Bitcoin mining malware could be hidden in app, security researchers warn

'If Bitcoin, or a currency working in a similar way to it, got a stable value and a large user base, it could take cash flows forever out of the hands of government.' Photograph: Rick Bowmer/AP

Computer users are being warned about "scam" apps which stealthily use their PC's resources to "mine" Bitcoins - by getting permission in a lengthy user agreement.

The security company Malwarebytes says that it has come across a program which silently used more than half of a user's computer power to perform the complex calculations required to generate the virtual currency, whose value has skyrocketed this year to around $1,000.

Adam Kujawa at Malwarebytes says that the move is one step on from the typical "Potentially Unwanted Programs" which offer browser toolbars and search agents that capture user data and pass it back to the companies, which then use that to serve adverts.

This time, though, the program "installs a Bitcoin minter on the user system, not just for a quick buck but actually written into the software's EULA [End User Licence Agreement]. This type of system hijacking is just another way for advertising based softeare to exploit a user into getting even more cash."

The relevant part of the EULA says:

COMPUTER CALCULATIONS, SECURITY: as part of downloading a Mutual Public, your computer may do mathematical calculations for our affiliated networks to confirm transactions and increase security. Any rewards or fees collected by WBT or our affiliates are the sole property of WBT and our affiliates.

"Talk about sneaky," comments Kujawa.

He points out that this means the owner of the software would not share any proceeds of the work with the PC's owner.

Yet the efforts of the app writers - and the PC owners - may be wasted. The amount of processing power now being used to try to mine Bitcoins have increased exponentially in the past year, so that it now requires dedicated ASIC processing rigs to generate Bitcoins in any reasonable period. It's now almost impossible to mine Bitcoins using a standard PC CPU - and even "botnets" of CPUs aren't able to compete against the dedicated rigs in terms of computing power.

Bitcoin exploits against innocent users who don't participate in using the currency have been growing as its value has risen. In September, Malwarebytes pointed to the use of "ransomware" which would encrypt a system and demand a ransom - and in the meantime put the CPU to work mining Bitcoins.

And on 19 November E-Sports Entertainment, an online video game company, made a $1m settlement with the State of New Jersey to settle a case after it was revealed that a version of the company's software had in effect created a botnet to mine Bitcoins: in a two-week period in July, according to the complaint, its software took over 14,000 computers and generating around $3,500 in value at the time by mining Bitcoins. Two of the company's staff were accused of converting the Bitcoins into US dollars and depositing them in their accounts.