HomeNewsCrypto Coinbase to Support Litecoin and How it Can Change Bitcoin’s Path Crypto, NewsExecutives Researchers Individuals Topics | March 26, 2014 March 26, 2014 CoinKrypt: How criminals use your phone to mine digital currency By Marc Rogers In order to add to their stockpiles, criminals are getting really inefficient: turning phones into digital currency-mining bots.We recently saw several versions of this malware family we call CoinKrypt, which is designed to hijack your phone in order to use it to mine digital currency for somebody else.So far we have only found CoinKrypt in Spanish forums dedicated to the distribution of pirated software.Digital currencies are acquired through a few avenues.You can buy them on their respective markets, but you can also perform a process called “mining.” By mining you allow the digital currency to use your computer’s resources to validate waiting transactions.Only when a transaction has been validated in this way can it be added to the blockchain.

As payment for lending your computing time to the network the network rewards miners with newly created coins.The process is possible for any ordinary computer or smartphone using a special piece of software.While it doesn’t steal any information from your phone, mining can be incredibly resource-intensive and, if allowed to run without any limits, could potentially damage hardware by causing it to overheat and even burn out.As a minimum, users affected by this malware will find their phones getting warm and their battery-life massively shortened.CoinKrypt might suck up your data plan by periodically downloading what is known as a block chain, or a copy of the currency transaction history, which can be several gigabytes in size.Currently detection levels are very low for this threat and although distribution appears to be primarily through shady Spanish forums most of the detections are in France .If you’ve got Lookout, don’t worry about your phone becoming a slave to this criminal’s mining operation.

Targeting low-hanging fruit As malware goes, CoinKrypt is about as basic as they come.Comprised of just three small program sections or classes embedded in the target app, all it really does is kick off the mining process.However this lack of complexity is part of what makes it dangerous.Normal mining software is set up to throttle the rate at which coins are mined to protect the hardware it is running on.litecoin hash poolThis includes no such protection and will drive the hardware to mine until it runs out of battery.bitcoin double shaOverheating associated with this kind of harsh use can also damage hardware.bitcoin mining with ciscoWe’ve seen it targeting Litecoin, Dogecoin, and Casinocoin, yet ignoring the much more popular Bitcoin.bitcoin miner ghs

This leads us to believe this criminal is experimenting with malware that can take advantage of lower-hanging digital currency fruit that might yield more coins with less work.With the price of a single Bitcoin at $650 and other newer currencies such as Litecoin approaching $20 for a single coin we are in the middle of a digital gold rush.bitcoin kurs vor 2 jahrenCoinKrypt is the digital equivalent of a claim jumper.wow ethereal loreWhy target Dogecoin or Litecoin and not the much more profitable Bitcoin?In order to control the rate at which new digital coins are minted, the software that runs the currency sets a difficulty rate which governs just how much processing power you need to expend in order to solve the blockchain and get new coins.The difficulty for Bitcoin is so tough right now that a recent mining experiment using 600 quadcore servers was only able to generate 0.4 bit coins.

Table comparing mining difficulties between digital currencies as of 3/14/14 As you can see from the table above, it is almost one million times easier to mine Litecoin than Bitcoin and over 3.5 million times easier to mine Dogecoin.Despite the fact that this malware author was likely targeting the lower hanging digital currency fruit, mining likely isn’t worth the return on investment for this malware.When we tested the feasibility of mining using a Nexus 4 by using Android mining software such as the application “AndLTC”, we were only able to attain a rate of about 8Kh/s - or 8,000 hash calculations per second, the standard unit of measure for mining.Using a Litecoin calculator and the difficulty setting mentioned above we can see that this would net us 0.01 LTC after seven days non stop mining.That’s almost 20 cents.This is probably why the latest samples we have found are now targeting an even newer, or lesser-used digital currency.While mining as a strategy hasn’t paid off for these malware authors, as these digital currencies continue to grow, we predict that the number of new malware families targeting them will also continue to grow as malware authors experiment with various different strategies in their desire to cash in.

Check out our suggestions on how to stay safe: Make sure the Android system setting ‘Unknown sources’ is unchecked to prevent dropped or drive-by-download app installs Download a mobile security app like Lookout’s app that protects against malware as a first line of defense Author Marc Rogers Executives Researchers Individuals TopicsBitcoin Sign up or log in to customize your list._ Here's how it works: Anybody can ask a question Anybody can answer The best answers are voted up and rise to the top up vote down vote favorite 13 I know that I pay the transaction fee per kB, so how can I calculate how large the transaction will be before I send it via the RPC api.I run a site called bitcoindebit.net, and I cannot let the user's balance go negative, so I need to know if they have enough balance to cover the cost.transactions bitcoind transaction-fees up vote down vote Assuming all the inputs you are spending are from regular "pay to address" transactions, each input will contribute 180 (plus or minus 1) bytes to the transaction.

Each output adds 34 bytes to the transaction.And there's a fixed extra 10 bytes which are always present.The "plus or minus 1" comes from the fact that each input needs a signature to be claimed.The signature contains two 32 byte values, but if either of the values has a first byte of 0x80 or more, it has a 0x00 byte prepended to it.So I'm assuming one of the two is high and the other is low.That way I'm off by at most one byte per input.So if your transaction has in inputs and out outputs, the transaction size, in bytes will be: in*180 + out*34 + 10 plus or minus 'in' For example, this transaction has 40 inputs and 16 outputs.That gives us a transaction size of 40*180 + 16*34 + 10 +- 40 i.e.7754 +- 40 bytes.The actual size is 7761 bytes.If the inputs are from "pay to pubkey" transactions then the inputs are smaller than for "pay to address" transactions.And this will be different also for "pay to script hash" inputs too, depending on how/if that's implemented.Edit: This transaction was made with bitcoins stolen in the Linode heist and shows a transaction size of 1337, possibly a deliberate use of leetspeak in the blockchain.

Edit2: Now that compressed public keys are commonplace, each input is 32 bytes shorter and so the transaction size is now: in*148 + out*34 + 10 plus or minus 'in' up vote down vote It is important to understand that the transaction fee you have to pay to make a payment is based on how you received the funds you are using to make the payment.The outgoing payment (assuming it's only to one place) is always going to be the same size.So the 'out' part will always have two standard "pay to address" scripts.The size of the 'in' part will depend on how many outputs you have to claim, which depends on how you got the funds.So I wouldn't suggest charging the transaction fee to the person withdrawing, because then you're billing the user based on parameters the user has no control over.The transaction fees depend on things like how many transaction outputs you have to gather to get the coins needed.That's completely dependent on how your funds are structured.Imagine if you walk into a candy store and are told that a candy bar is 35 cents, but then when they rang you up, they tacked on a 15 cent fee.

When you asked them what it was for, they explained that the previous customer had paid them all in pennies, and in order to give you your change, they'd have to count all those pennies, and that takes more time.I think you'd be pissed because that fee has to do with how their funds are structured and has nothing to do with your transaction.You would expect them to either eat those costs or build them into their prices.You wouldn't expect them to figure out exactly how much it costs to sell you a candy bar based on their internal business configuration and charge you personally based on that.Either charge a flat fee per withdrawal (.01 BTC is currently common) or cover the transaction fees yourself.And use sensible strategies to reduce transaction fees.But, in my opinion, you really don't want to pass on that kind of cost to a customer.up vote 7 down vote Here are some calculations based on the Protocol Documentation.A Bitcoin Transaction is composed of the following: Version (4 Bytes) TxIn Count (1 ~ 9B) For each TxIn: Outpoint (36B) Script Length (1 ~ 9B) ScriptSig(?)

Sequence (4B) TxOut Count (1 ~ 9B) For each TxOut: Value (8B) Script Length(1 ~ 9B)* Script (?)* LockTime (4B) Assuming a standard P2SH/P2PKH transaction is created, the script length marked in asterisk will be bound to 1byte as the Script Length is encoded as a variable integer; while the script size marked in asterisks will be bound to 24bytes as it will only contain a script hash.So, in summary, we can assume that the maximum bound of each TxOut to be 33bytes if we are paying to a P2SH/P2PKH address, since there are 4 opcodes in each output script.Assuming we are spending P2PKH outpoints for our TxIn.Our ScriptSig (composed of a 72byte DER Encoded Transaction Signature + 33byte Public Key) would be 146bytes in size and our script length will only consume 1byte as the size of the ScriptSig is less than 0xFD.Therefore, a standard P2PKH/P2SH transaction spending a ONE UTXO redeemable with a basic ScriptSig paying to only ONE output is 189bytes.Otherwise, we can also further generalise this to: in marks the number of TxIns out marks the number of TxOuts Assuming that in < 254 and out < 254.