Barcode Scanner on Google Play infects 10 Million with One Update

[upnorth]

Content source

https://blog.malwarebytes.com/android/2021/02/barcode-scanner-app-on-google-play-infects-10-million-users-with-one-update/

Many of the patrons had the app installed on their mobile devices for long periods of time (one user had it installed for several years). Then all of sudden, after an update in December, Barcode Scanner had gone from an innocent scanner to full on malware! Although Google has already pulled this app, we predict from a cached Google Play webpage that the update occurred on December 4th, 2020.

App Name: Barcode Scanner
MD5: A922F91BAF324FA07B3C40846EBBFE30
Package Name: com.qrcodescanner.barcodescanner

Spoiler

Video Unavailable

This video is unavailable.

streamable.com

Barcode Scanner app on Google Play infects 10 million users with one update | Malwarebytes Labs

In a single update, a popular barcode scanner app that had been on Google Play for years turned into malware.

blog.malwarebytes.com

 

[Ink]

If Google incorporated a QR reader into their Camera app from the beginning (like Apple). Users wouldn't need to go around digging for malware-free apps on the Play Store, or FOSS App stores.

 

[mlnevese]

If Google incorporated a QR reader into their Camera app from the beginning (like Apple). Users wouldn't need to go around digging for malware-free apps on the Play Store, or FOSS App stores.

Samsung phones have that functionality. I believe other brands do too. There is no reason for Google not to implement it.

 

[Ink]

Trend Micro QR is the best from what I've tried from the Play Store. Not tried any FOSS versions.

 

[upnorth]

Samsung phones have that functionality. I believe other brands do too. There is no reason for Google not to implement it.

Fully agree with that, and yes other brands have this feature built-in. Even my old Huawei got it, but personal I was not satisfied with it's auto-redirection and opening links/urls without me even had a chance to intervene or even read. Very few barcode apps seems to have that protection. From my own small now old test, only 3 did. Today I can only confirm the one I still have installed.

upnorth Huawei P20 Pro

Updated to EMUI version 9.0.0.286. Includes updated Android Security patch : May 6, 2019 https://consumer.huawei.com/en/support/bulletin/2019/5/

malwaretips.com

Google has already pulled this app

Pretty poor comfort for all these millions of already infected users. It's again staggering numbers and it ain't the first time, and more then likely won't be the last either.