Lotus Reader - The Hackernews Client

asveikau6 years ago

Any speculation why they would only leave in the malicious code for about a month? Changed their mind? Done without full knowledge? Achieved some high value heist and rolled it back?

jeroenhdasveikau6 years ago

An update to an ad library is what caused the malicious code in the first place. Presumably either the infected library was updated again or the developers switched libraries.

The developers behind this app did not add any malicious code they wrote themselves. The attack either came from the ad library or the ad library was hacked.

asveikaujeroenhd6 years ago

If it's the case that it was accidental I feel bad that the app was pulled rather than only vulnerable versions forced off. Although I suppose it would be hard to find assurances that it won't happen again.

btrettel6 years ago

I don't think that list is accurate. I installed CamScanner on Aug. 23, got a text about apparently being signed up for a $5/month service called GameZone at about 4:30 am on Aug. 24, and factory reset my phone the afternoon of Aug. 24 after an investigation. CamScanner was the only app I installed recently, and I saw other discussion connecting GameZone to the app. I'd say CamScanner was responsible with about 90% confidence.

In addition to factory resetting my phone, I've changed account passwords for all accounts I used on my phone, rotated every entry in my TOTP app, and logged out of all other active sessions on quite a few different services.