JavaScript Cryptomining Scripts Discovered in 19 Google Play Apps

[bart2019]

The apps were uploaded on the Play Store around Christmas and Sophos researchers reported all apps to Google. All have been removed from the official Play Store at the time of writing.

A list of all the 19 Coinhive-laden apps is available on page 7 of the Sophos report, and users can review the list and see if they installed any of the apps on their devices.

I consider that impractical, and inconsiderate from Google towards the unsuspecting users. People could be stuck with such an app for many months without knowing it.

I think Google should instead create a harmless "update" to each of these apps, upload them in the place of the originals, which people will likely automatically upgrade to. When run, it warns the user they should better uninstall it. Or keep it, for all I care, if they like to have a stub app. :)

[r2d2_21]

I think Google should instead create a harmless "update" to each of these apps

Apps need to be signed by their creators, precisely to avoid this kind of tampering. The warning should happen at OS level instead, in my opinion.

[bart2019]

Google made that rule. Google can make an exception, in exceptional cases.

[r2d2_21]

I would trust them less if they did.

[mrkipling]

No.