2FA app with 10k Google Play downloads loaded well-known banking trojan

Re:2FA app with 10k Google Play downloads loaded well-known ... by alexbakker on Friday January 28, 2022 @11:19AM (#30116633)

It sucks to see your open source work being abused like this, and there's seemingly nothing we can do about it.

Every now and then I scour the play store to see if I can find any Aegis clones. We've reported a couple that didn't have a link to the source code and/or were linking proprietary libraries (as per our license), but they're still up. Of course, those cases aren't as bad as this one where actual malware was included, but it's pretty telling about the state of the Google Play Store.

[ Parent | on HN ]

Re:2FA app with 10k Google Play downloads loaded well-known ... by sschueller on Friday January 28, 2022 @12:31PM (#30117738)

Either way Google should be contacting the relevant police in the country the owner of the account lives. A developer account is not free so someone had to pay, if the credit card was stolen then also report that to Visa etc.

If Google doesn't have enough information then maybe they should require a government ID to get a developer account. I mean Facebook requires ID for some users.

[ Parent | on HN ]

Re:2FA app with 10k Google Play downloads loaded well-known ... by Aulig on Saturday January 29, 2022 @08:21AM (#30126060)

If deemed high-risk, Google already asks for proof of identity whe registering a developer account

[ Parent | on HN ]

Re:2FA app with 10k Google Play downloads loaded well-known ... by 0xdeadb00f on Saturday January 29, 2022 @11:59PM (#30134178)

Aegis is my TOTP app of choice! Keep up the great work, I really love it.

[ Parent | on HN ]

Re:2FA app with 10k Google Play downloads loaded well-known ... by alexbakker on Monday January 31, 2022 @09:33AM (#30148284)

Glad to hear you like it!

[ Parent | on HN ]