malicious URL in Chrome as the next step of this "funnel".
Something similar happened to me a few years back after I accidentally tapped an ad in Chrome (an ad delivered by Google no less). While I didn't get infected the site did start displaying system like prompts (my phone was also vibrating at this point and playing the same sound I get when there's a natural disaster) saying my device was infected and that I should tap OK to download an apk.
I did several things after this:
- Reported the ad to Google (no followup from their side - naturally).
You can disable system apps so they don't show up even without root. If you have root you can also uninstall them. Just open a terminal, su and use pm uninstall to uninstall for your user or all users (you can reinstall the same way if you end up needing it later). No reason to use the provided Chrome when you can just use Bromite though.
> What type of dialog can pop up on your Android screen after unlocking and install "malware"? What is "malware" here? It looks like they mean an app from the play store?
That would be the case if you enable sideloading, but that isn't mentioned in the article. Is it possible to install an app via popup without going through the store? This needs some clarification.
If that would be the case what is the point of the article? Of course Google Play Protect shouldn't interfere with an side-loaded app. One major reason for side-loading (after giving explicit consent and ignoring all the warnings associated) is to allow applications Google wouldn't approve.
Google Play Protect also warned on unknown sideloaded apps (and requested an upload for a scan) when I tried it ~half a year ago. Documentation[0] implies this is still the case
> It checks your device for potentially harmful apps from other sources. These harmful apps are sometimes called malware.
> If you choose to install apps from unknown sources outside of the Google Play Store, turning on the “Improve harmful app detection” setting will allow Google Play Protect to send unknown apps to Google to protect you from harmful apps.
Yes this is basic (and incredibly common) behavior. The alternative is often much worse (an embedded WebView in each app to do things like open TOS pages).
I had this app too, and I remember thinking it was weird because I think an official google developer blog (or something like that) mentioned the need to install it, as there was no built in QR code reader at the time. I can't remember which old phone I had it on though.
I also think those reviews might be left by people who can't find the original offending app because it's been removed. https://www.apkshub.com/app/com.qrcodescanner.barcodescanner seems to show it had BILLING permission though, which is always an alarm bell.
The one on apkshub is the one mentioned in the blog. Google has removed it from google play. https://play.google.com/store/apps/details?id=com.google.zxi... is a completely different, open source app, with unexplained bad reviews, probably nothing to do with the malware, and hasn't been removed by google.
Am I missing something or does your repo only contain the minified version of the javascript, and not contain the `index.js` referenced in the `package.json` nor the method to build to minified artifacts? This seems like it's not open source.
You may know this already, but just in case: the iOS camera app has a QR reader built in, just point the camera at a valid code and it’ll automatically display a tooltip containing the URL which will open in Safari if you tap it.
Yes, but trusted UI is needed to require permissions for things like that (ie. so that every pixel on the screen of the phone the user can be aware which app and security 'container' it came from).
That is pretty hard to achieve, and no mobile or desktop platform really has it.
Ex-AOSP hacker here. I felt it strongly at the time too that Android didn't need anti-Malware [0] but I don't anymore.
Some 5 years ago, I switched to Firefox Mobile out of annoyance because Chrome refused to block all those popups random websites would show with some prompting an app install.
Google has since made a lot of improvements including tightening up which apps can install other apps (not a blanket permission anymore), running the Potentially Harmful Applications program, narrowing down fingerprinting (still some way to go as evident by TFA). Google is even locking the code up that runs outside of Android in crosvms [1]. I'm positive, things will improve [2] even if slowly because Android, at this point, is the most widely distributed OS and they can't move as fast anymore without hurting developers and users.
Google did implement what they call AppOps (2013) which paved for tremendous amount of user control over app permissions. They removed AppOps citing that it was never meant to be used by end-users but by AOSP and app developers [3].
Fortunately, if Android is rooted, one can use AppOps [4]; but then rooting exposes one to an incredible amount.
Besides, there are LittleSnitch-esque firewalls for both root and non-root devices [5].
You are supposed to debloat all the malware that comes with your phone, courtesy of the manufacturer. If you are not capable of that, or don't care enough to have someone do it for you, you'll have to get used to ads. Annoying ads are considered a feature on stock Android builds.
What surprised here is that Android doesn’t have a native QR scanner. I’ve always assumed that iOS was late to the game and that Google Search/Lens handled QRs since 1999. Is that not the case (anymore)?
My Huawei phone actually does come with a QR scanner. You just have to open the built in camera app, then click this icon[0]. It defaults to the translator camera, which I find really that you can just point at text and it translates it on your screen. Then there's a picture of a square with a line down the center that turns on the QR scanner.
As you can imagine, when all the covid checkins started, I couldn't find this. Everyone would say to me "just open the camera on your iPhone it's easy" as though it was a given that every visitor was using an Apple phone.
I went through three different QR apps based on what I found on the play store and all of them blasted me with inappropriate ads I kept wishing I didn't open in public. A bit if visibility in the UX would have solved this.
The versions of Android that vendors ship usually have a QR scanner. For example, Samsung's camera app reacts to them by default. I don't think AOSP has a QR reader, but Lineage OS ships a camera that reads them.
I'll add that even though most phones have some sort of built-in reader, there are many reasons a developer would want to use a standalone reader. The Samsung reader launches URLs (99% of QR codes I encounter), and it understands Text and VCARD as well, but I don't know that it understands all kinds of arbitrary or custom QR codes you might want to define.
The issue is that some malware installed itself with the name QR scanner, not that Android does or doesn't have a QR scanner. Most Android camera apps (each phone comes with its own) will recognise QR codes fine, although the UI is sometimes annoying.
If Google removed it from the Play store, why don't they have a way to tell people that an app they have installed has been detected as malware and prompt them to remove it?
Blockada has a nice Hostlog view to show requests in real time. Have caught websites I thought I had blocked this way. Wish it would tell me which App made the request.
Coincidentally, I was trying to download a qr code scanner app on my new phone the other day, and looking at the listing, trying to discern which ones were going to be overly greedy with permissions and ad spam lead me to immediately installing f-droid again. originally i hadn't planned to bother with it, but man the google play store is in really bad shape. and advertised apps are just a stupid concept that needs to die.
I really wish there was more granularity to the permissions. For the vast majority of apps, I don't want them to be able to use the internet. Seems pretty basic (other than the fact that is threatens the whole Ad ecosystem...)
Would be cool too if there was a shared file space for apps... And apps had to stay within that pen. Giving them access to all your phone's files is just wreckless. But I don't have the choice.
> I started by inspecting the list of recurring tasks, but the output was so voluminous that finding anything useful was a dim prospect.
Sometimes I phantasize about a novel computer or phone, where you can "physically" inspect the running (non-OS) applications. On a phone, you'd have a glowing edge where each light or micro display corresponds to one application. You can only ever have 6 or so apps running at the same time. If an app launches a lot in the background, you'd notice it quickly from the new color blinking. On a desktop PC or a server, maybe you'd even have a little door in the case, and behind it a bunch of little OLED displays that replace the task manager. With a click of a physical switch, you could evict an application from memory automatically.
Of course this would be unpractical for a lot of reasons, and you'd have to trust the OS/firmware. But I like both ideas of understanding what the PC is doing, and adding back a tactile element to computing.
About QR code, isn't that the sort of thing that would be super more efficient to do in hardware at the camera chip level?
This makes me think that it would be nice to be able too load "camera sensor scripts" in a similar way to GLSL for GPU, for filtering and analysis using hardware. (it might be possible, I am not an android developer)
Yeah, looking at the AVTEST.org results, it has generally appeared Google would've been better off buying a no-name competitor's app rather than trusting their own engineers to implement security software: https://www.av-test.org/en/antivirus/mobile-devices/android/...
I've been a victim of that specific malware and I was wondering how on earth did it happen as I'm usually careful enough when it comes to security. I also had the barcode scanner app. I didn't go as far as the author and I did a factory reset.
As sad as the incident is: I am glad he is still committed to Android after being a team member and therefore equipped with a deep understanding about the platform and architecture itself.
Scary. Is there such a thing as a malware scanner on Android? Are they effective or worthwhile at all? Why isn't Apple susceptible to this type of malware, seemingly?
A malware scanner won't find an app that you gave permission to show on-top on other apps and use this to show ads. It is not doing anything it isn't allowed to do.
Can you explain how you managed to install malware while unlocking your bootloader? The only two methods for unlocking I've ever used are OEM applications like Odin for older phones and simple ADB commands for newer ones, neither of which put you at particular danger from malware.
a not so obvious protip: you usually don't even need a "qr reader app" modern phone camera apps will pop the link without having to install extra stuff.
It’s a joke that this happened. And even worse that he considered installing “malwarebytes”, one of those things that smell of windows 98 shareware, to fix it. This is why I buy iPhone.
If you install an app on iPhone that is allowed to make pop-ups and it shows ads in those pop-ups you get the same situation as here. This wasn't malware as it couldn't access anything except itself.
I've switched to Android (Huawei) 2-3 years ago (after the Apple battery fiasco). I keep installed (and updated) the NoRoot Firewall app, which by default blocks all access.
I also added to my mix the Nova Launcher. It makes it easier to tap&hold an app icon, gives you a quick shortcut straight to the specific app's Settings --> Apps --> specific app's properties, in which I (usually) block access to data/wifi/roaming/background (e.g. for a QR Code reader app).
90% of my apps do not need to reach out to the interweb, and I block them both on Settings as well as Block Data/Wifi on NoRoot Firewall.
Although Huawei is beeing Huawei-ing (some sneaky apps are running).. I do like the interface into "Manually" managing backround running (battery), internet access.
I'm not trying to be facetious or rude, but that seems like a massive decision against something that was largely fixed? I can understand if you had software-problems with iOS but I didn't see that in your comment.
Managing those kinds of blocker apps, and security and such are all great when you're 'in the zone' and have it fresh at the forefront of your thoughts. For me, it only takes a week or so of not thinking about it before my standards slip and I have Just Another Application™ running.
I didn't have any probs with sofrware while using iPhones. I was jailbreaking them, installing a similar firewall and had my mind at ease. I would go to Apple in a heartbeat if they stopped lying and allowed rooted/jailbroken phones.
It is nice to see that on a comment 95% on Android people still downvote me for (justifiably) trashing Apple. They got caught cheating. Then they got caught lying. Then they were found guilty. Apple fanboys are having a party downvoting.
Fun fact: "HN karma" is virtual, while the $1k that they pay Apple every year is a REAL number. Keep rocking folks. I guess when someone spits on your coffee you downvote the commenter and keep going back to the same coffee place, right? (https://bgr.com/2020/07/13/iphone-batterygate-lawsuit-settle...)
> and I have Just Another Application™ running
this is absolutely normal/logical. A friend suggested the 7min workout by Johnson & Johnson. Nice app, free, has these simple 7mins workouts, also has warm-up/cool-down if you want the extra 7-8mins.. very nice. Loving it.
It doesn't need internet connection to fully operate (workouts). I don't need it to "back up my progress in their cloud". So it stays offline (forever). It takes 1min when I install that new/extra app to bolt it down and have it behave just as I want (and does not disrupt me with notifications or leak data or kill my battery).
The lesson should be; even very experienced technical people fall onto the malware trap. We all have day-to-day problems, unexpected stuff happening, in short life doing its thing. We'll inevitably end up being victims of a scam that happens just the worst possible day of them all, because reasons.
Thus the problem is not if we'll also fall on the trap, but what tools we'll have at our disposal when we do, and to what extent the Operating System will be there helping to protect us (and/or help us diagnose the issue...)