5 ms·

The lesson here is not "oh look the author is stupid because they installed a shitty QR scanner app and didn't notice the obvious mistake". The lesson should b

by j1elo 6y ago

The lesson here is not "oh look the author is stupid because they installed a shitty QR scanner app and didn't notice the obvious mistake". The lesson should be; even very experienced technical people fall onto the malware trap. We all have day-to-day problems, unexpected stuff happening, in short life doing its thing. We'll inevitably end up being victims of a scam that happens just the worst possible day of them all, because reasons. Thus the problem is not if we'll also fall on the trap, but what tools we'll have at our disposal when we do, and to what extent the Operating System will be there helping to protect us (and/or help us diagnose the issue...)

3pt14159 6y ago
I took away another lesson: One of the early developers of Android doesn't replace his phone even after being absolutely certain it had malware. That kinda blows my mind.
- abrookewood 6y ago
  That's a pretty extreme and expensive option. I think I would have just gone for a factory reset.
  - 3pt14159 6y ago
    At the very least, yes. But I read something from a former NSA hacker once and he mentioned he replaces his computer and phone every quarter, in addition to a bunch of other paranoid things. I'm not that extreme, but I did replace my computer once I got back from Kiev. I'd rather not worry about it.
  - prox 6y ago
    I had an attack that kept the Malware after a factory reset, and I contacted Lenovo about it. They confirmed it was indeed still intact. We even did a low-level reset (a representative guided me through it) but to his own surprise the malware was still there. I was out of warranty and I had to pay a sum to get it fixed, which was more expensive than buying a new tablet.
- growt 6y ago
  That would be reasonable if the phone owner was likely the victim of some targeted attack (beeing politician or something similar). But if it's just regular malware that was installed with a drive by download, I would trust the android security model that much.
  - prox 6y ago
    I wouldn’t. Some malware can hide a lot deeper than a factory reset can erase.
    - fomine3 6y ago
      Such behavior needs privilege escalation thanks to sandbox. I don't believe crap app can do privilege escalation for constantly updated phone.
- Shivetya 6y ago
  I do not use an Android phone, is there an easy means to restore one to factory condition? Is there a simple process to save and restore your phone to your PC/Mac similar to how Apple does it? (my father has an android phone and now I suddenly find myself curious about save/restore and how to find malware on his phone)
  - goldcd 6y ago
    Yes - it's very easy to do a factory reset on your phone. No - There is no 'easy' way to store/restore the entire phone as I believe Apple does. (I had a miserable day doing this, when my old Pixel started playing up and had to migrate across to a replacement) - and this was best case when I had the two phones next to each other. Core 'google' stuff seems fine - either all tied to your account (e.g. contacts) or google app data (texts, pictures etc) which can be backed up to cloud, or directly migrated between phones. What doesn't work is the logins/settings for all the random apps. Some do store on cloud. Some allow manual export/import of settings. Some you're going to have to setup again from scratch. Back in the day when I did root my phone, TWRP and similar things let you image/restore the whole phone.
    - userbinator 6y ago
      Older Mediatek platform phones let you read/write the entire internal flash (eMMC) directly, which is AFAIK the full extent of persistent writable storage. That is the true "factory reset", as it's how they were first loaded with software in production. I believe the more widely-known and generic Android reset is merely restoring from an internal partition.
      - gruez 6y ago
        AFAIK since android uses read-only system partition, there's nothing to restore. It just wipes the data partition and that's it.
        goldcd 6y ago
        Indeed. If you look at the storage requirements of an app, you can see it's split between "App Size" and "User Data" (along with a cache). AFAIK there's no way to actually backup/move the user data without rooting. Now I can see why Google might not want to store all that (and why I might not want them to) - but it's somewhat silly not to have any options.
- r1ch 6y ago
  Doing so would mean you don't trust the Android security model. No app can be granted permission to affect the OS or other apps unless the phone is rooted and you give it root.
  - 3pt14159 6y ago
    I mean, I don't trust as a binary. I have continuums of trust from very little to very much. I know that people are capable of privilege escalation and persistence. I've seen it with my own eyes. I know it's unlikely that that specific piece of malware was able to get persistent root, but it could have and it also could have exfiltrated cryptographic keys or certificate or bearer tokens while it was on there. Better to just get a new phone if you're such an experienced software developer that you literally helped build Android.
    - drewmol 6y ago
      If you don't fear as a binary then threat assessment and mitigation cost may be a factor. Could be a closet ios user.
alex_duf 6y ago
I've had the same issue as the author of the post. The barcode scanner wasn't any shitty app, it was the one that was recommended a long time ago by Google authenticator. I had left it installed on my phone and it must had had the dodgy update that got it banned from the app store.
- riphdd2020 6y ago
  > the one that was recommended a long time ago by Google authenticator That's where I remember it from, thanks! However I think there's some confusion here: the one the blog mentions is not https://play.google.com/store/apps/details?id=com.google.zxing.client.android https://play.google.com/store/apps/details?id=com.google.zxi... (github based, relatively trustworthy looking, recommended by Google Authenticator back in the day), it's the now removed qrcodescanner app: https://webcache.googleusercontent.com/search?q=cache:38t1gWApYMMJ:https://play.google.com/store/apps/details%3Fid%3Dcom.qrcodescanner.barcodescanner%26hl%3Den%26gl%3DGB+&cd=3&hl=en&ct=clnk&gl=uk&client=ubuntu https://webcache.googleusercontent.com/search?q=cache:38t1gW... I think those bad reviews on https://play.google.com/store/apps/details?id=com.google.zxing.client.android https://play.google.com/store/apps/details?id=com.google.zxi... are because the malware probably used the zxing qr library, and there might be traces left in it, or these users are just confused (or the malware app deliberately pointed low star reviewers to the github competitor app in the play store). As others have stated, this github app with the bad reviews hasn't been updated for a long time. If the malware is also in https://github.com/zxing/zxing https://github.com/zxing/zxing , I really hope they do a postmortem to explain how. The fact that https://play.google.com/store/apps/details?id=com.google.zxing.client.android https://play.google.com/store/apps/details?id=com.google.zxi... still exists though, while the app mentioned in the blog has been removed by google, makes me think the zxing app is clean.
  - Rooster61 6y ago
    Hang on a second, something is fishy here. I had an issue that the mirrors what was happening on the zxing reviews. I was getting a full page ad every 15 minutes or so after unlocking my phone. The rub? It wasn't this app. It was another one that was also called barcode scanner. It was also beginning to garner negative reviews, which the developer (had a Ukranian email address) had begun responding to saying the app was perfectly legal because it was serving ads only inside the app itself. I'm wondering if that deluge of bad reviews is directed at the wrong app? I'll look to see if I can still find the google play page for the one I had. Also, I had that app for a LONG time before it started displaying this kind of behavior just last month, which also corresponds to the bad reviews starting on the zxing app.
swiley 6y ago
IMO: the lesson here is that restricting people to the OS vendor's software repository doesn't prevent malware. The only way to even help that is via community review (note that apple doesn't review internal behavior of the apps or instrument them in any way, they just have someone try using them behind a proxy) and enforcing public available source code like fdroid.
- FloayYerBoat 6y ago
  "the lesson here is that restricting people to the OS vendor's software repository doesn't prevent malware" This was a side-loaded app on an unlocked phone. What am I missing?
crossroadsguy 6y ago
As an iPhone user and an Android developer my lessons learnt, over the time, are: 1. Do not trust Google to vet the apps in the play store. They won't; they don't even try. 2. Those shiny Play Protect and whatnot postured around by Google are practically utter useless bs/bloat 3. Stick to famous, really famous apps from the Play Store - as in well known - e.g. Facebook, Netflix, Evernote etc (you will be tracked of course, you won't be hacked - you pay this price by using Googled Android anyway) 4. If you couldn't find a well known app on Play Store - head to https://www.f-droid.org https://www.f-droid.org 5. Do not, just do not download any other app on your phone (treat it as a no exception rule) unless you know what you are doing and possibly can look at the code - find something decent as an APK from GitHub et al. 6. Be very miserly when it comes to doling out permissions to apps. Your default should be "no". 7. Privacy (not really) and safety are just superficial polish by Google on Android OS - their core and only focus developing the OS is: making it as much of an ad platform as they can and on top of that how to get a bigger and bigger cut of the overall ad revenue with every release.
- ladyanita22 6y ago
  You speak like if you were any kind of authority. Nowadays anybody can be an Android developer, India is full of teenagers doing it.
  - maxmalysh 6y ago
    http://www.paulgraham.com/disagree.html http://www.paulgraham.com/disagree.html
    - ladyanita22 6y ago
      TL;DR
      - Qub3d 6y ago
        The part of pg's comments that relates to your comments is this part: "Saying that an author lacks the authority to write about a topic is a variant of ad hominem—and a particularly useless sort, because good ideas often come from outsiders. The question is whether the author is correct or not. If his lack of authority caused him to make mistakes, point those out. And if it didn't, it's not a problem." But in general, Paul Graham isn't saying anything that is novel to this site's comment guidelines: Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community. Comments should get more thoughtful and substantive, not less, as a topic gets more divisive. https://news.ycombinator.com/newsguidelines.html#comments https://news.ycombinator.com/newsguidelines.html#comments
drcongo 6y ago
My takeaway from this post is never use Android. Not that I ever would.
Can_Not 6y ago
I had a QR scanner installed for _years_ before it started (in December) giving me chrome pop-ups for spammy links. The dev is even on the app store lying saying the ads are in the app when the app is actually covertly waking itself up to open chrome.

by j1elo 6y ago

3pt14159 6y ago

I took away another lesson: One of the early developers of Android doesn't replace his phone even after being absolutely certain it had malware. That kinda blows my mind.

abrookewood 6y ago
That's a pretty extreme and expensive option. I think I would have just gone for a factory reset.
- 3pt14159 6y ago
  At the very least, yes. But I read something from a former NSA hacker once and he mentioned he replaces his computer and phone every quarter, in addition to a bunch of other paranoid things. I'm not that extreme, but I did replace my computer once I got back from Kiev. I'd rather not worry about it.
- prox 6y ago
  I had an attack that kept the Malware after a factory reset, and I contacted Lenovo about it. They confirmed it was indeed still intact. We even did a low-level reset (a representative guided me through it) but to his own surprise the malware was still there. I was out of warranty and I had to pay a sum to get it fixed, which was more expensive than buying a new tablet.
growt 6y ago
That would be reasonable if the phone owner was likely the victim of some targeted attack (beeing politician or something similar). But if it's just regular malware that was installed with a drive by download, I would trust the android security model that much.
- prox 6y ago
  I wouldn’t. Some malware can hide a lot deeper than a factory reset can erase.
  - fomine3 6y ago
    Such behavior needs privilege escalation thanks to sandbox. I don't believe crap app can do privilege escalation for constantly updated phone.
Shivetya 6y ago
I do not use an Android phone, is there an easy means to restore one to factory condition? Is there a simple process to save and restore your phone to your PC/Mac similar to how Apple does it? (my father has an android phone and now I suddenly find myself curious about save/restore and how to find malware on his phone)
- goldcd 6y ago
  Yes - it's very easy to do a factory reset on your phone. No - There is no 'easy' way to store/restore the entire phone as I believe Apple does. (I had a miserable day doing this, when my old Pixel started playing up and had to migrate across to a replacement) - and this was best case when I had the two phones next to each other. Core 'google' stuff seems fine - either all tied to your account (e.g. contacts) or google app data (texts, pictures etc) which can be backed up to cloud, or directly migrated between phones. What doesn't work is the logins/settings for all the random apps. Some do store on cloud. Some allow manual export/import of settings. Some you're going to have to setup again from scratch. Back in the day when I did root my phone, TWRP and similar things let you image/restore the whole phone.
  - userbinator 6y ago
    Older Mediatek platform phones let you read/write the entire internal flash (eMMC) directly, which is AFAIK the full extent of persistent writable storage. That is the true "factory reset", as it's how they were first loaded with software in production. I believe the more widely-known and generic Android reset is merely restoring from an internal partition.
    - gruez 6y ago
      AFAIK since android uses read-only system partition, there's nothing to restore. It just wipes the data partition and that's it.
      - goldcd 6y ago
        Indeed. If you look at the storage requirements of an app, you can see it's split between "App Size" and "User Data" (along with a cache). AFAIK there's no way to actually backup/move the user data without rooting. Now I can see why Google might not want to store all that (and why I might not want them to) - but it's somewhat silly not to have any options.
r1ch 6y ago
Doing so would mean you don't trust the Android security model. No app can be granted permission to affect the OS or other apps unless the phone is rooted and you give it root.
- 3pt14159 6y ago
  I mean, I don't trust as a binary. I have continuums of trust from very little to very much. I know that people are capable of privilege escalation and persistence. I've seen it with my own eyes. I know it's unlikely that that specific piece of malware was able to get persistent root, but it could have and it also could have exfiltrated cryptographic keys or certificate or bearer tokens while it was on there. Better to just get a new phone if you're such an experienced software developer that you literally helped build Android.
  - drewmol 6y ago
    If you don't fear as a binary then threat assessment and mitigation cost may be a factor. Could be a closet ios user.

alex_duf 6y ago

I've had the same issue as the author of the post. The barcode scanner wasn't any shitty app, it was the one that was recommended a long time ago by Google authenticator. I had left it installed on my phone and it must had had the dodgy update that got it banned from the app store.

riphdd2020 6y ago
> the one that was recommended a long time ago by Google authenticator That's where I remember it from, thanks! However I think there's some confusion here: the one the blog mentions is not https://play.google.com/store/apps/details?id=com.google.zxing.client.android https://play.google.com/store/apps/details?id=com.google.zxi... (github based, relatively trustworthy looking, recommended by Google Authenticator back in the day), it's the now removed qrcodescanner app: https://webcache.googleusercontent.com/search?q=cache:38t1gWApYMMJ:https://play.google.com/store/apps/details%3Fid%3Dcom.qrcodescanner.barcodescanner%26hl%3Den%26gl%3DGB+&cd=3&hl=en&ct=clnk&gl=uk&client=ubuntu https://webcache.googleusercontent.com/search?q=cache:38t1gW... I think those bad reviews on https://play.google.com/store/apps/details?id=com.google.zxing.client.android https://play.google.com/store/apps/details?id=com.google.zxi... are because the malware probably used the zxing qr library, and there might be traces left in it, or these users are just confused (or the malware app deliberately pointed low star reviewers to the github competitor app in the play store). As others have stated, this github app with the bad reviews hasn't been updated for a long time. If the malware is also in https://github.com/zxing/zxing https://github.com/zxing/zxing , I really hope they do a postmortem to explain how. The fact that https://play.google.com/store/apps/details?id=com.google.zxing.client.android https://play.google.com/store/apps/details?id=com.google.zxi... still exists though, while the app mentioned in the blog has been removed by google, makes me think the zxing app is clean.
- Rooster61 6y ago
  Hang on a second, something is fishy here. I had an issue that the mirrors what was happening on the zxing reviews. I was getting a full page ad every 15 minutes or so after unlocking my phone. The rub? It wasn't this app. It was another one that was also called barcode scanner. It was also beginning to garner negative reviews, which the developer (had a Ukranian email address) had begun responding to saying the app was perfectly legal because it was serving ads only inside the app itself. I'm wondering if that deluge of bad reviews is directed at the wrong app? I'll look to see if I can still find the google play page for the one I had. Also, I had that app for a LONG time before it started displaying this kind of behavior just last month, which also corresponds to the bad reviews starting on the zxing app.

swiley 6y ago

IMO: the lesson here is that restricting people to the OS vendor's software repository doesn't prevent malware. The only way to even help that is via community review (note that apple doesn't review internal behavior of the apps or instrument them in any way, they just have someone try using them behind a proxy) and enforcing public available source code like fdroid.

FloayYerBoat 6y ago
"the lesson here is that restricting people to the OS vendor's software repository doesn't prevent malware" This was a side-loaded app on an unlocked phone. What am I missing?

crossroadsguy 6y ago

As an iPhone user and an Android developer my lessons learnt, over the time, are: 1. Do not trust Google to vet the apps in the play store. They won't; they don't even try. 2. Those shiny Play Protect and whatnot postured around by Google are practically utter useless bs/bloat 3. Stick to famous, really famous apps from the Play Store - as in well known - e.g. Facebook, Netflix, Evernote etc (you will be tracked of course, you won't be hacked - you pay this price by using Googled Android anyway) 4. If you couldn't find a well known app on Play Store - head to https://www.f-droid.org https://www.f-droid.org 5. Do not, just do not download any other app on your phone (treat it as a no exception rule) unless you know what you are doing and possibly can look at the code - find something decent as an APK from GitHub et al. 6. Be very miserly when it comes to doling out permissions to apps. Your default should be "no". 7. Privacy (not really) and safety are just superficial polish by Google on Android OS - their core and only focus developing the OS is: making it as much of an ad platform as they can and on top of that how to get a bigger and bigger cut of the overall ad revenue with every release.

ladyanita22 6y ago
You speak like if you were any kind of authority. Nowadays anybody can be an Android developer, India is full of teenagers doing it.
- maxmalysh 6y ago
  http://www.paulgraham.com/disagree.html http://www.paulgraham.com/disagree.html
  - ladyanita22 6y ago
    TL;DR
    - Qub3d 6y ago
      The part of pg's comments that relates to your comments is this part: "Saying that an author lacks the authority to write about a topic is a variant of ad hominem—and a particularly useless sort, because good ideas often come from outsiders. The question is whether the author is correct or not. If his lack of authority caused him to make mistakes, point those out. And if it didn't, it's not a problem." But in general, Paul Graham isn't saying anything that is novel to this site's comment guidelines: Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community. Comments should get more thoughtful and substantive, not less, as a topic gets more divisive. https://news.ycombinator.com/newsguidelines.html#comments https://news.ycombinator.com/newsguidelines.html#comments

drcongo 6y ago

My takeaway from this post is never use Android. Not that I ever would.

Can_Not 6y ago

I had a QR scanner installed for _years_ before it started (in December) giving me chrome pop-ups for spammy links. The dev is even on the app store lying saying the ads are in the app when the app is actually covertly waking itself up to open chrome.