BadLepricon malware caught stealth-mining bitcoin in Android apps

Google has removed five wallpaper apps from Android's Google Play app store, after they were found to be mining for the bitcoin cryptocurrency without users' knowledge.

Security firm Lookout identified a strain of malware called BadLepricon running within the apps, which included Mens Club Live Wallpaper, Urban Pulse Live Wallpaper, Epic Smoke Live Wallpaper and Beating Heart Live Wallpaper.

"These apps did fulfill their advertised purpose in that they provided live wallpaper apps, which vary in theme from anime girls to 'epic smoke' to attractive men," explained Lookout in a blog post.

"However, without alerting you in the terms of service, BadLepricon enters into an infinite loop where — every five seconds — it checks the battery level, connectivity, and whether the phone’s display was on."

If the battery level is more than 50% full, the display is turned off and the device is connected to the network, the malware started its process of "mining" for bitcoin – running the necessary calculations to make the currency work, and getting a share of the results.

bitcoin's design means it gets harder over time to mine, and even the most powerful smartphones in 2014 have puny computing power for this task alone. The goal of bitcoin-mining malware like BadLepricon is to draw on the power of many devices, all running software without their owners' permission.

That said, BadLepricon doesn't seem to have been a roaring success on that score: "Google promptly removed five of these applications after we alerted them to the issue. The apps had between 100-500 installs each at the time of removal," explained Lookout.

This isn't the first cryptocoin-mining malware to be exposed on smartphones. In March, security company Trend Micro said it had found apps on Google Play with between 1m and 5m downloads each which were mining for Dogecoins and Litecoins – easier currencies to mine than bitcoin at the moment.

"Reading their app description and terms and conditions on the websites of these apps, users may not know that their devices may potentially be used as mining devices due to the murky language and vague terminology," explained mobile threats analyst Veo Zhang at the time.

Security firms have been warning about the potential for bitcoin-mining botnets for some time. In June 2011, Symantec claimed that while it had "not observed any botnets currently being used to mine Bitcoins, the possibility is there" – although it also suggested that this may be a less lucrative use for a botnet than other forms of cybercrime.

Both security companies have a clear interest in getting Android users worried about stealth-mining malware: one of Lookout's two suggestions on avoiding them is to "download a mobile security app like Lookout’s app that protects against malware as a first line of defense".

For its part, Google runs its own scanning tools to try to spot malware-infected apps uploaded to its store, then takes action when apps slip through the net. "We do not comment on individual apps. We remove applications that violate our policies," a spokesperson told The Guardian.

Those policies include a section on "dangerous products" that specifies that Google doesn't allow content that "harms, interferes with the operation of, or accesses in an unauthorised manner, networks, servers, or other infrastructure", even if cryptocurrency-mining apps don't quite fit into the document's definitions of spyware, malicious scripts and password phishing.

These particular strains of malware are arguably more benign than other kinds of virus: their main impact on infected devices is to run their batteries down – and in BadLepricon's case, it stops working when the battery is half-juiced.

Even so, Android owners looking for wallpapers of smoke (epic or otherwise) and buff male models on the Google Play store should be aware they may be getting more than they bargained for.