17 ms·

Malware on My Android Phone

334 points by rossjudson 6y ago

asiando 6y ago
What surprised here is that Android doesn’t have a native QR scanner. I’ve always assumed that iOS was late to the game and that Google Search/Lens handled QRs since 1999. Is that not the case (anymore)?
- technion 6y ago
  My Huawei phone actually does come with a QR scanner. You just have to open the built in camera app, then click this icon[0]. It defaults to the translator camera, which I find really that you can just point at text and it translates it on your screen. Then there's a picture of a square with a line down the center that turns on the QR scanner. As you can imagine, when all the covid checkins started, I couldn't find this. Everyone would say to me "just open the camera on your iPhone it's easy" as though it was a given that every visitor was using an Apple phone. I went through three different QR apps based on what I found on the play store and all of them blasted me with inappropriate ads I kept wishing I didn't open in public. A bit if visibility in the UX would have solved this. [0] https://ibb.co/L5XG21G https://ibb.co/L5XG21G
- morsch 6y ago
  The versions of Android that vendors ship usually have a QR scanner. For example, Samsung's camera app reacts to them by default. I don't think AOSP has a QR reader, but Lineage OS ships a camera that reads them.
  - peteri 6y ago
    It's in the Google Lens app on my Pixel 5.
  - morsch 6y ago
    I'll add that even though most phones have some sort of built-in reader, there are many reasons a developer would want to use a standalone reader. The Samsung reader launches URLs (99% of QR codes I encounter), and it understands Text and VCARD as well, but I don't know that it understands all kinds of arbitrary or custom QR codes you might want to define.
- rjmunro 6y ago
  The issue is that some malware installed itself with the name QR scanner, not that Android does or doesn't have a QR scanner. Most Android camera apps (each phone comes with its own) will recognise QR codes fine, although the UI is sometimes annoying.
kwdc 6y ago
"Google Play Protect was also completely unhelpful, which was a big disappointment. First because Google certainly knows which applications they removed from their store for malware reasons, but even so, I would expect Google Play Protect to at least flag any app it finds on my phone that is not on their store. Such an app is not necessarily malware, but it should certainly be flagged. Google Play Protect could also do some behavior profiling to analyze what apps are doing in the background. A service launching recurring VIEW intents on web sites in the background should have raised a flag to the system." Sounds good. I sense that there so many teams involved such a feature is not on their radar. So "they already know they blocked it" and "the existing installed app should be blocked" imply that two teams know what the others are doing. I'm guessing that the team that does the removal from the store has no communications path to those who would add a flagging mechanism for already installed apps.
- thatguy0900 6y ago
  " I would expect Google Play Protect to at least flag any app it finds on my phone that is not on their store. Such an app is not necessarily malware, but it should certainly be flagged." seems like Google is between a rock and a hard place here, they already catch so much heat over their treatment of third party app stores there would certainly be a lot of outrage over this if they started doing it
  - Maxburn 6y ago
    Very true, but instead of reaching in and removing your app giving a message saying "we pulled this app from the store for such and such reasons, maybe you want to review it" would be pretty nice.
    - jm_l 6y ago
      I believe that actually does happen if you installed through Google Play Store, but in this case the app was sideloaded onto the device.
pw6hv 6y ago
A QR code reader was the problem then... I am an Android user since the dawn of time and I was so surprised when my wife showed me that on her iPhone the QR code reader is embedded in her camera app... I wonder why it is not the same in any version of Android that I have used (now I am on Android One). This plus the native support for CardDav and CalDav are pushing me to try iOS next time I have to change my phone.
- romanows 6y ago
  On my Pixel 4a: Camera / Modes / Lens. That will open Google Lens which should scan QR codes.
  - muro 6y ago
    It does - just checked.
  - chaos_a 6y ago
    You can do the same on any android phone by opening the google app and tap the lens icon in the search bar.
- deleted 6y ago
  [deleted]
- izacus 6y ago
  Pretty much most of Android phones have QR code reader embedded in the camera app as well.
- Sander_Marechal 6y ago
  I have a Pixel 2. It scans QR codes with the default camera app just fine. When it detects a QR code you get a little popup you can click. It even works with regular 1D barcodes.
  - MrDresden 6y ago
    Long time Pixel user here (and an Android dev for that matter) and I had no idea the camera had qr support!
ce4 6y ago
I trust the F-Droid store more due to its curated (FOSS-software-only/no-trackers) maintainer based model and default to them if there's an app that I need, especially simple stuff that tends to mostly be adware on the playstore
- FriedrichN 6y ago
  On a side note, my bank is now forcing me to use their app which can only be downloaded from the Play Store (which I will never install). When I complained they told me it's because they think it's more secure than their current method which is a card reader, I tried to explain to them the average phone is teeming with malware, but they simply wouldn't believe me. I am currently looking for a new bank.
  - hadrien01 6y ago
    You can use AuroraStore from F-Droid, it allows you to download apps from the Play Store without a Google account.
    - simonmales 6y ago
      Nice tip!
      - Daniel_sk 6y ago
        It will probably be not good enough, many banking apps are using Google Safety Net to detect rooted or not Google certified devices with Google Play installed indirectly. AFAIK it's now quite difficult to break. I sort of understand the bank decision on this. There is a lot of malware on Android and users are easily tricked into installing some side-loaded APKs, and there is also a lot of hidden malware on Google Play which is hard to find (e.g. it downloads a payload after the store review is done). This would be a disaster since on Android you can for example use accessibility services to read any input from the user and also control the device. So you can circumvent 2FA and make transactions on behalf of the user on the device. There has been a lot banking malware on Google Play. I think they are getting it a bit under control now, but it's still very dangerous.
TooCreative 6y ago
Strange article I unlocked my phone and two accidental clicks led me to agree to a dialog that my brain immediately registered as suspicious What type of dialog can pop up on your Android screen after unlocking and install "malware"? What is "malware" here? It looks like they mean an app from the play store? The next day, I picked up my phone and when I launched Chrome, I immediately noticed it was displaying a spammy URL. How can one app alter the behavior of another?
- llarsson 6y ago
  Can't an app ask for a website to be opened, and then that would cause the standard browser to display said website and URL? It does not sound to me like the Chrome app was infected, just told to open a page.
  - UncleMeat 6y ago
    Yes this is basic (and incredibly common) behavior. The alternative is often much worse (an embedded WebView in each app to do things like open TOS pages).
- ytch 6y ago
  > How can one app alter the behavior of another? In Defcon 2, author finds a log with intent: {act=android.intent.action.VIEW Android will handle The URI with default app. The malware sends HTTP url, so it will be opened by default browser.
- sloshnmosh 6y ago
  What I believe the author is saying is that he received a push notification to chrome from the malicious app. Coincidentally, I just spent my Saturday evening pouring over malicious JavaScript hosted on Cloudfront that does extensive browser fingerprinting and if a match is made to an Android device a fake Captcha pops up in Chrome which actually enables push notifications and from there a full screen pop-up appears that vibrates the devices and claims the phone is infected with (N) viruses and the “repair now” button pulls up the Play Store app to install DFNDR antivirus/cleaner. If you look at the reviews of that app you’ll see all the angry reviews of users having their browsers hijacked. The app itself is just an advertising server wrapped around Avast’s detection engine and is funded by the Chinese Qihoo. It harvests users social media data and charges the users almost $10 a month after a 3 day trial period. Novice users are unable to delete the app if “advanced protection” is enabled because it becomes a device administrator and uses deceptive language to confuse the user trying to remove the app. If the app gets installed it will not let you clear the storage of the app from within settings even if you had never opened the app and before you agree to any terms and conditions. The fake virus warnings that lead to DFNDR have been going on every single day since 2013. I’m putting together a webpage that will include the JavaScript and other details as we speak. The Google Play Store is a dumpster fire full of scam apps and Scummy developers.
throwawaysea 6y ago
Scary. Is there such a thing as a malware scanner on Android? Are they effective or worthwhile at all? Why isn't Apple susceptible to this type of malware, seemingly?
- Daho0n 6y ago
  A malware scanner won't find an app that you gave permission to show on-top on other apps and use this to show ads. It is not doing anything it isn't allowed to do.
MrPatan 6y ago
Every native app can be hacked, or sold, to a malicious actor that will then make your phone theirs. Reduce the attack surface as much as you can!
ignoramous 6y ago
Ex-AOSP hacker here. I felt it strongly at the time too that Android didn't need anti-Malware [0] but I don't anymore. Some 5 years ago, I switched to Firefox Mobile out of annoyance because Chrome refused to block all those popups random websites would show with some prompting an app install. Google has since made a lot of improvements including tightening up which apps can install other apps (not a blanket permission anymore), running the Potentially Harmful Applications program, narrowing down fingerprinting (still some way to go as evident by TFA). Google is even locking the code up that runs outside of Android in crosvms [1]. I'm positive, things will improve [2] even if slowly because Android, at this point, is the most widely distributed OS and they can't move as fast anymore without hurting developers and users. Google did implement what they call AppOps (2013) which paved for tremendous amount of user control over app permissions. They removed AppOps citing that it was never meant to be used by end-users but by AOSP and app developers [3]. Fortunately, if Android is rooted, one can use AppOps [4]; but then rooting exposes one to an incredible amount. Besides, there are LittleSnitch-esque firewalls for both root and non-root devices [5]. [0] https://arstechnica.com/information-technology/2011/11/mobile-security-vendors-we-are-not-charlatans-and-scammers/ https://arstechnica.com/information-technology/2011/11/mobil... [1] https://youtu.be/edqJSzsDRxk https://youtu.be/edqJSzsDRxk [2] https://android-developers.googleblog.com/search/label/Security https://android-developers.googleblog.com/search/label/Secur... [3] https://www.zdnet.com/article/google-removes-awesome-but-unintended-privacy-controls-in-android-4-4-2/ https://www.zdnet.com/article/google-removes-awesome-but-uni... [4] https://github.com/MuntashirAkon/AppManager https://github.com/MuntashirAkon/AppManager [5] https://awesomeopensource.com/projects/android/firewall https://awesomeopensource.com/projects/android/firewall
gberger 6y ago
How is the average user expected to use adb and Android Studio to identify & remove malware from their phone? Android security is broken.
- Daho0n 6y ago
  Installing an app that pop-up ads isn't malware. The security model worked just fine.
- literallycancer 6y ago
  You are supposed to debloat all the malware that comes with your phone, courtesy of the manufacturer. If you are not capable of that, or don't care enough to have someone do it for you, you'll have to get used to ads. Annoying ads are considered a feature on stock Android builds.
HenryBemis 6y ago
I've switched to Android (Huawei) 2-3 years ago (after the Apple battery fiasco). I keep installed (and updated) the NoRoot Firewall app, which by default blocks all access. I also added to my mix the Nova Launcher. It makes it easier to tap&hold an app icon, gives you a quick shortcut straight to the specific app's Settings --> Apps --> specific app's properties, in which I (usually) block access to data/wifi/roaming/background (e.g. for a QR Code reader app). 90% of my apps do not need to reach out to the interweb, and I block them both on Settings as well as Block Data/Wifi on NoRoot Firewall. Although Huawei is beeing Huawei-ing (some sneaky apps are running).. I do like the interface into "Manually" managing backround running (battery), internet access.
- vSanjo 6y ago
  I'm not trying to be facetious or rude, but that seems like a massive decision against something that was largely fixed? I can understand if you had software-problems with iOS but I didn't see that in your comment. Managing those kinds of blocker apps, and security and such are all great when you're 'in the zone' and have it fresh at the forefront of your thoughts. For me, it only takes a week or so of not thinking about it before my standards slip and I have Just Another Application™ running.
  - HenryBemis 6y ago
    > you had software-problems with iOS I didn't have any probs with sofrware while using iPhones. I was jailbreaking them, installing a similar firewall and had my mind at ease. I would go to Apple in a heartbeat if they stopped lying and allowed rooted/jailbroken phones. It is nice to see that on a comment 95% on Android people still downvote me for (justifiably) trashing Apple. They got caught cheating. Then they got caught lying. Then they were found guilty. Apple fanboys are having a party downvoting. Fun fact: "HN karma" is virtual, while the $1k that they pay Apple every year is a REAL number. Keep rocking folks. I guess when someone spits on your coffee you downvote the commenter and keep going back to the same coffee place, right? (https://bgr.com/2020/07/13/iphone-batterygate-lawsuit-settlement-how-to-get-payment/ https://bgr.com/2020/07/13/iphone-batterygate-lawsuit-settle...) > and I have Just Another Application™ running this is absolutely normal/logical. A friend suggested the 7min workout by Johnson & Johnson. Nice app, free, has these simple 7mins workouts, also has warm-up/cool-down if you want the extra 7-8mins.. very nice. Loving it. It doesn't need internet connection to fully operate (workouts). I don't need it to "back up my progress in their cloud". So it stays offline (forever). It takes 1min when I install that new/extra app to bolt it down and have it behave just as I want (and does not disrupt me with notifications or leak data or kill my battery).
NiceWayToDoIT 6y ago
test
- sloshnmosh 6y ago
  test failed
- iamtedd 6y ago
  All I see is hunter2.
armada651 6y ago
Sounds like it might be related to the reviews for this app? https://play.google.com/store/apps/details?id=com.google.zxing.client.android https://play.google.com/store/apps/details?id=com.google.zxi... A 2020 review talks about ads appearing after a recent "update", but the app hasn't pushed an update since 2018! I've always had this app installed and never experienced adware, perhaps those reviews are left by people falling victim to the copycat scam?
- riphdd2020 6y ago
  I had this app too, and I remember thinking it was weird because I think an official google developer blog (or something like that) mentioned the need to install it, as there was no built in QR code reader at the time. I can't remember which old phone I had it on though. I also think those reviews might be left by people who can't find the original offending app because it's been removed. https://www.apkshub.com/app/com.qrcodescanner.barcodescanner https://www.apkshub.com/app/com.qrcodescanner.barcodescanner seems to show it had BILLING permission though, which is always an alarm bell.
  - tallanvor 6y ago
    The one you're looking at on apkshub is definitely a different app. The version number, last update, and permissions do not match what is in Play.
    - riphdd2020 6y ago
      The one on apkshub is the one mentioned in the blog. Google has removed it from google play. https://play.google.com/store/apps/details?id=com.google.zxing.client.android https://play.google.com/store/apps/details?id=com.google.zxi... is a completely different, open source app, with unexplained bad reviews, probably nothing to do with the malware, and hasn't been removed by google.
timdaub 6y ago
FYI: I created a website that quickly scans QR codes so that you won't have to download or open any ads-filled QR code apps anymore: - https://scan.lol https://scan.lol The code is open source too: https://github.com/TimDaub/scan.lol https://github.com/TimDaub/scan.lol
- opensmtpd 6y ago
  There is also zxing. https://zxing.org/w/decode.jspx https://zxing.org/w/decode.jspx
  - simonmales 6y ago
    Ah, this is nice to have from the ZXing team.
- EE84M3i 6y ago
  > The code is open source too: https://github.com/TimDaub/scan.lol https://github.com/TimDaub/scan.lol Am I missing something or does your repo only contain the minified version of the javascript, and not contain the `index.js` referenced in the `package.json` nor the method to build to minified artifacts? This seems like it's not open source.
  - timdaub 6y ago
    Hey, thanks for pointing that out. Rest assured, the site is 100% open source as I'm simply publishing the repo using GitHub Pages. There's no build step. Regarding package.json's main file: It's a mistake. I did not update it properly after I did `npm init`.
    - EE84M3i 6y ago
      Where does https://github.com/TimDaub/scan.lol/blob/master/qr-scanner-worker.min.js https://github.com/TimDaub/scan.lol/blob/master/qr-scanner-w... come from then?
- Mo3 6y ago
deleted 6y ago
[deleted]
j1elo 6y ago
The lesson here is not "oh look the author is stupid because they installed a shitty QR scanner app and didn't notice the obvious mistake". The lesson should be; even very experienced technical people fall onto the malware trap. We all have day-to-day problems, unexpected stuff happening, in short life doing its thing. We'll inevitably end up being victims of a scam that happens just the worst possible day of them all, because reasons. Thus the problem is not if we'll also fall on the trap, but what tools we'll have at our disposal when we do, and to what extent the Operating System will be there helping to protect us (and/or help us diagnose the issue...)
- 3pt14159 6y ago
  I took away another lesson: One of the early developers of Android doesn't replace his phone even after being absolutely certain it had malware. That kinda blows my mind.
  - abrookewood 6y ago
    That's a pretty extreme and expensive option. I think I would have just gone for a factory reset.
    - 3pt14159 6y ago
      At the very least, yes. But I read something from a former NSA hacker once and he mentioned he replaces his computer and phone every quarter, in addition to a bunch of other paranoid things. I'm not that extreme, but I did replace my computer once I got back from Kiev. I'd rather not worry about it.
    - prox 6y ago
      I had an attack that kept the Malware after a factory reset, and I contacted Lenovo about it. They confirmed it was indeed still intact. We even did a low-level reset (a representative guided me through it) but to his own surprise the malware was still there. I was out of warranty and I had to pay a sum to get it fixed, which was more expensive than buying a new tablet.
  - 6y ago
nodamage 6y ago
> Google Play Protect was also completely unhelpful, which was a big disappointment. Google Play Protect performs notoriously poorly compared to dedicated malware apps: https://www.tomsguide.com/reviews/google-play-protect https://www.tomsguide.com/reviews/google-play-protect
- ocdtrekkie 6y ago
  Yeah, looking at the AVTEST.org results, it has generally appeared Google would've been better off buying a no-name competitor's app rather than trusting their own engineers to implement security software: https://www.av-test.org/en/antivirus/mobile-devices/android/november-2020/ https://www.av-test.org/en/antivirus/mobile-devices/android/...
filipo 6y ago
As sad as the incident is: I am glad he is still committed to Android after being a team member and therefore equipped with a deep understanding about the platform and architecture itself.
Causality1 6y ago
Can you explain how you managed to install malware while unlocking your bootloader? The only two methods for unlocking I've ever used are OEM applications like Odin for older phones and simple ADB commands for newer ones, neither of which put you at particular danger from malware.
- Daho0n 6y ago
  He didn't. It was just an app that was updated and started showing ads. Not malware as it cannot access anything but still annoying.
  - Causality1 6y ago
    Ah. The way he worded his introduction made it seem like "two mis-taps" during the unlock process installed adware on his device.
bzb6 6y ago
It’s a joke that this happened. And even worse that he considered installing “malwarebytes”, one of those things that smell of windows 98 shareware, to fix it. This is why I buy iPhone.
- Daho0n 6y ago
  If you install an app on iPhone that is allowed to make pop-ups and it shows ads in those pop-ups you get the same situation as here. This wasn't malware as it couldn't access anything except itself.
  - bzb6 6y ago
    The article says the app kept opening new browser tabs on chrome while the app itself was not on the foreground. That’s impossible on iPhones
londons_explore 6y ago
Note that there is no evidence the security model is broken here. The 'malware' didn't access any private data. It just popped up annoying ads, which it doesn't need special permissions to do.
- nsomaru 6y ago
  > It just popped up annoying ads, which it doesn't need special permissions to do. Maybe that’s the problem?
  - londons_explore 6y ago
    Yes, but trusted UI is needed to require permissions for things like that (ie. so that every pixel on the screen of the phone the user can be aware which app and security 'container' it came from). That is pretty hard to achieve, and no mobile or desktop platform really has it.
alex_duf 6y ago
Oh I'm so glad this has been posted! I've been a victim of that specific malware and I was wondering how on earth did it happen as I'm usually careful enough when it comes to security. I also had the barcode scanner app. I didn't go as far as the author and I did a factory reset.
kuon 6y ago
About QR code, isn't that the sort of thing that would be super more efficient to do in hardware at the camera chip level? This makes me think that it would be nice to be able too load "camera sensor scripts" in a similar way to GLSL for GPU, for filtering and analysis using hardware. (it might be possible, I am not an android developer)
asddubs 6y ago
Coincidentally, I was trying to download a qr code scanner app on my new phone the other day, and looking at the listing, trying to discern which ones were going to be overly greedy with permissions and ad spam lead me to immediately installing f-droid again. originally i hadn't planned to bother with it, but man the google play store is in really bad shape. and advertised apps are just a stupid concept that needs to die.
c_prompt 6y ago
> Listing the apps installed on my phone should give me the option to sort them by “Latest installed”. I am pretty sure that if I had had this option and I had seen a QR Code Scanner installed just a few days ago, it would have immediately grabbed my attention. As it is, the way Android lists the installed apps is pretty useless for this purpose. I was able to find it pretty quickly by going to: Settings > Battery > Usage Details > Battery Usage Since Full Charge This showed me the most recent app used. As I hadn't used the QR scanner app in quite some time, it seemed a reasonable place to look first.
- aembleton 6y ago
  That shows you the most recent app used, but he needed the most recent one installed.
  - Garvey 6y ago
    Play Store > My Apps and Games > Installed, and then change the sort order to "Last Updated".
    - Maxburn 6y ago
      I don't have a android device here to confirm but I suspect if it was just installed and never updated it won't show in that list.
  - c_prompt 6y ago
    True, but I did it right after the ad appeared.
m1gu3l 6y ago
a not so obvious protip: you usually don't even need a "qr reader app" modern phone camera apps will pop the link without having to install extra stuff.
robertlagrant 6y ago
If Google removed it from the Play store, why don't they have a way to tell people that an app they have installed has been detected as malware and prompt them to remove it?
deleted 6y ago
[deleted]
marcodiego 6y ago
Play store should allow to filter by license and anti-features. That would make it as usable as f-droid. As an example: try to find a non-ad-infested flashlight app on play store, then try to find a single ad-infested flashlight app on f-droid.
sloshnmosh 6y ago
Another problem is with the cheap Android devices that come with a preinstalled rootkit disguised as the firmware update app. (fota.apk) It uses LUA scripts to install apps remotely and can grant any app any permission and run as system level through reflection. The government funded LifeLine phones that are given to the poor, disabled and veterans are all infected with this malware. Here is an excellent technical analysis of the rootkit: https://wuffs.org/blog/digitime-tech-fota-backdoors https://wuffs.org/blog/digitime-tech-fota-backdoors
anonnyj 6y ago
I really wish there was more granularity to the permissions. For the vast majority of apps, I don't want them to be able to use the internet. Seems pretty basic (other than the fact that is threatens the whole Ad ecosystem...) Would be cool too if there was a shared file space for apps... And apps had to stay within that pen. Giving them access to all your phone's files is just wreckless. But I don't have the choice.
hnburnsy 6y ago
Blockada has a nice Hostlog view to show requests in real time. Have caught websites I thought I had blocked this way. Wish it would tell me which App made the request.
- Cactus2018 6y ago
  https://f-droid.org/packages/org.blokada.fem.fdroid/ https://f-droid.org/packages/org.blokada.fem.fdroid/
captainmuon 6y ago
> I started by inspecting the list of recurring tasks, but the output was so voluminous that finding anything useful was a dim prospect. Sometimes I phantasize about a novel computer or phone, where you can "physically" inspect the running (non-OS) applications. On a phone, you'd have a glowing edge where each light or micro display corresponds to one application. You can only ever have 6 or so apps running at the same time. If an app launches a lot in the background, you'd notice it quickly from the new color blinking. On a desktop PC or a server, maybe you'd even have a little door in the case, and behind it a bunch of little OLED displays that replace the task manager. With a click of a physical switch, you could evict an application from memory automatically. Of course this would be unpractical for a lot of reasons, and you'd have to trust the OS/firmware. But I like both ideas of understanding what the PC is doing, and adding back a tactile element to computing.

334 points by rossjudson 6y ago

What surprised here is that Android doesn’t have a native QR scanner. I’ve always assumed that iOS was late to the game and that Google Search/Lens handled QRs since 1999. Is that not the case (anymore)?

technion 6y ago
My Huawei phone actually does come with a QR scanner. You just have to open the built in camera app, then click this icon[0]. It defaults to the translator camera, which I find really that you can just point at text and it translates it on your screen. Then there's a picture of a square with a line down the center that turns on the QR scanner. As you can imagine, when all the covid checkins started, I couldn't find this. Everyone would say to me "just open the camera on your iPhone it's easy" as though it was a given that every visitor was using an Apple phone. I went through three different QR apps based on what I found on the play store and all of them blasted me with inappropriate ads I kept wishing I didn't open in public. A bit if visibility in the UX would have solved this. [0] https://ibb.co/L5XG21G https://ibb.co/L5XG21G
morsch 6y ago
The versions of Android that vendors ship usually have a QR scanner. For example, Samsung's camera app reacts to them by default. I don't think AOSP has a QR reader, but Lineage OS ships a camera that reads them.
- peteri 6y ago
  It's in the Google Lens app on my Pixel 5.
- morsch 6y ago
  I'll add that even though most phones have some sort of built-in reader, there are many reasons a developer would want to use a standalone reader. The Samsung reader launches URLs (99% of QR codes I encounter), and it understands Text and VCARD as well, but I don't know that it understands all kinds of arbitrary or custom QR codes you might want to define.
rjmunro 6y ago
The issue is that some malware installed itself with the name QR scanner, not that Android does or doesn't have a QR scanner. Most Android camera apps (each phone comes with its own) will recognise QR codes fine, although the UI is sometimes annoying.

kwdc 6y ago

"Google Play Protect was also completely unhelpful, which was a big disappointment. First because Google certainly knows which applications they removed from their store for malware reasons, but even so, I would expect Google Play Protect to at least flag any app it finds on my phone that is not on their store. Such an app is not necessarily malware, but it should certainly be flagged. Google Play Protect could also do some behavior profiling to analyze what apps are doing in the background. A service launching recurring VIEW intents on web sites in the background should have raised a flag to the system." Sounds good. I sense that there so many teams involved such a feature is not on their radar. So "they already know they blocked it" and "the existing installed app should be blocked" imply that two teams know what the others are doing. I'm guessing that the team that does the removal from the store has no communications path to those who would add a flagging mechanism for already installed apps.

thatguy0900 6y ago
" I would expect Google Play Protect to at least flag any app it finds on my phone that is not on their store. Such an app is not necessarily malware, but it should certainly be flagged." seems like Google is between a rock and a hard place here, they already catch so much heat over their treatment of third party app stores there would certainly be a lot of outrage over this if they started doing it
- Maxburn 6y ago
  Very true, but instead of reaching in and removing your app giving a message saying "we pulled this app from the store for such and such reasons, maybe you want to review it" would be pretty nice.
  - jm_l 6y ago
    I believe that actually does happen if you installed through Google Play Store, but in this case the app was sideloaded onto the device.

pw6hv 6y ago

A QR code reader was the problem then... I am an Android user since the dawn of time and I was so surprised when my wife showed me that on her iPhone the QR code reader is embedded in her camera app... I wonder why it is not the same in any version of Android that I have used (now I am on Android One). This plus the native support for CardDav and CalDav are pushing me to try iOS next time I have to change my phone.

romanows 6y ago
On my Pixel 4a: Camera / Modes / Lens. That will open Google Lens which should scan QR codes.
- muro 6y ago
  It does - just checked.
- chaos_a 6y ago
  You can do the same on any android phone by opening the google app and tap the lens icon in the search bar.
deleted 6y ago
[deleted]
izacus 6y ago
Pretty much most of Android phones have QR code reader embedded in the camera app as well.
Sander_Marechal 6y ago
I have a Pixel 2. It scans QR codes with the default camera app just fine. When it detects a QR code you get a little popup you can click. It even works with regular 1D barcodes.
- MrDresden 6y ago
  Long time Pixel user here (and an Android dev for that matter) and I had no idea the camera had qr support!

ce4 6y ago

I trust the F-Droid store more due to its curated (FOSS-software-only/no-trackers) maintainer based model and default to them if there's an app that I need, especially simple stuff that tends to mostly be adware on the playstore

FriedrichN 6y ago
On a side note, my bank is now forcing me to use their app which can only be downloaded from the Play Store (which I will never install). When I complained they told me it's because they think it's more secure than their current method which is a card reader, I tried to explain to them the average phone is teeming with malware, but they simply wouldn't believe me. I am currently looking for a new bank.
- hadrien01 6y ago
  You can use AuroraStore from F-Droid, it allows you to download apps from the Play Store without a Google account.
  - simonmales 6y ago
    Nice tip!
    - Daniel_sk 6y ago
      It will probably be not good enough, many banking apps are using Google Safety Net to detect rooted or not Google certified devices with Google Play installed indirectly. AFAIK it's now quite difficult to break. I sort of understand the bank decision on this. There is a lot of malware on Android and users are easily tricked into installing some side-loaded APKs, and there is also a lot of hidden malware on Google Play which is hard to find (e.g. it downloads a payload after the store review is done). This would be a disaster since on Android you can for example use accessibility services to read any input from the user and also control the device. So you can circumvent 2FA and make transactions on behalf of the user on the device. There has been a lot banking malware on Google Play. I think they are getting it a bit under control now, but it's still very dangerous.

TooCreative 6y ago

Strange article I unlocked my phone and two accidental clicks led me to agree to a dialog that my brain immediately registered as suspicious What type of dialog can pop up on your Android screen after unlocking and install "malware"? What is "malware" here? It looks like they mean an app from the play store? The next day, I picked up my phone and when I launched Chrome, I immediately noticed it was displaying a spammy URL. How can one app alter the behavior of another?

llarsson 6y ago
Can't an app ask for a website to be opened, and then that would cause the standard browser to display said website and URL? It does not sound to me like the Chrome app was infected, just told to open a page.
- UncleMeat 6y ago
  Yes this is basic (and incredibly common) behavior. The alternative is often much worse (an embedded WebView in each app to do things like open TOS pages).
ytch 6y ago
> How can one app alter the behavior of another? In Defcon 2, author finds a log with intent: {act=android.intent.action.VIEW Android will handle The URI with default app. The malware sends HTTP url, so it will be opened by default browser.
sloshnmosh 6y ago
What I believe the author is saying is that he received a push notification to chrome from the malicious app. Coincidentally, I just spent my Saturday evening pouring over malicious JavaScript hosted on Cloudfront that does extensive browser fingerprinting and if a match is made to an Android device a fake Captcha pops up in Chrome which actually enables push notifications and from there a full screen pop-up appears that vibrates the devices and claims the phone is infected with (N) viruses and the “repair now” button pulls up the Play Store app to install DFNDR antivirus/cleaner. If you look at the reviews of that app you’ll see all the angry reviews of users having their browsers hijacked. The app itself is just an advertising server wrapped around Avast’s detection engine and is funded by the Chinese Qihoo. It harvests users social media data and charges the users almost $10 a month after a 3 day trial period. Novice users are unable to delete the app if “advanced protection” is enabled because it becomes a device administrator and uses deceptive language to confuse the user trying to remove the app. If the app gets installed it will not let you clear the storage of the app from within settings even if you had never opened the app and before you agree to any terms and conditions. The fake virus warnings that lead to DFNDR have been going on every single day since 2013. I’m putting together a webpage that will include the JavaScript and other details as we speak. The Google Play Store is a dumpster fire full of scam apps and Scummy developers.

throwawaysea 6y ago

Scary. Is there such a thing as a malware scanner on Android? Are they effective or worthwhile at all? Why isn't Apple susceptible to this type of malware, seemingly?

Daho0n 6y ago
A malware scanner won't find an app that you gave permission to show on-top on other apps and use this to show ads. It is not doing anything it isn't allowed to do.

MrPatan 6y ago

Every native app can be hacked, or sold, to a malicious actor that will then make your phone theirs. Reduce the attack surface as much as you can!

ignoramous 6y ago

Ex-AOSP hacker here. I felt it strongly at the time too that Android didn't need anti-Malware [0] but I don't anymore. Some 5 years ago, I switched to Firefox Mobile out of annoyance because Chrome refused to block all those popups random websites would show with some prompting an app install. Google has since made a lot of improvements including tightening up which apps can install other apps (not a blanket permission anymore), running the Potentially Harmful Applications program, narrowing down fingerprinting (still some way to go as evident by TFA). Google is even locking the code up that runs outside of Android in crosvms [1]. I'm positive, things will improve [2] even if slowly because Android, at this point, is the most widely distributed OS and they can't move as fast anymore without hurting developers and users. Google did implement what they call AppOps (2013) which paved for tremendous amount of user control over app permissions. They removed AppOps citing that it was never meant to be used by end-users but by AOSP and app developers [3]. Fortunately, if Android is rooted, one can use AppOps [4]; but then rooting exposes one to an incredible amount. Besides, there are LittleSnitch-esque firewalls for both root and non-root devices [5]. [0] https://arstechnica.com/information-technology/2011/11/mobile-security-vendors-we-are-not-charlatans-and-scammers/ https://arstechnica.com/information-technology/2011/11/mobil... [1] https://youtu.be/edqJSzsDRxk https://youtu.be/edqJSzsDRxk [2] https://android-developers.googleblog.com/search/label/Security https://android-developers.googleblog.com/search/label/Secur... [3] https://www.zdnet.com/article/google-removes-awesome-but-unintended-privacy-controls-in-android-4-4-2/ https://www.zdnet.com/article/google-removes-awesome-but-uni... [4] https://github.com/MuntashirAkon/AppManager https://github.com/MuntashirAkon/AppManager [5] https://awesomeopensource.com/projects/android/firewall https://awesomeopensource.com/projects/android/firewall

gberger 6y ago

How is the average user expected to use adb and Android Studio to identify & remove malware from their phone? Android security is broken.

Daho0n 6y ago
Installing an app that pop-up ads isn't malware. The security model worked just fine.
literallycancer 6y ago
You are supposed to debloat all the malware that comes with your phone, courtesy of the manufacturer. If you are not capable of that, or don't care enough to have someone do it for you, you'll have to get used to ads. Annoying ads are considered a feature on stock Android builds.

HenryBemis 6y ago

I've switched to Android (Huawei) 2-3 years ago (after the Apple battery fiasco). I keep installed (and updated) the NoRoot Firewall app, which by default blocks all access. I also added to my mix the Nova Launcher. It makes it easier to tap&hold an app icon, gives you a quick shortcut straight to the specific app's Settings --> Apps --> specific app's properties, in which I (usually) block access to data/wifi/roaming/background (e.g. for a QR Code reader app). 90% of my apps do not need to reach out to the interweb, and I block them both on Settings as well as Block Data/Wifi on NoRoot Firewall. Although Huawei is beeing Huawei-ing (some sneaky apps are running).. I do like the interface into "Manually" managing backround running (battery), internet access.

vSanjo 6y ago
I'm not trying to be facetious or rude, but that seems like a massive decision against something that was largely fixed? I can understand if you had software-problems with iOS but I didn't see that in your comment. Managing those kinds of blocker apps, and security and such are all great when you're 'in the zone' and have it fresh at the forefront of your thoughts. For me, it only takes a week or so of not thinking about it before my standards slip and I have Just Another Application™ running.
- HenryBemis 6y ago
  > you had software-problems with iOS I didn't have any probs with sofrware while using iPhones. I was jailbreaking them, installing a similar firewall and had my mind at ease. I would go to Apple in a heartbeat if they stopped lying and allowed rooted/jailbroken phones. It is nice to see that on a comment 95% on Android people still downvote me for (justifiably) trashing Apple. They got caught cheating. Then they got caught lying. Then they were found guilty. Apple fanboys are having a party downvoting. Fun fact: "HN karma" is virtual, while the $1k that they pay Apple every year is a REAL number. Keep rocking folks. I guess when someone spits on your coffee you downvote the commenter and keep going back to the same coffee place, right? (https://bgr.com/2020/07/13/iphone-batterygate-lawsuit-settlement-how-to-get-payment/ https://bgr.com/2020/07/13/iphone-batterygate-lawsuit-settle...) > and I have Just Another Application™ running this is absolutely normal/logical. A friend suggested the 7min workout by Johnson & Johnson. Nice app, free, has these simple 7mins workouts, also has warm-up/cool-down if you want the extra 7-8mins.. very nice. Loving it. It doesn't need internet connection to fully operate (workouts). I don't need it to "back up my progress in their cloud". So it stays offline (forever). It takes 1min when I install that new/extra app to bolt it down and have it behave just as I want (and does not disrupt me with notifications or leak data or kill my battery).

NiceWayToDoIT 6y ago

test

sloshnmosh 6y ago
test failed
iamtedd 6y ago
All I see is hunter2.

armada651 6y ago

Sounds like it might be related to the reviews for this app? https://play.google.com/store/apps/details?id=com.google.zxing.client.android https://play.google.com/store/apps/details?id=com.google.zxi... A 2020 review talks about ads appearing after a recent "update", but the app hasn't pushed an update since 2018! I've always had this app installed and never experienced adware, perhaps those reviews are left by people falling victim to the copycat scam?

riphdd2020 6y ago
I had this app too, and I remember thinking it was weird because I think an official google developer blog (or something like that) mentioned the need to install it, as there was no built in QR code reader at the time. I can't remember which old phone I had it on though. I also think those reviews might be left by people who can't find the original offending app because it's been removed. https://www.apkshub.com/app/com.qrcodescanner.barcodescanner https://www.apkshub.com/app/com.qrcodescanner.barcodescanner seems to show it had BILLING permission though, which is always an alarm bell.
- tallanvor 6y ago
  The one you're looking at on apkshub is definitely a different app. The version number, last update, and permissions do not match what is in Play.
  - riphdd2020 6y ago
    The one on apkshub is the one mentioned in the blog. Google has removed it from google play. https://play.google.com/store/apps/details?id=com.google.zxing.client.android https://play.google.com/store/apps/details?id=com.google.zxi... is a completely different, open source app, with unexplained bad reviews, probably nothing to do with the malware, and hasn't been removed by google.

timdaub 6y ago

FYI: I created a website that quickly scans QR codes so that you won't have to download or open any ads-filled QR code apps anymore: - https://scan.lol https://scan.lol The code is open source too: https://github.com/TimDaub/scan.lol https://github.com/TimDaub/scan.lol

opensmtpd 6y ago
There is also zxing. https://zxing.org/w/decode.jspx https://zxing.org/w/decode.jspx
- simonmales 6y ago
  Ah, this is nice to have from the ZXing team.
EE84M3i 6y ago
> The code is open source too: https://github.com/TimDaub/scan.lol https://github.com/TimDaub/scan.lol Am I missing something or does your repo only contain the minified version of the javascript, and not contain the `index.js` referenced in the `package.json` nor the method to build to minified artifacts? This seems like it's not open source.
- timdaub 6y ago
  Hey, thanks for pointing that out. Rest assured, the site is 100% open source as I'm simply publishing the repo using GitHub Pages. There's no build step. Regarding package.json's main file: It's a mistake. I did not update it properly after I did `npm init`.
  - EE84M3i 6y ago
    Where does https://github.com/TimDaub/scan.lol/blob/master/qr-scanner-worker.min.js https://github.com/TimDaub/scan.lol/blob/master/qr-scanner-w... come from then?
Mo3 6y ago

deleted 6y ago

[deleted]

j1elo 6y ago

The lesson here is not "oh look the author is stupid because they installed a shitty QR scanner app and didn't notice the obvious mistake". The lesson should be; even very experienced technical people fall onto the malware trap. We all have day-to-day problems, unexpected stuff happening, in short life doing its thing. We'll inevitably end up being victims of a scam that happens just the worst possible day of them all, because reasons. Thus the problem is not if we'll also fall on the trap, but what tools we'll have at our disposal when we do, and to what extent the Operating System will be there helping to protect us (and/or help us diagnose the issue...)

3pt14159 6y ago
I took away another lesson: One of the early developers of Android doesn't replace his phone even after being absolutely certain it had malware. That kinda blows my mind.
- abrookewood 6y ago
  That's a pretty extreme and expensive option. I think I would have just gone for a factory reset.
  - 3pt14159 6y ago
    At the very least, yes. But I read something from a former NSA hacker once and he mentioned he replaces his computer and phone every quarter, in addition to a bunch of other paranoid things. I'm not that extreme, but I did replace my computer once I got back from Kiev. I'd rather not worry about it.
  - prox 6y ago
    I had an attack that kept the Malware after a factory reset, and I contacted Lenovo about it. They confirmed it was indeed still intact. We even did a low-level reset (a representative guided me through it) but to his own surprise the malware was still there. I was out of warranty and I had to pay a sum to get it fixed, which was more expensive than buying a new tablet.
- 6y ago

nodamage 6y ago

> Google Play Protect was also completely unhelpful, which was a big disappointment. Google Play Protect performs notoriously poorly compared to dedicated malware apps: https://www.tomsguide.com/reviews/google-play-protect https://www.tomsguide.com/reviews/google-play-protect

ocdtrekkie 6y ago
Yeah, looking at the AVTEST.org results, it has generally appeared Google would've been better off buying a no-name competitor's app rather than trusting their own engineers to implement security software: https://www.av-test.org/en/antivirus/mobile-devices/android/november-2020/ https://www.av-test.org/en/antivirus/mobile-devices/android/...

filipo 6y ago

As sad as the incident is: I am glad he is still committed to Android after being a team member and therefore equipped with a deep understanding about the platform and architecture itself.

Causality1 6y ago

Can you explain how you managed to install malware while unlocking your bootloader? The only two methods for unlocking I've ever used are OEM applications like Odin for older phones and simple ADB commands for newer ones, neither of which put you at particular danger from malware.

Daho0n 6y ago
He didn't. It was just an app that was updated and started showing ads. Not malware as it cannot access anything but still annoying.
- Causality1 6y ago
  Ah. The way he worded his introduction made it seem like "two mis-taps" during the unlock process installed adware on his device.

bzb6 6y ago

It’s a joke that this happened. And even worse that he considered installing “malwarebytes”, one of those things that smell of windows 98 shareware, to fix it. This is why I buy iPhone.

Daho0n 6y ago
If you install an app on iPhone that is allowed to make pop-ups and it shows ads in those pop-ups you get the same situation as here. This wasn't malware as it couldn't access anything except itself.
- bzb6 6y ago
  The article says the app kept opening new browser tabs on chrome while the app itself was not on the foreground. That’s impossible on iPhones

londons_explore 6y ago

Note that there is no evidence the security model is broken here. The 'malware' didn't access any private data. It just popped up annoying ads, which it doesn't need special permissions to do.

nsomaru 6y ago
> It just popped up annoying ads, which it doesn't need special permissions to do. Maybe that’s the problem?
- londons_explore 6y ago
  Yes, but trusted UI is needed to require permissions for things like that (ie. so that every pixel on the screen of the phone the user can be aware which app and security 'container' it came from). That is pretty hard to achieve, and no mobile or desktop platform really has it.

alex_duf 6y ago

Oh I'm so glad this has been posted! I've been a victim of that specific malware and I was wondering how on earth did it happen as I'm usually careful enough when it comes to security. I also had the barcode scanner app. I didn't go as far as the author and I did a factory reset.

kuon 6y ago

About QR code, isn't that the sort of thing that would be super more efficient to do in hardware at the camera chip level? This makes me think that it would be nice to be able too load "camera sensor scripts" in a similar way to GLSL for GPU, for filtering and analysis using hardware. (it might be possible, I am not an android developer)

asddubs 6y ago

Coincidentally, I was trying to download a qr code scanner app on my new phone the other day, and looking at the listing, trying to discern which ones were going to be overly greedy with permissions and ad spam lead me to immediately installing f-droid again. originally i hadn't planned to bother with it, but man the google play store is in really bad shape. and advertised apps are just a stupid concept that needs to die.

c_prompt 6y ago

> Listing the apps installed on my phone should give me the option to sort them by “Latest installed”. I am pretty sure that if I had had this option and I had seen a QR Code Scanner installed just a few days ago, it would have immediately grabbed my attention. As it is, the way Android lists the installed apps is pretty useless for this purpose. I was able to find it pretty quickly by going to: Settings > Battery > Usage Details > Battery Usage Since Full Charge This showed me the most recent app used. As I hadn't used the QR scanner app in quite some time, it seemed a reasonable place to look first.

aembleton 6y ago
That shows you the most recent app used, but he needed the most recent one installed.
- Garvey 6y ago
  Play Store > My Apps and Games > Installed, and then change the sort order to "Last Updated".
  - Maxburn 6y ago
    I don't have a android device here to confirm but I suspect if it was just installed and never updated it won't show in that list.
- c_prompt 6y ago
  True, but I did it right after the ad appeared.

m1gu3l 6y ago

a not so obvious protip: you usually don't even need a "qr reader app" modern phone camera apps will pop the link without having to install extra stuff.

robertlagrant 6y ago

If Google removed it from the Play store, why don't they have a way to tell people that an app they have installed has been detected as malware and prompt them to remove it?

deleted 6y ago

[deleted]

marcodiego 6y ago

Play store should allow to filter by license and anti-features. That would make it as usable as f-droid. As an example: try to find a non-ad-infested flashlight app on play store, then try to find a single ad-infested flashlight app on f-droid.

sloshnmosh 6y ago

Another problem is with the cheap Android devices that come with a preinstalled rootkit disguised as the firmware update app. (fota.apk) It uses LUA scripts to install apps remotely and can grant any app any permission and run as system level through reflection. The government funded LifeLine phones that are given to the poor, disabled and veterans are all infected with this malware. Here is an excellent technical analysis of the rootkit: https://wuffs.org/blog/digitime-tech-fota-backdoors https://wuffs.org/blog/digitime-tech-fota-backdoors

anonnyj 6y ago

I really wish there was more granularity to the permissions. For the vast majority of apps, I don't want them to be able to use the internet. Seems pretty basic (other than the fact that is threatens the whole Ad ecosystem...) Would be cool too if there was a shared file space for apps... And apps had to stay within that pen. Giving them access to all your phone's files is just wreckless. But I don't have the choice.

hnburnsy 6y ago

Blockada has a nice Hostlog view to show requests in real time. Have caught websites I thought I had blocked this way. Wish it would tell me which App made the request.

Cactus2018 6y ago
https://f-droid.org/packages/org.blokada.fem.fdroid/ https://f-droid.org/packages/org.blokada.fem.fdroid/

captainmuon 6y ago

> I started by inspecting the list of recurring tasks, but the output was so voluminous that finding anything useful was a dim prospect. Sometimes I phantasize about a novel computer or phone, where you can "physically" inspect the running (non-OS) applications. On a phone, you'd have a glowing edge where each light or micro display corresponds to one application. You can only ever have 6 or so apps running at the same time. If an app launches a lot in the background, you'd notice it quickly from the new color blinking. On a desktop PC or a server, maybe you'd even have a little door in the case, and behind it a bunch of little OLED displays that replace the task manager. With a click of a physical switch, you could evict an application from memory automatically. Of course this would be unpractical for a lot of reasons, and you'd have to trust the OS/firmware. But I like both ideas of understanding what the PC is doing, and adding back a tactile element to computing.