6

I'm battling an adware on multiple Android devices which none of the Malware removal tools I tried (Kaspersky, Avast, and Norton IIRC) can find.

Behaviour

While the phone is locked, new Chrome tabs (not the default browser, Chrome specifically) are launched periodically, pointing at (don't visit!) http://vpg.dorputolano.com. This redirects you to various ugly ad-sites for gambling, betting, new phones, and what have you. It doesn't act, while the phone is unlocked.

Importantly, this behaviour has jumped devices: I first had the issue on my OnePlus 3. I was changing phones anyway at the time and I thought with a fresh install on my new phone I'd be golden. I used the OnePlus transfer app to transfer my stuff to my new OnePlus Nord, which in hindsight might not have been the best of ideas. Now after ~3 weeks of using the new phone, it started again. No apps have been installed in this period, so it seems to have a dormant period before it starts acting up.

What I have tried

  • Most obviously, switch to a brand new phone
  • Finding rogue processes via adb shell and ps -A
  • Trying to change /etc/hosts to at least not visit the bad site, but this needs root access
  • Neither of my devices were/are rooted

Device info

  • OnePlus Nord, Model AC2003
  • Oxygen OS 10.5.10.AC01BA
  • Carrier Wingo (read: Swisscom), not known for malicious behaviour
  • (The old phone was a OnePlus 3, up to date with the last update they shipped)

I'm hoping for

  • Identification of the malicious app and how to remove it
  • Further tips on pinning it down myself, maybe more adb tricks?
  • If all else fails, workarounds to mitigate the behaviour
Andrew T.
  • 15,988
  • 10
  • 74
  • 123
tannerli
  • 231
  • 1
  • 5

1 Answers1

7

Using my Google Activity History, i spotted a few activity entries of my Barcode Scanner app which didn't belong there as I didn't use the app at the time.

Uninstalling the app resolved the problem. In my case, the com.qrcodescanner.barcodescanner] was the culprit. Edit: The app has been pulled from the store since. The most recent 1-star reviews confirm that the apps is an adware since the last update.

For completeness' sake, this might not be the dev's fault since the app Andrew pointed out (com.google.zxing.client.android (Play store)) suffers from the very same condition it seems, the reviews now all say it delivers ads. Edit: Apparently this is a false positive, as it unfortunately had an identical app name and got hit with negative reviews for no reason

Edit: Maybe some barcode library further upstream got compromised?

In any case, caution on using either of the apps is advised.

Use zxing's Barcode Scanner for a better alternative

Credit to @andrewT. for pointing me to the solution

Update, 08. Feb 2021: There is now a writeup of the story at Malwarebytes Blog

tannerli
  • 231
  • 1
  • 5