Slashdot Mirror
Bitcoin Miners Bundled With PUPs In Legitimate Applications Backed By EULA
hypnosec writes "Bitcoin miners are being integrated with third party potentially unwanted programs (PUPs) that come bundled with legitimate applications. These miners surreptitiously carry out Bitcoin mining operations on the user's system consuming valuable CPU time without explicitly asking for user's consent. Malwarebytes, the company which found evidence of these miners, first came across such an instance of a Bitcoin miner when one of the users of its software requested for assistance on November 22 through a forum post. The user revealed that 'jh1d.exe' was taking up over 50 percent of the CPU resource and even after manual deletion the executable was re-appearing. Malwarebytes dug deeper into this and found traces of a miner 'jhProtominer,' a popular mining software that runs via the command line". However, it seems that the company behind the application has a specific clause 3 in EULA that talks about mathematical calculations similar to Bitcoin mining operation. This means that the company behind the software can and will install Bitcoin miners and use system resources to perform operations as required to mine Bitcoins and keep the rewards for themselves."
This is why you should use free software from a reputable source, such as Debian GNU/Linux.
Bitcoin miners are being integrated with third party potentially unwanted programs (PUPs) that come bundled with legitimate applications. ... However, it seems that the company behind the application has a specific clause 3 in EULA that talks about mathematical calculations similar to Bitcoin mining operation. This means that the company behind the software can and will install Bitcoin miners and use system resources to perform operations as required to mine Bitcoins and keep the rewards for themselves
Incorrect.
Software that includes "PUPs" from the original software producer is not "legitimate". Any company with a EULA such as the one described is not a "legitimate" software company.
If you want news from today, you have to come back tomorrow.
Interesting.
Is "potentially unwanted programs" the new politicaly correct term for malware? It's OK to call it malware, even if the user technically-allegedly-probablynot signed an EULA allowing it.
If it runs an unauthorized bitcoin miner, stealing your cycles and electricity, it's malware. No exceptions.
End users need to learn to be responsible for their own systems. Then again, it's not like Microsoft has made it easy to identify running processes, what launched them and what they are communicating with, so perhaps not all blame belongs to the end user.
After all these years they figured out a way to make people pay for their software
Along with winrar
And that's a big bump in electrical use these days. Especially if they're getting GPUs involved. My gaming rig's power consumption roughly triples under load. Then it cranks out the heat so my AC kick in...
This is no worse than Flash installing Norton antivirus when you update. Sure, you can opt out of installing Norton, but most inexperienced users end up installing it anyway.
Besides, a Bitcoin miner would probably use fewer system resources than Norton.
End users need to learn to be responsible for their own systems.
True to a certain extent. But think about downloads from CNet.
Isn't CNet a trustworthy source? No? It certainly LOOKS like a trustworthy source. It's not a warez site, right?
But of course most /. folks know otherwise, we know that CNet is one the major sources of malware.
Also, please remember that not everyone who uses a computer is an "IT pro". This should not be necessary to avoid shit like this crap.
If you want news from today, you have to come back tomorrow.
A potentially unwanted program that consumes over 50% of my CPU cycles: it's called Adobe Flash. Anybody know how to get rid of it?
A new dimension in computing.
Bitcoin mining on anything but ASICs is no longer profitable. Even on an R9 290X with an 80+ Platinum PSU, you're making maybe $1 - $2 a day. And the vast majority of people don't have anything like that equipment. CPU mining is so slow, you'll never complete any work before the block is finished. GPU mining is still fast enough to get some work done, provided you own an AMD GPU.
But Nvidia GPUs don't mine BTC for beans and most mining kernels will crash an NV card or lead to rampant slowdowns and random lockups. Even an AMD card needs a low priority miner to escape the kind of UI chokeup that immediately alerts someone to a problem in the system. This might have made sense in 2010, when CPUs could still mine, but these days the return on investment is going to be terrible -- and the performance hit is big enough that people *will* notice.
This is pretty much the definition thereof.
Whenever I read something like this it makes me wonder what "plausible" software is the means of infection.
I may be naive but I can not imagine that any of the companies and individuals I install stuff of on my machines would be shady enough.
What stupid stuff from what shady source do I have to install to get a Bitcoin-Miner I didn't ask for?
At least they don't turn you into a Humancentipad
In many countries advertising a product as "free" when you have fine print that says it's not free (hint: electricity costs money) is illegal.
Could you reduce what you just said down to 10 words? Thanks.
If the EULA mentions minning of any kind and you accept it without reading it then you can't complain. The reason you have the EULA presented to you is because you're meant to read it.
I think we just need to call it UP - unwanted programs. No potentially about it.
Pretty sure that "free" chat client aggregater Digsby has been using CPU time on machines it's been installed on for ages - one of the reasons I don't recommend people use it.
It's in section 15 of their TOS.
Don't know if they've ever used this specifically for Bitcoin mining, but there's no reason they couldn't.
Remember when all the crackers could be charged with was, "Theft of Electricity"? Now this is actual real theft of electricity.
How do you want to pay for using this application?
[ ] advertisements shown within the application
[ ] participation in email campaigns
[ ] redirecting your network traffic for market analysis
[ ] solving captchas for us
[ ] by providing processing cycles
[ ] $
Seems fair to me. Just should be visible to the user and not hidden in some EULA.
Suppose this concept was used for good instead of evil. Suppose someone were to set up a benign bitcoin miner that individuals could volunteer to install and decide how much unused cpu time they were willing to allocate. Suppose, say, 85% went to some charity and 15% went to "admin overhead" and suppose people started deducting the expense as a charitable donation? Perhaps the donor might even get a bit of a cash rebate? Interested in working it through? Email me.
I would think stealthy/obscured one-sided "agreements" to use the resources of others to generate revenue without their clear knowledge should get the attention of consumer advocates and attorneys general of various states?
YMMV
I had to install Java (Open JDK/IcedTea) recently on a personal Linux PC to take an online JBoss admin class from RedHat. My employer already has the "real" Oracle item for programs they use internally installable on company PC's (I just did not want to the class to be "interrupted" by work activities I was running on another monitor for the work PC).
So there are legitimate uses for Java - imagine that!
It is very much a matter of "informed consent", and I think that is what is lacking in this topic's case of the PUP's stealthy EULA clauses for the bitcoin mining "vampire" software.
YMMV
Applies to SETI@home vs the "uninformed consent" involved with this PUP/EULA obfuscation.
I'd imagine that the fact that even GPU mining is a fairly dubious proposition at this point (I can't remember if the increases in price lately allow it to still be viable if the hardware costs are already sunk but you need to pay the electric bill; but the FPGAs and ASICs aren't getting any slower or less numerous)
Indeed, for *Bitcoin*, anything under a high-end ASIC (dozens or more GH/s) is worthless and a huge waste of electricty and heat.
even donated or stolen CPU time would be close to worthless, even if doing it in Javascript doesn't impose much overhead...
The trick is choosing the correct crypto coin: there's a whole zoo of them.
Some rely on SHA256^2 hashing like bitcoin, other rely on hashing algorithme for which only CPU implementations do exist (Primecoin is a nice example, and also doubles by doing actually useful computations instead of just plain brute-forcing hashes).
In fact TFA article is wrong, this isn't a Bitcoin miner. This is a miner for Protoshare, which is currently mostly mined on CPUs.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
And that's a big bump in electrical use these days. Especially if they're getting GPUs involved.
Not in this case. This miner isn't for Bitcoin but for another alt-coin (with a different algoritm) which is mostly mined on CPUs.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Who cares? If your freebie gets 100k installs, and only 1000 of them still work.
But instead of actually mining *Bitcoin* (have no idea where that idea came from) which will probably bring you 10$ a day,
do like TFA and install something which mines a different alt-coin powered by an algorithme which only runs on CPUs.
TFA's example is actually a Protoshare miner.
PrimeCoin is another example which is still mined mostly on CPUs (and in addition to mining also produce scientific data)
Then there are stuff like Quark Coin which use all the candidate for SHA-3 as hashing algo (and don't have good GPU implementation yet, and no ASICs at all).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
From the MWB page's quote of the relevant EULA section:
"...mathematical calculations for our affiliated networks to confirm transactions and increase security. "
Confirm WHICH transactions and WHOSE security? I think an aggrieved user could make a legal case that this language is deliberately obscuring who benefits, and in what way. Considering the use of their resources to benefit someone else is what is really happening, it should not be hard to conclude that this is fraudulently intended.
I've you thought this was bad, come back in a couple of years,where licenses will say, they can transfer your bitcoins to them ;) :) =D
That not the only incorrect thing.
The mined coin isn't bitcoin, it's protoshare.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
This.
Stealing CPUs for mining probably isn't worthwhile. Using your own GPU isn't particularly worthwhile (unless it's winter and you have electric heat, and aren't buying new hardware.) ASIC miners are available surprisingly cheaply on eBay and IIRC DealExtreme, and if you're going to buy mining equipment, the best choice is probably them or maybe FPGA boards. But from what I hear, GPU mining with stolen electricity is probably still profitable, at least if you're infecting machines yourself; not sure if it's profitable if you're also renting botnet time.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Near the beginning of the month, some group or another was exploiting a PHP vulnerability to get web servers to mine bitcoins for them. I saw multiple attempts every day in the logs.
If you're stealing all the CPU cycles it's apparently still worth it to someone.
this...
to the perpetrators of this scam... fuck you.
If the culprits are already fingered, then denounce them widely on the internet and whoever they are commercially associated with in this bundling scheme and drive them out of business (and if its not easy to remove then it is big bucks lawsuit time) Someone creative might come up with an App that would bombard the miner's result pickup site with endless garbage just for fun
What does Java do that a piece of Python\Perl\Ruby\Lisp script can't do
Run on Java ME phones is one. Acceptable performance through recompilation to native code is another. Last time I checked, Python, Perl, and Ruby were interpreted, with expectation that inner loops would be factored out into a library written in C++ and called through ctypes or the other languages' equivalents. Java threading also beats Python's Global Interpreter Lock.
I save cycles on a PC with a 1.6 GHz Atom CPU by setting plug-ins to click-to-play. It used to require an extension called Flashblock, but now it's starting to get built into browsers.
you'll be lucky to make more than your bank would have given you for the same amount of cash in a savings account.
I moved my money to Ally CDs because Chase savings accounts pay 0.01% APY.
And at least that doesn't "devalue" over time.
While fiat currencies inflate, Bitcoin keeps on deflating.
From what I know, miners only get a fee from the blocks that THEY mined. Not from other miners' blocks.
When a miner in a mining pool scores a block, the pool's owner earns the minted coins and transaction fees and then pays 98 percent of that to the miners in the pool proportional to the number of hashes that each miner contributed to a block.
Eventually you will hit a plateau where the people with cheap electricity and the latest asics will make money
Just as people invest in coal mining where coal is plentiful, people will invest in Bitcoin mining where electric power is cheap.
Man, the future of FOREX is going to make the Linux DE holy wars look like minor doctrinal differences...
I think the parallel with Linux is valid on a lot of point.
Not only have recent history seen an explosion of variants:
(There are many alt-coins just as there are many linux distributions).
But on the long term, probably is will resolve itself in the same way:
A couple of widespread mainstream variants (like Debian, Redhat, Ubuntu, openSUSE) (same in the crypto-coin world: Bitcoin and Litecoin are apparently here to stay, and happy at their position)
A few others for more specialist uses (like Gentoo, Knoppix, SystemRescueCD) (probably in the crypto world some *actually anonymous* coin will emerge).
And then a whole bunch of entries that nobody has ever heard of and are almost not used.
But there's a small difference:
- Low popularity linux distro, end up usually abandonned
- Whereas, low use coins end up being the playground for troll-traders.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]