8 ms·
Apps with millions of Google Play downloads covertly mine cryptocurrency
- diminoten 13y ago> the purveyor of the apps subsequently earned thousands of Dogecoins So like 5 bucks?
- changdizzle 13y agoThis is alarmingly similar to the ESEA situation where ESEA (a premium membership gaming community) discreetly built a bitcoin miner into their anti-cheat client [1], fried some users' graphics cards and were found out then fined $1MM. [2] [1] http://www.theverge.com/2013/5/2/4292672/esea-gaming-network-bitcoin-botnet http://www.theverge.com/2013/5/2/4292672/esea-gaming-network... [2] http://www.wired.com/wiredenterprise/2013/11/e-sports/ http://www.wired.com/wiredenterprise/2013/11/e-sports/
- devindotcom 13y agoThis is pretty hilarious. Given how small the load can be to automatically contribute hashes to a pool for ___coin, I expect more of these in the future, but smarter. Runs for 5 seconds per minute on ten million devices for six months? That's no joke with some of the hardware out there. It's this close to a victimless crime (that is, unless the victim gets their CPU/GPU fried, as has happened with these nets before). But what about apps that use spare cycles while you're plugged in, or above 75% battery, or between hours x and y, to mine dogecoins for charity? People would voluntarily submit to that!
- wyager 13y agoIt's still stupid. Mobile devices are orders of magnitudes worse than PCs at the integer arithmetic required for cryptocurrency mining.
- gargarplex 13y agoonly a brewing threat til it becomes a force. innovator's dilemma.
- devindotcom 13y agoBut you have orders of magnitude more of them. Slaved mobile devices are orders of magnitude cheaper, too!
- wyager 13y ago>But you have orders of magnitude more of them. Not according to this: http://www.technologyreview.com/sites/default/files/images/MJ13_BizReport_charts.2.png http://www.technologyreview.com/sites/default/files/images/M...
- alandarev 13y agoYes, but very few PC owners will download & run songs.exe executable to listen to several songs available at youtube.
- doesnt_know 13y agoElectricity and bandwidth are both resources that most people have to pay for, I would consider this theft and not a "victimless crime". The severity of financial impact on the victim is irrelevant. If I steal tiny amounts of money ~0.01c from large amounts of people and accrued significant wealth from it, is it fine? Is it a "victimless crime" because the amount is so small?
- negrit 13y ago> The severity of financial impact on the victim is irrelevant. Not if it actually damage some parts of the phone like the battery because you have to charge it more often.
- saurik 13y agoYou seem to mean "negligible", which is a different meaning than "irrelevant"; the point that was being made is that even if it were a "negligible" amount, the crime is not "victimless", hence the amount of the theft is "irrelevant": the point you seem to be making is that it might be a non-"negligible" amount, which is probably true, but at this point in the thread unrelated, and in fact according to the post you are responding to, "irrelevant" ;P.
- inheritancejon 13y agoI agree, its theft. If I borrow your bicycle all the time without you knowing it may be innocent enough, but it still causes wear and tear on the bicycle. I am thieving bicycle time from you that you paid for. If I had simply asked for it, you couldn't blame me, but alas I took it without your consent. [edit] Do either of these apps explicitly state that they will access/use device in this way?
- termain 13y agoNo it's not theft, it's conversion. https://en.wikipedia.org/wiki/Conversion_(law) https://en.wikipedia.org/wiki/Conversion_(law)
- UweSchmidt 13y agoIt's the disdain for the user. Take their data, use their CPUs, whatever. Users are dumb, they won't notice, and hey, the app's free anyway. Back in the day, the software on my "Personal Computer" was my friend. It was all wonderful things to have and to learn about. Looking at my smartphone that's right here on my table, it's shiny, but I've long felt a distinct lack of control over the thing. And now this: Hello - any of you apps mining anything right now in there?
- clef 13y agoI Just use the factory apps and have nothing else installed, this way no one mines anything out of me.
- qq66 13y agoExcept Google mining all your data (if you use Android)
- clef 13y agoWell then I guess Apple knows I come here often!
- Yetanfou 13y agoThat would be strange, given that the only Google-produced code on my Android-running phone comes from AOSP and has had plenty of eyes (and network sniffers, and firewalls, etc) on it to weed out any such mining. If you run Google applications (on Android or on iOS or elsewhere) you send data to Google. If you don't want to send data to Google, don't run Google applications. The same goes for Apple applications which phone home to Apple, Microsoft applications to Microsoft, etc. Android works fine without Google applications ('gapps'). It does not need the Google Services Framework to survive. You don't need the (horribly named) 'play store'. Nor Gmail, Google Maps, Google+, etc. This is one of the big differences between Android and the other bigger players in this field - you have a choice.
- galaktor 13y agoby which you also miss out on most of the things that make a smartphone worth buying in the first place...
- DanBC 13y agoHere's a story from 2004 about a school IT tech who installed SETI@home on the school machines. The increased electricity bill caused some consternation and he lost his job. http://www.techdirt.com/articles/20041010/2225204.shtml http://www.techdirt.com/articles/20041010/2225204.shtml I imagine that mining crypto currency without permission is due for a high profile court case.
- mikeash 13y agoI did that on some university servers around 1999. We had a few Alphas dedicated to batch processing, and I set up S@H to run on them. One catch was that the duration of batch jobs was limited to 12 hours, so I couldn't just fire and forget. I ended up scripting it so that when the job ended, it automatically resubmitted itself to the batch queue. It took about a day before I got a surprisingly friendly e-mail from the sysadmin asking me to please stop.
- Cthulhu_ 13y agoI'm inclined to believe that things like this could just be an alternative to ads. Ads take up CPU, battery life and bandwidth too (although a relatively small amount compared to coin mining). Alternative income source, I guess.
- jlcummings 13y agoTaking that further, I would much rather be used as a fractional miner than provide unhindered, across the board access to personal transportable data and per device usage from the device. Providing a user with means to throttle or govern the mining seems appropriate even if not explicit. If I am trying to use my device put the virtual mining crew on break and dont check back for at least 20 minutes. Secondly, exclusive mining rights. Only one app per device, but each developer can ask for a share of the haul. Having more mining apps competing for time will work in no ones favor. As the device owner I should inherently be entitled to a significant share. An auditible mining client would be valuable. I could certainly see this as something that could eventually fit neatly somewhere between an optional and encouraged part of an AOSP deployment.
- maxerickson 13y agoIt will frequently be the case that it would be cheaper for the user to simply buy whatever credits are being mined with their resources (which means that many of them won't knowingly run miners).
- jlcummings 13y agoToday, perhaps and most likely in all but a few cases. That doesn't preclude a shift or evolution of platforms to more efficiently provide that capability as a built in.
- DigitalSea 13y agoI think what surprises me most about this situation is that even though the supposed offending apps, Songs in particular has been downloaded and installed between one and five million times but only possibly generated the author a few thousand Dogecoin. Seems like a big risk for a few dollars, wouldn't advertisements be more profitable option?
- scott_karana 13y agoDoesn't the app have ads in addition to the mining aspect? As someone pointed out in a similar past thread, 1 coin for $0 of energy is still an infinite profit.
- MichaelGG 13y agoThat's putting a value of zero on being fined (or worse). I don't think the risk is non-zero. Just takes one zealous AG to file a case against you (even if you're out of jurisdiction, there's a non-zero chance you might end up passing through at some point).
- scott_karana 13y agoYes, that's definitely true. I don't know what kind of vetting is performed for free apps on the Play Store, but for all we know, couldn't it be someone pseudonymous in a non-extradition country uploading via Tor?
- incomethax 13y agoThis could be an interesting model to do out in the open. Rather than covertly mine cryptocurrency, say that the app is free if you contribute hashes to a pool, or you can buy the premium version that doesn't. Almost like the "slow" version vs the "fast" version of an app.
- yuhong 13y agoOr just mention it in the description and make it low priority using nice (in addition to doing it when plugged in).
- clef 13y agoDidn't this idea start with SETI@home in the 90's ?
- incomethax 13y agoThe idea of sharing computation cycles certainly did, however, converting those computation cycles into currency so it can fuel other "real" work is most definitely a by-product of bitcoin.
- Houshalter 13y agoThe economics make no sense. It costs more in electricity to run the program than to just pay for it directly. It's a trivially small amount.
- lazylizard 13y agofor all that trouble why don't they(makers of these apps) just buy a pc with a pair of reasonable ati cards?
- DanBC 13y agoBecause they don't pay the energy costs on other people's phones.
- kevingadd 13y agoFor a F2P app, the cost of doing this is basically 0 and the revenue will continue to increase as long as the app keeps getting popular. Doesn't matter if the revenue is small, it's still more revenue from your F2P app.
- MichaelGG 13y agoCertainly some jurisdiction might decide this isn't "fair" and attempt prosecution? May be worth a headline somplace near election time.
- herf 13y agoThese schemes mostly just convert electricity to cryptocurrency. The electricity is almost always more expensive than the value, but the app authors aren't paying the bill. If you're plugging in your 5W charger for less than half the day, the limit is maybe $2/year/user, assuming you can get away with it for a year...
- TrainedMonkey 13y ago$2 is way too high. I would say a cent per week tops.
- warp 13y agoLet's say 5W for 8 hours per day, that's 14 kWh per year. Last year I paid 17.51 eurocents per kWh, so it would be EUR 2.45 per year for me ($3.37 per year).
- TrainedMonkey 13y agoMy bad, I thought you are talking how much could be made with the phone mining.
- gargarplex 13y agoam curious which if any android AV providers caught this
- kawliga 13y agoI wonder if one could create a pyramid scheme app out of this? An invite only one. 1st guy - 100% mining load & all profit. 2nd and 3rd guy split the mining load and 99.99% of the profit. and so on...
- kawliga 13y agowait... forget invite only - anyone could download. Your rank would depend upon how early you became a member and how often you leave the app running. The mining load would increase/decrease depending upon how many users are running the app at the time. Also, place ads on the app.
- riffraff 13y agohttp://wowsuchponzi.com/ http://wowsuchponzi.com/
- svas 13y ago<shameless plug> I've been working on an idea similar to this for a few months. Instead of limiting this to crypto currency mining (a fair application, FWIW), why not approach this with the idea that people plugging in their phones every night could easily constitute the largest distributed supercomputer ever built? Everyone has the same nightly ritual: Wake up, use phone/tablet/device, plug in at night. Once it's plugged in, your phone charges to 100% after a few hours, and then essentially sits there for x hours effectively doing nothing (that's a little sensationalist, but it highlights my point). Folding@Home, et al have done this before, but the silver bullet here is that no one turns off their phone when it charges at night - perhaps to maintain the off chance they receive a random 4 AM phone call. Now if you can combine this with an SDK (say... something Javascript based) that makes it easy to write/deploy compute jobs/"apps", you have a real distributed computing platform. You can also maintain security by using a similar proof-of-work scheme that bitcoin uses to prevent fraudulent mining. The real challenge here is incentivizing people to run your app. Here's my sign up form for an early private beta for anyone who is interested. http://stynt.co http://stynt.co
- dclusin 13y agoI thought of this as well, but more along the lines of protein folding. I think finding a cure for one of those diseases would be more than enough for most people to justify the power consumption.
- svas 13y agoFolding@Home, and the BOINC network over at Berkeley have done a great job at this already. http://boinc.berkeley.edu http://boinc.berkeley.edu There's still an immense opportunity to tap unused cycles if you give people another reason to donate their device time. Unfortunately, altruistic purposes don't always appeal to the masses :-)
- zodiac 13y agoI could see it being used for protein folding, but I don't think cryptocurrency mining is an application. By running your app, I'm consuming extra electricity for which I would have to pay. How would you compensate me for that?
- Rasmase 13y agoWhat is the hashrate on these? Could'nt imagine it being very high...
- deleted 13y ago[deleted]
- epmatsw 13y agoScrypt based coins (like doge) won't get hashrates nearly that high. For example, a GTX670 pulls in ~300kh/s while mining doge. 1.3mh/s would make the Galaxy faster than the current highest end graphics card[1]. A Raspberry Pi pulls in just under half a kilohash/sec[2]. So your number is probably about 1000x higher than it should be, based on the number for the Pi. $17/hour is a lot less attractive. [1]https://litecoin.info/Mining_hardware_comparison#Laptop_.2F_Mobile_.2F_Integrated https://litecoin.info/Mining_hardware_comparison#Laptop_.2F_... [2]http://www.reddit.com/r/dogecoin/comments/1ttxhi/digging_with_my_raspberry_pi_via_its_cpu/ http://www.reddit.com/r/dogecoin/comments/1ttxhi/digging_wit...
- logicchains 13y agoI wonder how viable doing this openly would be as a free-to-play business model? Being upfront with the user: "we're not going to show you any ads and you won't have to pay anything for extra content, but we'll be using a tiny proportion of your CPU time to mine cryptocurrency to pay for the development costs of this app."
- kevingadd 13y agoIt was done secretly in the recent past, and apparently while it lasted (weeks, i think?) it brought in something like $6k. It helps that most gamers have fairly powerful graphics cards. If you mapped bitcoins mined to microtransaction currency (for in-game rewards) most players would love it.
- ckuehl 13y agoNot sure if this is what you're referring to, but this was done last year in secret by ESEA, a US gaming league (primarily Counter-Strike) [1]. They claim the value was almost USD$4,000 over about two weeks, although we don't really know how many users were affected and for how long. This doesn't seem like an extraordinary amount, though, especially if we're talking about using mobile phones instead of high-end gaming PCs. [1] http://www.pcgamer.com/2013/05/01/esea-accidentally-release-malware-into-public-client-causing-users-to-farm-bitcoins/ http://www.pcgamer.com/2013/05/01/esea-accidentally-release-...
- apaprocki 13y agoCareful.. The New Jersey DA is trying to go after an MIT student for simply exploring the freemium mining concept at a hackathon. He got MIT and the EFF to back him, but there are probably others looking to make an example out of someone. http://venturebeat.com/2014/02/12/new-jersey-slaps-mit-bitcoin-hackers-with-subpoena-and-theyre-fighting-back/ http://venturebeat.com/2014/02/12/new-jersey-slaps-mit-bitco...
- ethanbond 13y agoYep, at RPI we had a research project doing something a bit similar by tying bitcoin transactions to the HTTP protocol itself to enable on-the-fly payments with an alternative of on-the-fly mining. RPI lawyers told us to stop after we asked for counsel due to money transmitter laws. A few months later the MIT kid got hit with a subpoena. Bullet dodged for us but I really hope he pulls through with a win.
- endersshadow 13y agoThis is the thing that worries me the most about Bitcoin and other cryptocurrencies--because I want them to succeed--there are myriad laws surrounding money transfers, especially electronically. There are tax implications, as well. There are also huge trade agreements internationally--and even intranationally--that come into play, as well. Banks and credit card companies currently handle most of the legality of these things, but with cryptocurrencies, there are no banks--these are essentially cash transactions. I expect more and more folks will start to "discover" the real legal implications of some of these types of applications. I'm sure we'll see some story or what have you, and we'll all cry foul, even though the laws have been in place for many years and we mostly (albeit somewhat unknowingly) abide by them. I also expect that folks will "discover" why we have central banks for currencies, and why Alexander Hamilton was a Smart Guy. While cryptocurrencies are new, the problems they'll face aren't--in fact, we've solved these problems mostly in developed countries. They still exist pretty readily in developing countries, though. What happens when we start selling securities based around cryptocurrencies, such as derivatives? If you think the SEC will allow Americans to buy, sell, and even discuss securities openly, you are out of your mind. What about money laundering? When/if you ever work for a bank or an investment firm in the US, you'll take some training around money laundering (there are even tests at the end). The SEC (allegedly) holds these firms responsible for spotting, reporting, and stopping money laundering schemes. What happens when money laundering happens over an exchange? How will that be handled? Sorry for the long-windedness...your anecdote just got me thinking.
- wcfields 13y agoI had this as a day dream a month ago. Though it would work as in-app currency that I would give to the users and the servers / aws bill would be subsidized by the collective micromining.
- vlasev 13y agoWhy not make an app that uses your phone during charging at night to mine coins for charity?
- blueskin_ 13y agoThis is why the permissions model needs to be improved - not just to deny/grant normal ones, but also to stop apps from unexpectedly running in the background.
- yoodenvranx 13y agoAre there any example where somebody used Javascript on a website to do something like this?
- stefan_kendall3 13y agoUsers don't want to pay, and they don't want ads. The scale has to tip eventually.
- zemanel 13y agoSaddens me how low people can go for one or many bucks.
- rmrfrmrf 13y agoIt's always good to see Android users enjoying their freedom from Apple's tyranny.
- donniezazen 13y agoNo wonder Songs is an app to download pirated Bollywood songs.
- IgorPartola 13y agoI wonder if the new mobile GPU's are any good at mining scrypt-based currencies. It's possible that this could be fairly profitable. I don't think that long term this is going to replace ads though. Cryptocurrencies are too volatile at this point and I'd wager that ads are going to continue being much more profitable.
- ryeguy_24 13y agoSorry, irrespective of the legality or morality, this is quite a creative idea.
- signa11 13y agowould you like 1024 chickens or 2 oxen ?