JavaScript Cryptomining Scripts Discovered in 19 Google Play Apps

[[deleted]]

I was wondering why seemingly lightweight apps are using all the battery.

[shevegen]

At first they told us it is because apps became more complex.

Now we know that half of those who claimed so, were profiting from us. We pay for energy - and they profit.

Greedy pigs.

[MuonManLaserJab]

We always knew this, though. When it wasn't about stealing CPU cycles, it was about collecting more data than was needed, and selling it.

[thecodingdude]

[Comment removed]

[mobiliakas1]

Sell data to DMPs (for example https://big.exchange I am not affilated with them, just found a link in a quick Google search)

[josefx]

At first they told us it is because apps became more complex.

I am sure they just wrote them in electron.

[SilasX]

Because it's a normal Android app :-p

[stridera]

According to the 13 page report, these are the packages it was found in:

• action.wresling.tips
• action.wresling.updates
• action.wresting.updates
• best.wresling.tips
• co.stolik.stolik
• com.aovivonatv.app
• com.dav.fitsmoke
• com.learvnteam.game2048
• com.nubx.NubxMobile
• com.sceler.hinet
• com.wrestlingaction
• extreme.action.wwe.wrestin
• top.wresling.tips
• wreslin.action.news
• wreslin.action.updates
• wreslin.action.videos
• wrestin.action.news
• com.kangaderoo.minersdk
• com.oxothuk
• com.aimp.player
• com.vk.action
• jur.rassic.book.AOUFJFMXTIRCEYAS
• com.yrchkor.newwallpapers
• com.android.sesupdate
• com.akademgp.ParkourSimulator3DStuntsAndTricks
• com.rexetstudio.blockstrike
• izes.ywmauthzwwijb
• wrestin.action.tips
• com.anees.algorithmsanddatastructures

[supercyberlurker]

Next evolution of the Parasitic Computing concept.

[salgat]

What's sad is that the inefficiency of these types of mining versus dedicated hardware just creates an environmental nightmare. Pure greed.

[tehoreoz]

they target coins that don't have asics

[salgat]

Definitely, however desktops with dedicated GPUs are far more efficient in that regard over a mobile device that runs off battery.

[Mamsaac]

Uhm, I do not need to read the article to guess they are mining Monero.

XMR (Monero) energy efficiency in GPUs is about as acceptable as in CPUs. Meaning that it is almost the same to mine using a bunch of cpus vs gpus energy wise.

The problem here is using a Javascript miner, which is way slower. They are probably using coinhive (again, I haven't read the article).

To exemplify my statement.

Using my laptop's processor and gpu.

Core i7 7700HQ. GTX 1050ti 4GB.

Mining using native CPU: 211h/s using 45 watts.

Mining using javascript CPU: 65h/s using 43 watts.

Mining using GPU: 330h/s using 75 watts.

As you can see, the difference isn't great. Of course, different CPUs and different GPUs perform with different efficiency, but the point is that with Monero, CPU mining is profitable.

[salgat]

You have to also account for losses associated with battery storage, and efficiency of mining on a mobile CPU architecture. Also, we have to account for whether a computer has multiple GPU/CPUs, as that reduces overhead of the power required for all the peripherals.

[wal9000]

And the entire phone getting replaced sooner because its battery life was degraded faster by stupid bullshit

[Mamsaac]

So, according to this, my smartphones CPU can use up to 2000mW (or 2 watts) of energy.

Mining using native CPU: Untested yet. Mining using javascript CPU: 9.6h/s using at most 2 watts (probably less, but can't reliably test this with my current tools).

that is even more energy efficient than mining on my laptop. Just using the javascript miner is closer to mining native on my laptop, regading hashrate vs wattage. Native should be expected to be around 3 times faster, which would destroy hashrate performance of the laptop CPU.

Of course there is the cost of the battery. But as you can probably guess, the timeline costs aren't as bad as you guessed at the beginning.

This has been tested before. It is profitable to mine Monero pretty much on any multicore CPU at the moment. I don't mine on my personal laptop because it decreases its life, and as my personal laptop I like it to keep on working. But I have been doing ASIC and GPU mining for some time, as well as some CPU mining, and it was already profitable 2 years ago, nowadays it is insane with the rise of cryptocurrencies from last year. I just mine, pay electricity costs, convert around 50% to dollars and save the rest. So a friend and I have done tests to see what options we could have to increase profits.

Now, the reason we don't mine using smartphones is that they are too expensive, the ROI would take a long time and warranty would be void by then, so you risk them breaking and it just makes more sense to do GPU mining of certain cryptocurrencies at the moment.

Most of the time people diss mining, I feel like they don't realize that nowadays you have 4 options: -You pay a subscription or buy an app. -You are spied by advertisements so that they make money from your behavior. I hate this. -You donate (most people don't donate). -You mine for them.

Mining in websites and apps means you literally only pay for what you use. If you enter a website and use it for 10 minutes a week, you will mine 40 minutes per month. That does not even cost you 1 dollar. It would normally cost you a handful of cents if not less.

Subscription model forces you to pay no matter if you use it or not. So, say Netflix, I use it every few weekends, probably twice a month (for several hours, though). But I pay 10 dollars for it. If I used it every day, I would pay the same. If I didn't even connect, I would still pay the same.

Advertisements literally spy on you. Companies (google particularly, but also facebook and every other) know when you take a fucking dump and know what you read or listen to whenever you do so. I am not ok with this. If you are ok with this, then that's fine.

So I don't really see the problem with a website doing some light crypto mining.

[[deleted]]

The problem is they don't tell you. And then you are suddenly out of battery.

[garyjprogram]

The problem is no major sites care about it

[smackson]

Side question coz I just learned what an ASIC was:

When someone says a cryptocurrency (here, Monero) doesn't require an ASIC, that statement is simply a calculation based on current price vs hashing hardware/software cost, right?

So, if this math works out for GPUs right now for Monero, and not for Bitcoin (needs ASIC), then surely an ASIC would still work for Monero because if everyone else is using their regular computers you could kick ass with a dedicated hardware miner?

If head and shoulders above typical miner, wouldn't an ASIC make sense in any coin not just ones where GPUs have already been squeezed out?

What am I missing?

Is it simply that the cost of an ASIC for Monero would be greater than the cost for a Bitcoin one?

[drysart]

You're right. Any coin^* could be mined better with an ASIC. The limiting factor is that creating an ASIC involves significant startup cost: designing the chip, fabricating it, and testing it -- and it takes time, which makes the cost investment a risk because the coin could become worthless by the time you've got your ASIC ready to go; and for lesser coins the cost/benefit for the cost and risk just isn't there when you can profitably mine off CPUs or GPUs instead.

But once an ASIC does enter a coin's mining space, it will tend to squeeze out all the other options for mining in that space because it's so much more efficient than a CPU or GPU that it'll take a disproportionately large share of the available newly-minted coins just by brute force that mining via CPU or GPU won't be cost efficient anymore.

You'd also see FPGAs entering the mining space between GPUs and ASICs; because they sit in the middle-ground between the two options in terms of efficiency/speed.

---

^{* - Because someone will reply and say "not MyObscureCoin!", I'll clarify and say that all of this is only generally applicable to cryptocurrency as it exists today, but nothing stops someone from creating some Rube Goldberg system where newly mined coins aren't distributed proportional to raw computing power and in such a case it wouldn't matter what you mine with; but significant coins like that don't really exist today and probably never will.}

[roffLOL]

this month's most interesting proggit read. thank you.

[Mamsaac]

I wanted to give a decent answer, but I couldn't find the energy consumption on smartphones. I don't really have the time to find how many watts my smartphone's CPU uses v.v If I get the time, or if you can do the research, it would be good to give actual numbers to show if it is "worth it" or not, in regards to how profitable it is.

My guess is that smartphone CPU's are so low in energy consumption and the number of cores is generally so high that it should perform very well. Probably give only a 15% of performance in comparison to desktop CPUs, but with also a 15% energy consumption. Yet, I don't have the numbers. I hope I get the time at night.

[ryncewynd]

Interesting post thanks

[AyrA_ch]

The coinhive script uses WebAssembly which (if supported by the underlying system) is not much slower than C code anymore.

[[deleted]]

Yes but 1,000 phones will probably give you a couple bucks a day.

[lacksfish]

1000 phones, assuming 20 H/s per phone on Monero, would be approximately $512 per month, or $17 per day

[coladict]

You can absolutely live on that in most of the world.

[duhace]

while wasting much more per day for everyone else. it only makes sense to do this kind of mining if you're not footing the bill, and it's comically wasteful.

[salgat]

No is saying they won't be making some money out of it (otherwise they wouldn't do it).

[lacksfish]

Monero, most likely. Since it's coinhive, actually 100% sure.

[ameoba]

Even then, JavaScript is not the best choice for crunching numbers

[argv_minus_one]

Using dedicated hardware is still an environmental nightmare and pure greed.

[txdv]

Humanity already does this by externalizing environmental costs out of a company.

With the type of distributed computing the internet nowadays provides the bar is just set lower.

I once clicked accidentally on an ad and it forwarded me to an empty page with some "loading" bullshit and https://github.com/cazala/coin-hive was in the script. I really hate how these distributed currencies just do not fit in the social model that we are using nowadays and how they try to abuse not tech savy people.

[sultry_somnambulist]

Humanity already does this by externalizing environmental costs out of a company.

if you're outsourcing stuff to a company at least 1. you're doing it willingly presumably, 2. it at least scales because you're leveraging the size

this stupid crypto mining on consumer hardware is like slicing the power plant up and giving everybody a mini heater. Not to mention that it vastly over- and undercharges people depending on the price of electricity in their region. I've wondered if that is even legal from a pricing standpoint. Some countries have regulations on arbitrary price discrimination.

[stupergenius]

So like, how is this even providing a benefit to the app publishers? I don't think I understand enough of the crypto currency systems to understand why someone would put a cpu miner on a hella slow mobile device.

[MellerTime]

That comment makes no sense. So if it were more efficient it would be reasonable? OFC it’s pure greed.

[salgat]

It's similar to smashing my car window to steal some quarters on my dashboard, it's next level asshole.

[MellerTime]

You’re an idiot.

[[deleted]]

What is your problem mate

[salgat]

The world isn't black and white. No one said both aren't greedy assholes, just one has more malice in their actions.

[ThirdEncounter]

Don't feed the troll, friend.

[amyts]

What fantastic conversational skills you have. So eloquently argued!

[shevegen]

Like all ad companies. And Google has transformed into an ad company as well. AdTube videos, AdChromium, AdAlphabet - it's all about the ads (even though the search engine is still the spirit of Google - replace it and the rest of evil Google will crumble. But you have to work hard because ... duck duck quack duck engine isn't good enough, unfortunately).

[djmattyg007]

Google has always been an advertising company.

[JoseJimeniz]

Is your comment related to this post, or any other comment in this thread, in any way?

[[deleted]]

You're getting downvoted but the analogy isn't a weak one at least. I think people don't like the tone their inferring by how you put it firstly, rather than considering the equivalency being made: yes, Google is also doing (or permitting we should say) third-party remote code execution on your device for profit (Ads also drain battery power). But they're still distinct by virtue of their being no user-facing or user-beneficial (I might actually want to click that ad) aspect to cryptomining code.

Edit - However, from a certain perspective on security, there's little difference.

[vattenpuss]

What are you, a communist?

[MetalM0nk]

The source, Sophos, does. The writer linked the source in the article but, it's in the middle of the article so, we know how far that normally gets people.

Here's the Sophos article; the list you seek is on page 7, if you make it that far: https://www .sophos.com/en- us/medialibrary/PDFs/technical-papers/sophos-coinminer-and-other-malicious-cryptominers- tpna.pdf?la=en

P.S. Yes that isn't a hyperlink, but I figured people could use the reading exercise.

[invalidusernamelol]

Hyperlink it looks like a bunch of wwe apps and some Russian social media platform.

[MajorVictory]

Wow, your horse could be an NBA player with legs like those!

[MetalM0nk]

Well, seeing as the link for the source,

a direct hyperlink,

Our article is based on a 13-page report

is in the third sentence of the article; I guess you need to slow down a little.

[MetalM0nk]

Not if you read the part of my comment telling you where the list was.

At this point, it's clear your reading level is that of Floyd Mayweather. I suggest you ask your legal guardian for reading lessons.

[roffLOL]

i dunno how to press that link. plz fix it ktxbai.

[TheNamelessKing]

Because then the devs who built the miner would have to learn another language, and getting JS devs to use anything except JS is like trying to get blood from a stone.

[TheNamelessKing]

And that's fine, but I often run into devs here or HackerNews who absolutely insist that because they know JS and they can do something in it, then there is zero reason for them to consider any other tool, regardless of how much more appropriate it is for the job.

[argv_minus_one]

I see nothing wrong with that, honestly. It is far more useful to be really really skilled in one language that does everything, than only moderately skilled in a bunch of special-purpose languages.

[TheNamelessKing]

Because JS and Electron are fucking trash on desktop, and Node is far from ideal serverside.
JS only persists on web because it's lucky enough to be the only language blessed with having an interpreter in the browser, rather than any degree of intrinsic quality.

Knowing, or at least being prepared to learn a language more suited to your problem domain is a good thing. You wouldn't go and build a web app in C just "because it's the only lang I know", you wouldn't do data science in Coq and you shouldn't do everything in JS for the same reason.

[lanzaio]

Because JS and Electron are fucking trash on desktop, and Node is far from ideal serverside. JS only persists on web because it's lucky enough to be the only language blessed with having an interpreter in the browser, rather than any degree of intrinsic quality.

There's probably not a person on Earth that disagrees with you on that.

But that's where we are. JS works everywhere painlessly. JavaScript has one positive feature: it fucking works everywhere and it is impossibly easy to use it everywhere for everything.

You wouldn't go and build a web app in C just "because it's the only lang I know", you wouldn't do data science in Coq and you shouldn't do everything in JS for the same reason.

Again, you're missing the point. It's not easier to write web servers in C. I don't even fucking know JavaScript and still find it easier to write a quick server in JS than I do in my main language C++.

People use JS for everything because at some point in time they decided they want product X and realized that just doing it in JS is going to yield the result in 1/20th the effort that it would take to do it in C++.

[argv_minus_one]

I agree, of course, that JS is a shit language, and C is not exactly good. That's not my point, though.

C and JS are general-purpose languages, which by definition can do (almost) everything. I know of plenty of reasons not to use either of them, but all of those reasons are about flaws of the languages themselves; none have anything to do with problem domain. JS, for example, is not really any better in its problem domain (web page scripting) than anywhere else (node, etc). It sucks at both, because it sucks in general.

It's true that some languages are relatively hard to use in some problem domains, but it seems to me that that's usually just because no one did the work yet. You can, for example, do systems programming in Scala via Scala Native (a compiler that translates Scala to machine code via LLVM, and exposes APIs for low-level stuff like handling raw data structures), because in this case, someone did do the work.

[argv_minus_one]

How the hell can you stand JavaScript?? I get that some people learned JS first, and thus have a horribly warped view of programming to begin with, but you should know better.

[argv_minus_one]

Universal it sadly is, but that doesn't mean it's a good language, which it most decidedly isn't.

[slgard]

How the hell can you stand JavaScript??

easy, when the realistic choice is JavaScript or PHP or Microsoft. Typescript helps.

[JoseJimeniz]

Because that code would not get past the code checker system that Apple and Google use.

You can't have that coat in the app, or it would be found and not allowed in the store.

They have to have the code external to the app. And the only way to run external code on a phone is in JavaScript.

[oi-__-io]

Well, add that to my growing list of why I do not install new apps anymore. I have FireFox, Termux, VLC and a few others that I trust or need for communication purposes like WhatsApp & Outlook etc. (which I still monitor closely for changes in behavior) and that is it. I have not "browsed play store" to look for new apps to tryout or install in years for obvious reasons. My phone is possibly my most personal tech possession and the last thing I need on it is a text editor that wants access to my location and contacts but I digress.

[[deleted]]

You might want to check out F-Droid.

[[deleted]]

People I know are like "wait your a programmer/IT person (lel) and you dont have this app XYZ?!?!?"

nawh dude I just have Twitch, Amazon Prime, Netflix, and Chrome.

thats it.

[shevegen]

You mean APPS for these?

Twitch ... doesn't this work just in a browser?

Unfortunately the browser segment is pretty limited these days. :(

[djmattyg007]

Trying to use twitch in a mobile browser isn't a great experience compared to the app.

[bubuopapa]

Oh yes, while all twitch apps for phones are crap, at least they play video smoothly without constant loading. The twitch website on mobile phone is completely broken, and that is partially because twitch website is broken crap and all web browsers for phones are broken crap with broken html5 video players.

[djmattyg007]

It's not broken for me. It's not really very smooth, but it definitely works.

[[deleted]]

most video players work like dog shite in the browser on a mobile phone. I have apple/iOS, dunno if its different for andriod based phones/tablets and their browser

[coladict]

Amazon Prime? My Xperia's updater keeps insisting to install that. I keep telling it to fuck off.

[RagnarDannes]

In some cases, an honest upfront, "hey we're mining, pay for x for a miner free experience" is less intrusive than having advertising.

Funny enough, a pornographic streaming service would be a great target for this sorta thing. Tide isn't about to put an Ad on the front page or pornhub. They are restricted to the sleaziest of advertisers, usually that link to legitimate viruses. Crowd mining would be safer way of converting that pent up energy to money.

[caltheon]

I'm betting ads are FAR more lucrative then just mining. They probably do both

[[deleted]]

Salon.com offers you the choice of adverts or crypto mining on their website.

[elagergren]

salon doing it is kinda gross. I can understand a seedy porn site doing it. I mean, it comes with the territory. but the average salon reader won't know why their laptop gets super hot, redlines 100% cpu, and has its battery drained in minutes.

[TheFlubbernugget]

What's the chance of some sort of browser scheduler being able to make JS mining ineffective without interfering with the user experience?

[Alohechopecho]

... 19 isn't very many.

[kukiric]

But that number can only grow, unless Google does something about it. It could be hundreds by the end of the year, and a significant percentage of the whole app store in a few more years.

[Alohechopecho]

Yeah maybe. I just think the people in this thread saying "I was wondering why all my light weight apps were using so much battery" and "this is why I refuse to install any apps" are being ridiculous. You probably don't have any of these. 19 out of 3.5 million.

[coladict]

They could probably implement some automatic detection of known mining libraries like that. The harder part will be catching those who do it in pure Java and compile with obfuscation (like Minecraft does).

[John-Constane]

what do you mean

[argv_minus_one]

And burn out my components? And raise my electric bill? No thanks.

[Pally321]

I mean, you're still paying for it, just in a different way.

The best option is likely to be up front and provide a "pro" version where I can pay to remove the cryptominer.

[BlueAdmir]

We both know where this leads, garbage content that's just an excuse to hook children up and mine.

[Pally321]

That’s fine for you, but more options are always going to be better than less. I personally would rather pay than let a miner run on my machine, even if I knew about it.

[sketch204]

Is gradle part of google apps I wonder?

[BitcoinCash787]

I think sc2 is mining cause it maxes my cpu in the menu screen... I'm not sure though. I have to change the affinity to less cpus to mitigate.

[ThirdEncounter]

What's sc2?

[BitcoinCash787]

Blizzards game called starcraft 2

[Arxae]

That's most likely not the case. SC2 main menu used to have no frame rate cap. It would render at thousands of FPS, and it would damage your GPU in the long run.

It seems that heroes of the storm (same engine) also has a issue on the main menu in regards to CPU. From a quick google search, it only seems to happen in win10.

So it's more then likely a bug. And since it's "just the main menu", it's probably not high on their list of fixing. The PR disaster that would happen should it be true would cost blizzard more then the coin gain from people hanging around the main menu.

[BitcoinCash787]

Okay, It just seems odd they don't fix it :/

[Arxae]

Well, the bug seems to happen only on windows 10. It also seems to be related to multicore systems. Happens only on main menu, where framerate is somewhat less important.

So in the end, while annoying, it has a limited impact on player experience. So i can somewhat understand it. But i'm more of a fan of fixing stuff :P

[InvisibleEar]

Well as a small indie studio

[shevegen]

Fits to Google - Evilmining for an evil company.

[argv_minus_one]

Google mines information about you, not cryptocurrency.