- Apr 24, 2013
- 1,200
Trend Micro has discovered a pair of apps that turned smartphones into tiny, secret Bitcoin mining machines when they weren’t in use. Unfortunately, these apps weren’t mining Bitcoins for their owners.
Every Android power user is familiar with that hunt for that piece of software that is causing their phone to misbehave. Whether it’s a battery that isn’t charging fast enough or the feeling that a device has slowed to a crawl for no reason, it’s almost always a rogue app that is misbehaving. Now it looks like at least two apps that were repackaged copies of existing popular apps — Songs (which copied TuneIn Radio) and Prized (Football Manager Handheld) — are guilty of doing a lot more than just getting stuck in a loop and eating up resources.
If you are one of the tens of thousands of people that had one of these two apps installed, whenever your phone was connected to power and inactive for a few minutes the behavior of the app would change. Instead of going dormant like all apps are supposed to in this situation, the “ANDROIDOS_KAGECOIN” commands that were manipulated into the Google Mobile Ads part of the app would start mining Bitcoin, Litecoin, and Dogecoin. While a single smartphone lacks sufficient power to pull in any real amount of Bitcoin, Songs was installed over a million times. When you put over a million phones all around the world to work for you several hours a day, that is sure to add up to quite a lot of Bitcoin.
Google has acted quickly and pulled the apps from the Google Play Store, but these kinds of things are unlikely to be easy to detect on a wide scale. While this one instance hid itself in Google’s own ad service, it doesn’t seem like they were aware of it until Trend Micro published their report. If this is happening to these two apps, it seems more than a little likely that it is happening elsewhere in the Google Play Store as well.
Every Android power user is familiar with that hunt for that piece of software that is causing their phone to misbehave. Whether it’s a battery that isn’t charging fast enough or the feeling that a device has slowed to a crawl for no reason, it’s almost always a rogue app that is misbehaving. Now it looks like at least two apps that were repackaged copies of existing popular apps — Songs (which copied TuneIn Radio) and Prized (Football Manager Handheld) — are guilty of doing a lot more than just getting stuck in a loop and eating up resources.
If you are one of the tens of thousands of people that had one of these two apps installed, whenever your phone was connected to power and inactive for a few minutes the behavior of the app would change. Instead of going dormant like all apps are supposed to in this situation, the “ANDROIDOS_KAGECOIN” commands that were manipulated into the Google Mobile Ads part of the app would start mining Bitcoin, Litecoin, and Dogecoin. While a single smartphone lacks sufficient power to pull in any real amount of Bitcoin, Songs was installed over a million times. When you put over a million phones all around the world to work for you several hours a day, that is sure to add up to quite a lot of Bitcoin.
Google has acted quickly and pulled the apps from the Google Play Store, but these kinds of things are unlikely to be easy to detect on a wide scale. While this one instance hid itself in Google’s own ad service, it doesn’t seem like they were aware of it until Trend Micro published their report. If this is happening to these two apps, it seems more than a little likely that it is happening elsewhere in the Google Play Store as well.
