12 ms·

CamScanner, a malicious Android app with more than 100M downloads in Google Play

301 points by GordonS 7y ago

GordonS 7y ago
For the past few days I've been seen spam events in my calendar about "free iPhones" and "webcam girls" - I couldn't figure out where they were coming from. I have CamScanner installed, so presumably that's the source... Now, I can remove CamScanner (which is a shame, it's a really good app), but how can I ensure the trojan is also removed? I tried the Avast AntiVirus app, but it didn't find anything. What does everyone else do for AV on Android?
- basicplus2 7y ago
  Try Sophos Mobile Security https://play.google.com/store/apps/details?id=com.sophos.smsec https://play.google.com/store/apps/details?id=com.sophos.sms...
- JasonHarrison 7y ago
  Apparently calendar invite spam is on the rise, and CamScanner might not be related. See https://www.theverge.com/2019/8/23/20829615/google-calendar-spam-events-sharing-email-how-to-stop https://www.theverge.com/2019/8/23/20829615/google-calendar-...
- dantheman 7y ago
  The calendar thing is probably this: https://lifehacker.com/how-to-prevent-spammers-from-infiltrating-your-google-c-1837539886 https://lifehacker.com/how-to-prevent-spammers-from-infiltra... check your emails
  - oh_sigh 7y ago
    I got hit by this exact one(free iphone X) recently, and couldn't find anything in my email. Surely, that kind of email would just look like spam, so isn't the correct solution for google to just not auto-add calendar events if their source email is spam?
    - abrookewood 7y ago
      Yep, my wife got exactly the same thing. Apparently those entries will appear in your calendar even if the email was sent to spam. You have to configure gmail to not automatically add the entries.
      - wolfd 7y ago
        This seems like a pretty big oversight on Gmail's part.
  - GordonS 7y ago
    No, it wasn't that - I had the auto invite setting turned off already, and I didn't have any emails that matched the calendar entries. I was fairly sure it must be malware, but I had no idea how to find out which app it was. I tried Avast AntiVirus, but it found nothing. After finding out about CamScanner I tried Kapersky AV, which did flag CamScanner as malware.
- lern_too_spel 7y ago
  > how can I ensure the trojan is also removed? The trojan is inside the app. Remove the app, and you remove the trojan.
  - giancarlostoro 7y ago
    Is this a solid guarantee? Usually on Windows a Trojan replicates itself outside of the main application it was installed through.
    - snazz 7y ago
      I think it would have to exploit a vulnerability in Android’s sandboxing mechanism (not hard considering how many people can’t or don’t update) to be able to become separate from its parent application. Win32 doesn’t do any kind of app sandboxing at all.
- snazz 7y ago
  Most antivirus software on Android is more like malware itself. You’re better off only using applications from F-Droid, very carefully vetting everything yourself, or not using Android. The Android security model is getting better, but it’s still really broken compared to anything on iOS.
- ignoramous 7y ago
  AVs for Android are themselves a privacy nightmare. You need to grant them all sorts of permissions and their privacy policies, oft times, leaves a lot to be desired. That said, Malwarebytes is decent, and so are some other offerings, but I wouldn't recommend using any. Here's basic steps you can follow: 1. Uninstall apps you don't use. 2. Firewall apps that do not require internet access to function (Calculator, CamScanner, Alarm Clock etc) 3. Block trackers and ads (use pi-hole and set private-dns). 4. Remove permissions from apps that do not really require the permission (Bank apps with all sorts of permissions). 5. Disable notification for apps that do not really need to notify you of anything at all (most games). 6. Install apps you're not comfortable using in work-profile, or in a privacy friendly app-sandbox (parallel-space started as one, but alas, aren't privacy-friendly anymore).
thebruce87m 7y ago
Is this just a non issue on iOS? If so, why?
- 0942v8653 7y ago
  I had the CamScanner app on my iPhone for quite some time, then uninstalled when I launched it and saw (IIRC) Chinese text appear. I'm assuming that ownership changed around that time, and if the Android and iOS apps have the same owner, I wouldn't trust it either. An iOS trojan would have slightly more limited impact, but if (for example) you gave the app "Access to your Photos" in order to save something, the app would still be able to read all of your photos and potentially send them back to home base as it chooses.
  - aitchnyu 7y ago
    I guess its time to disclose transfers and sales of mobile apps and browser extensions to end users.
- DevKoala 7y ago
  I am curious too. I presume it is due to better sand boxing and a more transparent system to request resource access.
  - codesushi42 7y ago
    It is easier to run background processes in Android by starting new services with their own dedicated process. And it's quite easy to run headless apps/processes.
- JustSomeNobody 7y ago
  Because 80+% of users are on the latest os version and the inverse is true of Android.
  - lern_too_spel 7y ago
    This doesn't use an exploit in Android and instead runs payloads with the permissions of the app. The same can happen on iOS and very likely does in many apps but is reported less often because there is no economic incentive (the App Store doesn't allow antivirus services). For an example, see how Xcodeghost went unnoticed by Apple.
sp332 7y ago
Just to clarify the headline: the app didn't have malware when most of the users installed it. A recent update added the malware.
- pbhjpbhj 7y ago
  And (based on a very brief scan read of the OP) the app is called CamScanner and is used to create PDFs.
- exolymph 7y ago
  Guess how surprised I am that the headline is inaccurate.
- AdmiralAsshat 7y ago
  That's not accurate, really. 100M+ users didn't install the thing overnight--they've downloaded it over the course of years. If they had it installed, and they had automatic updates turned on (which most people do), there was a several month window when they had a version of the app that contained malware, even if it was eventually removed.
  - sp332 7y ago
    Not sure how that's different from what I said, but yeah.
- baroffoos 7y ago
  This seems like such a common occurrence, not only with android apps but anything with auto updates. It seems like the only solution right now is to purely limit yourself to apps from f-droid. Not necessarily because open source is resistant to this, but because no spammer would bother attacking such a small group.
  - saagarjha 7y ago
    Sounds much like the Chrome Extension Store, where people would hijack/buy popular extensions and add malicious scripts to them.
blisterpeanuts 7y ago
Rather than disappear it from the Store entirely, it would be nice if Google could leave a placeholder with a warning; at least it would serve an educational purpose. Also, does the Play Store app have a way to notify users of a banned app that is still installed? I decided to check my wife's phone proactively, but I don't think she would otherwise have had a clue of malware (but has been getting weird and annoying pop-up ads).
- master-litty 7y ago
  If the purpose is education, I feel emails or some other direct notification would be far more helpful. It's not like we usually go to an app's Play store page after installation, save reviewing.
- sp332 7y ago
  Or in this case, rolled back to a previous non-infected version.
  - aflag 7y ago
    The new versions are also unaffected. It only had malware for a period of time while the developers were using a 3rd pat library with the malware.
- saagarjha 7y ago
  > Rather than disappear it from the Store entirely, it would be nice if Google could leave a placeholder with a warning; at least it would serve an educational purpose. This would also make the Play Store look bad.
  - luckylion 7y ago
    Which would also be fitting, wouldn't it? Google missed it and dropped the ball.
jimrandomh 7y ago
Does anyone have information on affected and unaffected version numbers? I have a version of this installed, but it's an old one, and may not have updated to the malware one because I disabled automatic updates. (Specifically because I was afraid of this, in fact.)
- bleachedsleet 7y ago
  Yes. There's a Reddit thread with the version information. I'll see if I can find it later when I'm off work but it made the front page so you could probably search it out fairly easily.
- tabjsina 7y ago
  May 22, 2019: 5.10.6.20190522 – safe June 6, 2019: 5.11.0.20190611 – safe June 14, 2019: 5.11.3.20190614 – safe June 16, 2019: 5.11.3.20190616 – unsafe June 24, 2019: 5.11.5.20190624 – unsafe July 10, 2019: 5.11.7.20190710 – unsafe July 23, 2019: 5.12.0.20190723 – unsafe July 25, 2019: 5.12.0.20190725 – unsafe July 30, 2019: 5.12.0.20190730 – safe August 8, 2019: 5.12.3.20190809 – safe August 14, 2019: 5.12.3.20190814 – safe August 16, 2019: 5.12.5.20190816 – safe August 20, 2019: 5.12.5.20190820 – safe Source: https://www.reddit.com/r/Android/comments/cwk0y4/camscanner_booted_from_play_store_after_discovery/eyc0vin https://www.reddit.com/r/Android/comments/cwk0y4/camscanner_...
  - asveikau 7y ago
    Any speculation why they would only leave in the malicious code for about a month? Changed their mind? Done without full knowledge? Achieved some high value heist and rolled it back?
    - jeroenhd 7y ago
      An update to an ad library is what caused the malicious code in the first place. Presumably either the infected library was updated again or the developers switched libraries. The developers behind this app did not add any malicious code they wrote themselves. The attack either came from the ad library or the ad library was hacked.
Deimorz 7y ago
Blogspam of https://www.kaspersky.com/blog/camscanner-malicious-android-app/28156/ https://www.kaspersky.com/blog/camscanner-malicious-android-... (Forbes contributor posts are almost always blogspam)
- mkolodny 7y ago
  What's blogspam?
  - McGlockenshire 7y ago
    Blogspam happens when someone writes a blog article that sources or references something from a more authoritative source, such as this one linking to the Kaspersky story, without adding anything of significance to the original.
    - GordonS 7y ago
      Which I don't think is exactly the case here - the Forbes site is not a blog, it's a news site. This article is their reporting of something newsworthy (even if not the best quality article).
      - chmod775 7y ago
        There's no fundamental difference between a news site and a blog. A lot of them even use the same software. News sites just tend to have lower quality entries than blogs and often engage in blogspam instead of providing links to superior sources or adding something of value. Obviously. Since they want to keep people on their site. I wonder what the average time spent on a "news article" vs. a "blog post" is.
        mtberatwork 7y ago
        > There's no fundamental difference between a news site and a blog. There is a difference. A blog is short for web log which implies a personal journal. Anyone can publish a blog without editorial oversight. A news site implies that professional journalists are producing reports with editorial and literary standards. Clearly many media companies blur this line though to the detriment of readers and journalists. > A lot of them even use the same software. What difference does that make? The vast majority of web sites use the same web server software (Apache/Nginx)...and the same software elsewhere in the stack.
flyGuyOnTheSly 7y ago
Can an "app with Malware" access my Google Authenticator credentials? Or read my screen while I am viewing them?
- jeroenhd 7y ago
  Google auth credentials: not without root (which malware might get if your device isn't up to dage ons security patches) Read screen: not without permission, even then not on protected screens, unless the malware has gained root access If the app doesn't get root, the Android sandbox should protect you sufficiently against attacks on the key store of Google Authenticator. However, if you copy the code to the device clipboard, the malware might read the code from there.
- btrettel 7y ago
  I believe my phone was compromised via CamScanner, and I factory reset my phone, changed the passwords to every account I used on my phone, and rotated every entry in my TOTP app. Not sure if any of that was necessary, but better safe than sorry as far as I'm concerned.
buildzr 7y ago
> So a dropper might be used to install malware that steals banking credentials or generates fake advertising clicks or signs up for fake subscriptions. This is basically wrong, you can't modify a browser or charge someone's card without breaking out of the sandbox. Worst case they could burn your cellular data or encrypt your photos and such if you gave it permission. Is there any evidence they maliciously used this or was it probably just in there so they could drop more creepy ad code?
- hathawsh 7y ago
  The exploit downloaded and executed code from some server, so there may have been targeted payloads that rooted specific devices. I hope I'm wrong, but that's the impression I get from the Kaspersky post: https://securelist.com/dropper-in-google-play/92496/ https://securelist.com/dropper-in-google-play/92496/
- nisa 7y ago
  > without breaking out of the sandbox. Every Android Security Advisory I looked at contained at least one often multiple Elevation of Privilegues or straight Remote Code Execution holes - my Android One smartphone usally gets the updates 20-35 days after the release of the Advisory - I'm the only one in my wider family that even got a smartphone that still receives monthly security updates at all. Most of them are stuck on an old Android version with years old patch-levels. So I doubt this is hard at all. I have no idea if there are public exploits for these issues but they probably exist.
habosa 7y ago
I've been using this app for years and also telling other people to use it, so this sucks. If anyone else is looking for a replacement there's a Microsoft app called "Office Lens" that seems to do a really nice job and is as safe a bet as anything.
- curiousgal 7y ago
  I use Adobe Scan.
- eknkc 7y ago
  Google Drive has a scanner too.
- emmelaich 7y ago
  It's amazing to me that so few people are not aware of the excellent scanning apps from Google. They work better, you're not expanding your privacy risk ... and they're free and integrated with Google docs etc. * namely, Drive Scan and Photoscan
  - GordonS 7y ago
    Never heard of Google Drive Scan, but I can't find it in the Play Store either?
    - shthed 7y ago
      It's built into the Google Drive app, press + and scan. https://support.google.com/drive/answer/3145835 https://support.google.com/drive/answer/3145835
  - girvo 7y ago
    I’ll vouch for PhotoScan. Great for digitising Instax shots!
  - JohnJamesRambo 7y ago
    I use Google Docs all the time and need those and have never heard of them. Google is so frustrating sometimes.
deleted 7y ago
[deleted]
doggydogs94 7y ago
Maybe Google should pay more attention to their own ecosystem and less focus on embarrassing other vendors.
- panpanna 7y ago
  I too wish they should stop using their resources to find security problems Apple should have found themselves. But I very much disagree this is about embarrassing Apple. In fact, Google is doing them a huge favor. (The iMessage bug for example could have been turned into a worm and infected ALL iPhones on the planet in matter of minutes if it was found by blackhat hackers instead. Apple should be thankful)
  - snazz 7y ago
    Project Zero is doing Apple a huge favor. Google isn’t a single organism; Project Zero isn’t taking away resources from the Android division. And it’s not like Project Zero doesn’t look for Android vulnerabilities, it’s just that iOS is a much more interesting target from a security standpoint because it’s widely considered to be actually secure (not to mention that people actually run the latest version of it). I think Fuchsia can’t come fast enough for an opportunity to break backwards compatibility and catch up with the rest of the world on security. (I also think that Google needs to put some more humans in the Play Store review process, but as we all know Google despises using humans when they can automate a process.)
    - panpanna 7y ago
      If we only consider security, Fuchsia is another horrible use of resources. How many Android issues are due to kernel bugs?? Of those, how many are due to Google using is own heavily modifed version of an outdated kernel? Agreed on humans, Google needs more humans and fewer robots.
a254613e 7y ago
So what exactly did this malware do most of the time? In the original kaspersky report it says "For example, an app with this malicious code may show intrusive ads and sign users up for paid subscriptions.". So how/did it sign up users for paid subscriptions without user interaction? Does android allow something like that? Aren't all apps sandboxed? In general how is the android sandboxing and permission system nowadays? I'm considering switching back to it from iOS, but reports like this are kinda discouraging.
- panpanna 7y ago
  I don't know this particular case, but "malware" seems to be used to describe "adware" these days by some blogs to generate more clicks. Android is just as secure/unsecure as iOS. Some recent "malware" campaigns targeted both platforms but in general Apple silently removes them while Android gets scrutinized to death. Edit: to answer your questions, these apps still operate within the limits of the sandbox. Which is maybe a reason the term "malware" should not be used.
  - scarface74 7y ago
    This is clearly not the case. Not only is Android’s permission system more permissive, most Android phones don’t get updates as frequently and definitely not as far long as iOS.
    - lern_too_spel 7y ago
      > most Android phones don’t get updates as frequently and definitely not as far long as iOS. This is irrelevant. Most phones period don't get updates frequently. Does that mean you shouldn't buy any phone? No, you should buy a phone that does get updated, and there are plenty of Android options.
      - scarface74 7y ago
        IOS 12 supports devices back to 2013. How many Android devices get support that far back? Apple also released an OS update in July of this year for iPhones back to the iPhone 4S from 2011. https://iphone.appleinsider.com/articles/19/07/22/apple-issues-ios-936-and-ios-1034-updates-for-older-iphone-and-ipad-models https://iphone.appleinsider.com/articles/19/07/22/apple-issu...
Abishek_Muthian 7y ago
PlayProtect is not detecting and warning users about CamScanner even when it has been removed from the Playstore. I've tested it via manual scan on PlayProtect as well, no dice. Isn't that what it is supposed to do? Has anyone ever got any app flagged by PlayProtect? If it's useless, then rather I would disable it than to give it access to all my installed apps. Google Engineers here, please ping your Google Play team reg PlayProtect. Edit: More detail.
- AnssiH 7y ago
  Do you have one of the affected versions installed? The versions since July 30th are not affected (according to https://news.ycombinator.com/item?id=20826213 https://news.ycombinator.com/item?id=20826213).
  - dblohm7 7y ago
    I did, and no, PlayProtect did nothing.
  - hathawsh 7y ago
    I have auto-update turned on, yet I just discovered CamScanner was apparently stuck on an unsafe version from July. Now CamScanner seems to be removed from the play store, yet I had to remove the app manually. Play Protect still thought everything was fine. I have a Google Pixel running stock firmware. I guess it's time for a factory reset.
  - Abishek_Muthian 7y ago
    I had paid version installed with auto update and I didn't receive any warning via PlayProtect. Kaspersky blog mentioned that the malware was part of the advertising module; so I assumed it gets activated only on the free version, so I manually scanned using PlayProtect in a mobile with free CamScanner installed. Since both of the instances I've mentioned has auto update, it's likely they were >July 30. But Kaspersky did mention that the latest version was indeed affected.
- mtgx 7y ago
  Every few months, Google's Android team writes a new blog post patting themselves on the back about how good Android security is thanks to Play Protect and that you almost don't need security patches because Play Protect is that good. And every time I call bullshit on that, but sadly it happens on Android fan forums, so few take it seriously, and instead prefer to cheer on for Google. Play Protect is nothing but an antivirus, and as such it's as good/useless as all the other antiviruses. In other words, it won't catch the vast majority of new malware (because obviously malware creators would first test their malware against Play Protect before launching it into the wild, and release it only if it bypasses the antivirus). It's only really good (if that) at preventing other users from getting infected with malware it already knows about.
anandkunwar 7y ago
"Scam Cancer", a friend once called it. I suppose he was right.
panpanna 7y ago
> CamScanner was actually a legitimate app, with no malicious intensions whatsoever, for quite some time. It used ads for monetization and even allowed in-app purchases. However, at some point, that changed, and recent versions of the app shipped with an advertising library containing a malicious module. IMO, this is more a legal matter than a technical one. Google needs to sue this company, not engage in a whack-a-mole game with their AI algorithm and useless scanner.
- GordonS 7y ago
  That's a little presumptuous - isn't it likely that CamScanner was somehow compromised? This could happen in the source code or in the build and release pipeline.
  - gdfasfklshg4 7y ago
    Then it is a police matter...
    - panpanna 7y ago
      Yeah, we can't just remove the app and think that would fix the issue. Otherwise this is bound to happen again.
  - ajsnigrutin 7y ago
    ...or they just included some [pupular ad library] that has gone bad, and noone checked.
PunksATawnyFill 7y ago
So what do they do? Revoke the app and developer account of that guy who wrote the free transit-mapping app for Montreal. Google: hypocrisy on a colossal scale.
- makomk 7y ago
  On the other hand, remember that guy whose complaint about Google termininating his developer account "for no reason" made the HN front page a couple of weeks back? https://medium.com/@tokata/how-google-play-terminated-a-developer-for-no-reason-e4d760e9f472 https://medium.com/@tokata/how-google-play-terminated-a-deve... According to his blog post, his "anti-piracy system" used "custom techniques including dynamic bytecode loading from a local app resource", the exact same technique used by this malicious code to hide from detection.
chkuendig 7y ago
Guess what - this was caused by a third-party ad network: https://twitter.com/CamScanner/status/1166733219841986561/photo/1 https://twitter.com/CamScanner/status/1166733219841986561/ph...
- Zenst 7y ago
  That is and for many, always an issue. Adverts help pay for content, be that a game or website - people literally make a living that way that it has become a bit of a defacto approach. But when you are tied to including some code that goes off to a site that you have no or very little control over, you are outsourcing part of your company (web or app) into the hands of another in which, if they mess up. You are the the one that takes all the PR flack. After all, if somebody slips an exploit into an AD hosted on a 3rd party site and offered up by a reputable AD serving company. Whilst the blame and fault may clearly be with the AD serving company for not screening what they offer. You are the ones that from a consumer and as it also transpires - the media as the one to blame. As we all know, corrections and retractions are always less viewed and eyeballed than the initial drama article based upon a small picture view of the issue/drama, instead of the root cause. Even with the best most respected media sites in the World, such retractions/corrections never get the same attention as the initial article of drama and doom. That is one problem that even today, still prevails - media does an article with the finger pointing at one direction and the truth, even when it comes out and updated, never tracks as well as the initial finger pointing and is very much the old saying of "if enough mud is slung, some will stick". {EDIT spelling and below} With that all said, ad-blocking by the likes of https://pi-hole.net/ https://pi-hole.net/ is more than just avoiding AD's, it's about privacy and more and more so - security.
  - Ajedi32 7y ago
    Here it sounds like the malicious code was in the advertising SDK itself, so ad blocking at the network level wouldn't necessarily have helped.
    - Zenst 7y ago
      Yes and I can't think of one single developer who has had to include AD's, ever scrutinising the code they are offered (though I'd bet one that they are out there and hopefully comment back), let alone been able to change it due to the terms such AD requirements impose. Maybe, Google et all need to make sure APP's have an even more granular control of permissions in that you can seperate the APP from the 3rd party AD's. that would only help more, but alas I suspect that may never happen as that would enable AD control much more accessible at a level that goes against their revenue stream.
env123 7y ago
Nice advert by Kaspersky in partnership with CamScanner
- aclsid 7y ago
  I seriously doubt that CamScanner wanted that kind of publicity. As for Kaspersky, they are like gun makers, selling you a false/real sense of security depending on who you ask.
pjc50 7y ago
Ironically this is right next to "Google just deleted my nearly 10-year-old free and open-source Android app" on the front page. False negatives and false positives.
- higginsc 7y ago
  At a sufficiently large scale, even rare events happen constantly.
  - ignoramous 7y ago
    Related news.yc discussion: https://news.ycombinator.com/item?id=14038044 https://news.ycombinator.com/item?id=14038044
- toss1 7y ago
  IOW, Google is clearly failing to keep up and accurately monitor it's Play Store. It is not an easy job to do even at small scales, and their scale is massive. But, it is the job they signed up for, and they need to properly provide resources for it (and it isn't like Google or Apple are short of resources).
godshatter 7y ago
Malicious code found in ad networks, but I still get downvoted every time I complain that a given website was unusable by me because after trying to enable some (hopefully safe) javascript domains it still wouldn't render in a usable form. There is a problem here. Trying to protect yourself from third-party malware running on your machine breaks half the damn web because of our over-reliance on javascript frameworks and ad networks. We have to find a better way.
LegendaryLegend 7y ago
Why would you scan a cat though?
cannedslime 7y ago
Anyone remembers when the android play store wasn't ranked by how much revenue google got out of it? Remember when even google employees put out their own apps free of ads like solitare etc. But all these free, ad-less apps mysteriously either disappeared from play store or got sent to the very bottom of every search query?
jimbo1qaz 7y ago
I am not surprised that CamScanner included a malicious advertising SDK, considering Exodus Privacy shows it has 17-19 trackers: https://reports.exodus-privacy.eu.org/en/reports/search/com.intsig.camscanner/ https://reports.exodus-privacy.eu.org/en/reports/search/com....
tripzilch 7y ago
So does the ad network just get away with this? Isn't it criminal to spread malware like this? Seems they were in a serious business relation with CamScanner, not some seedy underground place. Do other apps run the same ad library, do they run the same risk?

301 points by GordonS 7y ago

For the past few days I've been seen spam events in my calendar about "free iPhones" and "webcam girls" - I couldn't figure out where they were coming from. I have CamScanner installed, so presumably that's the source... Now, I can remove CamScanner (which is a shame, it's a really good app), but how can I ensure the trojan is also removed? I tried the Avast AntiVirus app, but it didn't find anything. What does everyone else do for AV on Android?

basicplus2 7y ago
Try Sophos Mobile Security https://play.google.com/store/apps/details?id=com.sophos.smsec https://play.google.com/store/apps/details?id=com.sophos.sms...
JasonHarrison 7y ago
Apparently calendar invite spam is on the rise, and CamScanner might not be related. See https://www.theverge.com/2019/8/23/20829615/google-calendar-spam-events-sharing-email-how-to-stop https://www.theverge.com/2019/8/23/20829615/google-calendar-...
dantheman 7y ago
The calendar thing is probably this: https://lifehacker.com/how-to-prevent-spammers-from-infiltrating-your-google-c-1837539886 https://lifehacker.com/how-to-prevent-spammers-from-infiltra... check your emails
- oh_sigh 7y ago
  I got hit by this exact one(free iphone X) recently, and couldn't find anything in my email. Surely, that kind of email would just look like spam, so isn't the correct solution for google to just not auto-add calendar events if their source email is spam?
  - abrookewood 7y ago
    Yep, my wife got exactly the same thing. Apparently those entries will appear in your calendar even if the email was sent to spam. You have to configure gmail to not automatically add the entries.
    - wolfd 7y ago
      This seems like a pretty big oversight on Gmail's part.
- GordonS 7y ago
  No, it wasn't that - I had the auto invite setting turned off already, and I didn't have any emails that matched the calendar entries. I was fairly sure it must be malware, but I had no idea how to find out which app it was. I tried Avast AntiVirus, but it found nothing. After finding out about CamScanner I tried Kapersky AV, which did flag CamScanner as malware.
lern_too_spel 7y ago
> how can I ensure the trojan is also removed? The trojan is inside the app. Remove the app, and you remove the trojan.
- giancarlostoro 7y ago
  Is this a solid guarantee? Usually on Windows a Trojan replicates itself outside of the main application it was installed through.
  - snazz 7y ago
    I think it would have to exploit a vulnerability in Android’s sandboxing mechanism (not hard considering how many people can’t or don’t update) to be able to become separate from its parent application. Win32 doesn’t do any kind of app sandboxing at all.
snazz 7y ago
Most antivirus software on Android is more like malware itself. You’re better off only using applications from F-Droid, very carefully vetting everything yourself, or not using Android. The Android security model is getting better, but it’s still really broken compared to anything on iOS.
ignoramous 7y ago
AVs for Android are themselves a privacy nightmare. You need to grant them all sorts of permissions and their privacy policies, oft times, leaves a lot to be desired. That said, Malwarebytes is decent, and so are some other offerings, but I wouldn't recommend using any. Here's basic steps you can follow: 1. Uninstall apps you don't use. 2. Firewall apps that do not require internet access to function (Calculator, CamScanner, Alarm Clock etc) 3. Block trackers and ads (use pi-hole and set private-dns). 4. Remove permissions from apps that do not really require the permission (Bank apps with all sorts of permissions). 5. Disable notification for apps that do not really need to notify you of anything at all (most games). 6. Install apps you're not comfortable using in work-profile, or in a privacy friendly app-sandbox (parallel-space started as one, but alas, aren't privacy-friendly anymore).

thebruce87m 7y ago

Is this just a non issue on iOS? If so, why?

0942v8653 7y ago
I had the CamScanner app on my iPhone for quite some time, then uninstalled when I launched it and saw (IIRC) Chinese text appear. I'm assuming that ownership changed around that time, and if the Android and iOS apps have the same owner, I wouldn't trust it either. An iOS trojan would have slightly more limited impact, but if (for example) you gave the app "Access to your Photos" in order to save something, the app would still be able to read all of your photos and potentially send them back to home base as it chooses.
- aitchnyu 7y ago
  I guess its time to disclose transfers and sales of mobile apps and browser extensions to end users.
DevKoala 7y ago
I am curious too. I presume it is due to better sand boxing and a more transparent system to request resource access.
- codesushi42 7y ago
  It is easier to run background processes in Android by starting new services with their own dedicated process. And it's quite easy to run headless apps/processes.
JustSomeNobody 7y ago
Because 80+% of users are on the latest os version and the inverse is true of Android.
- lern_too_spel 7y ago
  This doesn't use an exploit in Android and instead runs payloads with the permissions of the app. The same can happen on iOS and very likely does in many apps but is reported less often because there is no economic incentive (the App Store doesn't allow antivirus services). For an example, see how Xcodeghost went unnoticed by Apple.

sp332 7y ago

Just to clarify the headline: the app didn't have malware when most of the users installed it. A recent update added the malware.

pbhjpbhj 7y ago
And (based on a very brief scan read of the OP) the app is called CamScanner and is used to create PDFs.
exolymph 7y ago
Guess how surprised I am that the headline is inaccurate.
AdmiralAsshat 7y ago
That's not accurate, really. 100M+ users didn't install the thing overnight--they've downloaded it over the course of years. If they had it installed, and they had automatic updates turned on (which most people do), there was a several month window when they had a version of the app that contained malware, even if it was eventually removed.
- sp332 7y ago
  Not sure how that's different from what I said, but yeah.
baroffoos 7y ago
This seems like such a common occurrence, not only with android apps but anything with auto updates. It seems like the only solution right now is to purely limit yourself to apps from f-droid. Not necessarily because open source is resistant to this, but because no spammer would bother attacking such a small group.
- saagarjha 7y ago
  Sounds much like the Chrome Extension Store, where people would hijack/buy popular extensions and add malicious scripts to them.

blisterpeanuts 7y ago

Rather than disappear it from the Store entirely, it would be nice if Google could leave a placeholder with a warning; at least it would serve an educational purpose. Also, does the Play Store app have a way to notify users of a banned app that is still installed? I decided to check my wife's phone proactively, but I don't think she would otherwise have had a clue of malware (but has been getting weird and annoying pop-up ads).

master-litty 7y ago
If the purpose is education, I feel emails or some other direct notification would be far more helpful. It's not like we usually go to an app's Play store page after installation, save reviewing.
sp332 7y ago
Or in this case, rolled back to a previous non-infected version.
- aflag 7y ago
  The new versions are also unaffected. It only had malware for a period of time while the developers were using a 3rd pat library with the malware.
saagarjha 7y ago
> Rather than disappear it from the Store entirely, it would be nice if Google could leave a placeholder with a warning; at least it would serve an educational purpose. This would also make the Play Store look bad.
- luckylion 7y ago
  Which would also be fitting, wouldn't it? Google missed it and dropped the ball.

jimrandomh 7y ago

Does anyone have information on affected and unaffected version numbers? I have a version of this installed, but it's an old one, and may not have updated to the malware one because I disabled automatic updates. (Specifically because I was afraid of this, in fact.)

bleachedsleet 7y ago
Yes. There's a Reddit thread with the version information. I'll see if I can find it later when I'm off work but it made the front page so you could probably search it out fairly easily.
tabjsina 7y ago
May 22, 2019: 5.10.6.20190522 – safe June 6, 2019: 5.11.0.20190611 – safe June 14, 2019: 5.11.3.20190614 – safe June 16, 2019: 5.11.3.20190616 – unsafe June 24, 2019: 5.11.5.20190624 – unsafe July 10, 2019: 5.11.7.20190710 – unsafe July 23, 2019: 5.12.0.20190723 – unsafe July 25, 2019: 5.12.0.20190725 – unsafe July 30, 2019: 5.12.0.20190730 – safe August 8, 2019: 5.12.3.20190809 – safe August 14, 2019: 5.12.3.20190814 – safe August 16, 2019: 5.12.5.20190816 – safe August 20, 2019: 5.12.5.20190820 – safe Source: https://www.reddit.com/r/Android/comments/cwk0y4/camscanner_booted_from_play_store_after_discovery/eyc0vin https://www.reddit.com/r/Android/comments/cwk0y4/camscanner_...
- asveikau 7y ago
  Any speculation why they would only leave in the malicious code for about a month? Changed their mind? Done without full knowledge? Achieved some high value heist and rolled it back?
  - jeroenhd 7y ago
    An update to an ad library is what caused the malicious code in the first place. Presumably either the infected library was updated again or the developers switched libraries. The developers behind this app did not add any malicious code they wrote themselves. The attack either came from the ad library or the ad library was hacked.

Deimorz 7y ago

Blogspam of https://www.kaspersky.com/blog/camscanner-malicious-android-app/28156/ https://www.kaspersky.com/blog/camscanner-malicious-android-... (Forbes contributor posts are almost always blogspam)

mkolodny 7y ago
What's blogspam?
- McGlockenshire 7y ago
  Blogspam happens when someone writes a blog article that sources or references something from a more authoritative source, such as this one linking to the Kaspersky story, without adding anything of significance to the original.
  - GordonS 7y ago
    Which I don't think is exactly the case here - the Forbes site is not a blog, it's a news site. This article is their reporting of something newsworthy (even if not the best quality article).
    - chmod775 7y ago
      There's no fundamental difference between a news site and a blog. A lot of them even use the same software. News sites just tend to have lower quality entries than blogs and often engage in blogspam instead of providing links to superior sources or adding something of value. Obviously. Since they want to keep people on their site. I wonder what the average time spent on a "news article" vs. a "blog post" is.
      - mtberatwork 7y ago
        > There's no fundamental difference between a news site and a blog. There is a difference. A blog is short for web log which implies a personal journal. Anyone can publish a blog without editorial oversight. A news site implies that professional journalists are producing reports with editorial and literary standards. Clearly many media companies blur this line though to the detriment of readers and journalists. > A lot of them even use the same software. What difference does that make? The vast majority of web sites use the same web server software (Apache/Nginx)...and the same software elsewhere in the stack.

flyGuyOnTheSly 7y ago

Can an "app with Malware" access my Google Authenticator credentials? Or read my screen while I am viewing them?

jeroenhd 7y ago
Google auth credentials: not without root (which malware might get if your device isn't up to dage ons security patches) Read screen: not without permission, even then not on protected screens, unless the malware has gained root access If the app doesn't get root, the Android sandbox should protect you sufficiently against attacks on the key store of Google Authenticator. However, if you copy the code to the device clipboard, the malware might read the code from there.
btrettel 7y ago
I believe my phone was compromised via CamScanner, and I factory reset my phone, changed the passwords to every account I used on my phone, and rotated every entry in my TOTP app. Not sure if any of that was necessary, but better safe than sorry as far as I'm concerned.

buildzr 7y ago

> So a dropper might be used to install malware that steals banking credentials or generates fake advertising clicks or signs up for fake subscriptions. This is basically wrong, you can't modify a browser or charge someone's card without breaking out of the sandbox. Worst case they could burn your cellular data or encrypt your photos and such if you gave it permission. Is there any evidence they maliciously used this or was it probably just in there so they could drop more creepy ad code?

hathawsh 7y ago
The exploit downloaded and executed code from some server, so there may have been targeted payloads that rooted specific devices. I hope I'm wrong, but that's the impression I get from the Kaspersky post: https://securelist.com/dropper-in-google-play/92496/ https://securelist.com/dropper-in-google-play/92496/
nisa 7y ago
> without breaking out of the sandbox. Every Android Security Advisory I looked at contained at least one often multiple Elevation of Privilegues or straight Remote Code Execution holes - my Android One smartphone usally gets the updates 20-35 days after the release of the Advisory - I'm the only one in my wider family that even got a smartphone that still receives monthly security updates at all. Most of them are stuck on an old Android version with years old patch-levels. So I doubt this is hard at all. I have no idea if there are public exploits for these issues but they probably exist.

habosa 7y ago

I've been using this app for years and also telling other people to use it, so this sucks. If anyone else is looking for a replacement there's a Microsoft app called "Office Lens" that seems to do a really nice job and is as safe a bet as anything.

curiousgal 7y ago
I use Adobe Scan.
eknkc 7y ago
Google Drive has a scanner too.
emmelaich 7y ago
It's amazing to me that so few people are not aware of the excellent scanning apps from Google. They work better, you're not expanding your privacy risk ... and they're free and integrated with Google docs etc. * namely, Drive Scan and Photoscan
- GordonS 7y ago
  Never heard of Google Drive Scan, but I can't find it in the Play Store either?
  - shthed 7y ago
    It's built into the Google Drive app, press + and scan. https://support.google.com/drive/answer/3145835 https://support.google.com/drive/answer/3145835
- girvo 7y ago
  I’ll vouch for PhotoScan. Great for digitising Instax shots!
- JohnJamesRambo 7y ago
  I use Google Docs all the time and need those and have never heard of them. Google is so frustrating sometimes.

deleted 7y ago

[deleted]

doggydogs94 7y ago

Maybe Google should pay more attention to their own ecosystem and less focus on embarrassing other vendors.

panpanna 7y ago
I too wish they should stop using their resources to find security problems Apple should have found themselves. But I very much disagree this is about embarrassing Apple. In fact, Google is doing them a huge favor. (The iMessage bug for example could have been turned into a worm and infected ALL iPhones on the planet in matter of minutes if it was found by blackhat hackers instead. Apple should be thankful)
- snazz 7y ago
  Project Zero is doing Apple a huge favor. Google isn’t a single organism; Project Zero isn’t taking away resources from the Android division. And it’s not like Project Zero doesn’t look for Android vulnerabilities, it’s just that iOS is a much more interesting target from a security standpoint because it’s widely considered to be actually secure (not to mention that people actually run the latest version of it). I think Fuchsia can’t come fast enough for an opportunity to break backwards compatibility and catch up with the rest of the world on security. (I also think that Google needs to put some more humans in the Play Store review process, but as we all know Google despises using humans when they can automate a process.)
  - panpanna 7y ago
    If we only consider security, Fuchsia is another horrible use of resources. How many Android issues are due to kernel bugs?? Of those, how many are due to Google using is own heavily modifed version of an outdated kernel? Agreed on humans, Google needs more humans and fewer robots.

a254613e 7y ago

So what exactly did this malware do most of the time? In the original kaspersky report it says "For example, an app with this malicious code may show intrusive ads and sign users up for paid subscriptions.". So how/did it sign up users for paid subscriptions without user interaction? Does android allow something like that? Aren't all apps sandboxed? In general how is the android sandboxing and permission system nowadays? I'm considering switching back to it from iOS, but reports like this are kinda discouraging.

panpanna 7y ago
I don't know this particular case, but "malware" seems to be used to describe "adware" these days by some blogs to generate more clicks. Android is just as secure/unsecure as iOS. Some recent "malware" campaigns targeted both platforms but in general Apple silently removes them while Android gets scrutinized to death. Edit: to answer your questions, these apps still operate within the limits of the sandbox. Which is maybe a reason the term "malware" should not be used.
- scarface74 7y ago
  This is clearly not the case. Not only is Android’s permission system more permissive, most Android phones don’t get updates as frequently and definitely not as far long as iOS.
  - lern_too_spel 7y ago
    > most Android phones don’t get updates as frequently and definitely not as far long as iOS. This is irrelevant. Most phones period don't get updates frequently. Does that mean you shouldn't buy any phone? No, you should buy a phone that does get updated, and there are plenty of Android options.
    - scarface74 7y ago
      IOS 12 supports devices back to 2013. How many Android devices get support that far back? Apple also released an OS update in July of this year for iPhones back to the iPhone 4S from 2011. https://iphone.appleinsider.com/articles/19/07/22/apple-issues-ios-936-and-ios-1034-updates-for-older-iphone-and-ipad-models https://iphone.appleinsider.com/articles/19/07/22/apple-issu...

Abishek_Muthian 7y ago

PlayProtect is not detecting and warning users about CamScanner even when it has been removed from the Playstore. I've tested it via manual scan on PlayProtect as well, no dice. Isn't that what it is supposed to do? Has anyone ever got any app flagged by PlayProtect? If it's useless, then rather I would disable it than to give it access to all my installed apps. Google Engineers here, please ping your Google Play team reg PlayProtect. Edit: More detail.

AnssiH 7y ago
Do you have one of the affected versions installed? The versions since July 30th are not affected (according to https://news.ycombinator.com/item?id=20826213 https://news.ycombinator.com/item?id=20826213).
- dblohm7 7y ago
  I did, and no, PlayProtect did nothing.
- hathawsh 7y ago
  I have auto-update turned on, yet I just discovered CamScanner was apparently stuck on an unsafe version from July. Now CamScanner seems to be removed from the play store, yet I had to remove the app manually. Play Protect still thought everything was fine. I have a Google Pixel running stock firmware. I guess it's time for a factory reset.
- Abishek_Muthian 7y ago
  I had paid version installed with auto update and I didn't receive any warning via PlayProtect. Kaspersky blog mentioned that the malware was part of the advertising module; so I assumed it gets activated only on the free version, so I manually scanned using PlayProtect in a mobile with free CamScanner installed. Since both of the instances I've mentioned has auto update, it's likely they were >July 30. But Kaspersky did mention that the latest version was indeed affected.
mtgx 7y ago
Every few months, Google's Android team writes a new blog post patting themselves on the back about how good Android security is thanks to Play Protect and that you almost don't need security patches because Play Protect is that good. And every time I call bullshit on that, but sadly it happens on Android fan forums, so few take it seriously, and instead prefer to cheer on for Google. Play Protect is nothing but an antivirus, and as such it's as good/useless as all the other antiviruses. In other words, it won't catch the vast majority of new malware (because obviously malware creators would first test their malware against Play Protect before launching it into the wild, and release it only if it bypasses the antivirus). It's only really good (if that) at preventing other users from getting infected with malware it already knows about.

anandkunwar 7y ago

"Scam Cancer", a friend once called it. I suppose he was right.

panpanna 7y ago

> CamScanner was actually a legitimate app, with no malicious intensions whatsoever, for quite some time. It used ads for monetization and even allowed in-app purchases. However, at some point, that changed, and recent versions of the app shipped with an advertising library containing a malicious module. IMO, this is more a legal matter than a technical one. Google needs to sue this company, not engage in a whack-a-mole game with their AI algorithm and useless scanner.

GordonS 7y ago
That's a little presumptuous - isn't it likely that CamScanner was somehow compromised? This could happen in the source code or in the build and release pipeline.
- gdfasfklshg4 7y ago
  Then it is a police matter...
  - panpanna 7y ago
    Yeah, we can't just remove the app and think that would fix the issue. Otherwise this is bound to happen again.
- ajsnigrutin 7y ago
  ...or they just included some [pupular ad library] that has gone bad, and noone checked.

PunksATawnyFill 7y ago

So what do they do? Revoke the app and developer account of that guy who wrote the free transit-mapping app for Montreal. Google: hypocrisy on a colossal scale.

makomk 7y ago
On the other hand, remember that guy whose complaint about Google termininating his developer account "for no reason" made the HN front page a couple of weeks back? https://medium.com/@tokata/how-google-play-terminated-a-developer-for-no-reason-e4d760e9f472 https://medium.com/@tokata/how-google-play-terminated-a-deve... According to his blog post, his "anti-piracy system" used "custom techniques including dynamic bytecode loading from a local app resource", the exact same technique used by this malicious code to hide from detection.

chkuendig 7y ago

Guess what - this was caused by a third-party ad network: https://twitter.com/CamScanner/status/1166733219841986561/photo/1 https://twitter.com/CamScanner/status/1166733219841986561/ph...

Zenst 7y ago
That is and for many, always an issue. Adverts help pay for content, be that a game or website - people literally make a living that way that it has become a bit of a defacto approach. But when you are tied to including some code that goes off to a site that you have no or very little control over, you are outsourcing part of your company (web or app) into the hands of another in which, if they mess up. You are the the one that takes all the PR flack. After all, if somebody slips an exploit into an AD hosted on a 3rd party site and offered up by a reputable AD serving company. Whilst the blame and fault may clearly be with the AD serving company for not screening what they offer. You are the ones that from a consumer and as it also transpires - the media as the one to blame. As we all know, corrections and retractions are always less viewed and eyeballed than the initial drama article based upon a small picture view of the issue/drama, instead of the root cause. Even with the best most respected media sites in the World, such retractions/corrections never get the same attention as the initial article of drama and doom. That is one problem that even today, still prevails - media does an article with the finger pointing at one direction and the truth, even when it comes out and updated, never tracks as well as the initial finger pointing and is very much the old saying of "if enough mud is slung, some will stick". {EDIT spelling and below} With that all said, ad-blocking by the likes of https://pi-hole.net/ https://pi-hole.net/ is more than just avoiding AD's, it's about privacy and more and more so - security.
- Ajedi32 7y ago
  Here it sounds like the malicious code was in the advertising SDK itself, so ad blocking at the network level wouldn't necessarily have helped.
  - Zenst 7y ago
    Yes and I can't think of one single developer who has had to include AD's, ever scrutinising the code they are offered (though I'd bet one that they are out there and hopefully comment back), let alone been able to change it due to the terms such AD requirements impose. Maybe, Google et all need to make sure APP's have an even more granular control of permissions in that you can seperate the APP from the 3rd party AD's. that would only help more, but alas I suspect that may never happen as that would enable AD control much more accessible at a level that goes against their revenue stream.

env123 7y ago

Nice advert by Kaspersky in partnership with CamScanner

aclsid 7y ago
I seriously doubt that CamScanner wanted that kind of publicity. As for Kaspersky, they are like gun makers, selling you a false/real sense of security depending on who you ask.

pjc50 7y ago

Ironically this is right next to "Google just deleted my nearly 10-year-old free and open-source Android app" on the front page. False negatives and false positives.

higginsc 7y ago
At a sufficiently large scale, even rare events happen constantly.
- ignoramous 7y ago
  Related news.yc discussion: https://news.ycombinator.com/item?id=14038044 https://news.ycombinator.com/item?id=14038044
toss1 7y ago
IOW, Google is clearly failing to keep up and accurately monitor it's Play Store. It is not an easy job to do even at small scales, and their scale is massive. But, it is the job they signed up for, and they need to properly provide resources for it (and it isn't like Google or Apple are short of resources).

godshatter 7y ago

Malicious code found in ad networks, but I still get downvoted every time I complain that a given website was unusable by me because after trying to enable some (hopefully safe) javascript domains it still wouldn't render in a usable form. There is a problem here. Trying to protect yourself from third-party malware running on your machine breaks half the damn web because of our over-reliance on javascript frameworks and ad networks. We have to find a better way.

LegendaryLegend 7y ago

Why would you scan a cat though?

cannedslime 7y ago

Anyone remembers when the android play store wasn't ranked by how much revenue google got out of it? Remember when even google employees put out their own apps free of ads like solitare etc. But all these free, ad-less apps mysteriously either disappeared from play store or got sent to the very bottom of every search query?

jimbo1qaz 7y ago

I am not surprised that CamScanner included a malicious advertising SDK, considering Exodus Privacy shows it has 17-19 trackers: https://reports.exodus-privacy.eu.org/en/reports/search/com.intsig.camscanner/ https://reports.exodus-privacy.eu.org/en/reports/search/com....

tripzilch 7y ago

So does the ad network just get away with this? Isn't it criminal to spread malware like this? Seems they were in a serious business relation with CamScanner, not some seedy underground place. Do other apps run the same ad library, do they run the same risk?