Nearly ten million Android users have been infected by the popular barcode scanning app "Barcode Scanner" after the legitimate application was corrupted into malware. The software's malicious behavior was exposed by researchers at the security firm Malwarebytes, who reported it to Google, resulting in the app's removal from the app store.
It was at the end of last December when researchers began receiving distress calls from Android device users. The company says these users were seeing ads popping up out of nowhere through their default browsers. The strangest thing about the ad epidemic was that none of them had installed any apps recently. However, all the apps they had installed since then came directly from Google Play.
The pop-up ads continued until one of the malware victims discovered that the ads were coming from a long-installed application called Barcode Scanner.
Researchers quickly added the detection after a user reported it and Google removed the app from the store . Many users had been using the app on their mobile devices for a long time, including one user who had it installed for years.
After an update released in December , the Barcode Scanner app went from what it was supposed to be —a QR code reader and barcode generator, a useful utility for mobile devices— to full-blown malware. Although Google has since removed the app, the security company believes the update occurred on December 4, 2020, which changed the app's functionality to send advertisements without warning.
While many developers incorporate advertisements into their software to be able to offer free versions, and paid applications simply don't display advertisements, in recent years the change has happened overnight. Useful resource applications for adware are becoming more and more common.
“Advertising SDKs can come from various third-party companies and be a source of income for the application developer. It's a win-win situation, ”Malwarebytes noted. “Users get a free app, while app developers and ad SDK developers get paid. But every now and then, an Ads SDK company might change something and the ads can start to get a bit aggressive.
Sometimes, third parties may engage in "aggressive" advertising practices, but this is not the case with this barcode reader. Instead, researchers say the malicious code was included in the December update and was largely hidden to avoid detection. The update was also signed with the same security certificate used in previous versions of the Android app.
“No, in the case of Barcode Scanner, malicious code was added that was not present in previous versions of the application. Also, the added code used strong obfuscation to avoid detection. To verify that it comes from the same application developer, we confirmed that it had been signed by the same digital certificate as the previous clean versions ”.
The fact that Google has removed the app from Google Play does not mean it will disappear from affected devices . This is precisely the problem experienced by users who installed Barcode Scanner. To resolve this, users must manually uninstall the now malicious app.
Researchers were unable to determine exactly how long the barcode reader app had been a legitimate app on the Google Play store before it became malicious.
“Based on the large number of installs and user feedback, we believe it has been around for years. It's terrifying that with just one update, an app can turn malicious while still being under the Google Play Protect radar. It puzzles me that an app developer with a popular app can turn it into malware. Was it the plan from the beginning, to have an application idle, waiting to arrive after reaching popularity? I guess we'll never know, ”the investigators' report said.
Source: https://blog.malwarebytes.com/