Mac app 'Calendar 2' mined cryptocurrency by default, removed from Mac App Store

Posted:
in Mac Software edited March 2018
Popular Mac app "Calendar 2" recently added a "payment" option that uses customer computers to mine the cryptocurrency Monero in exchange for free access to premium features, but a bug in the app's code allowed the miner to run indefinitely even when users opt out of the default setting.




As outlined by ArsTechnica, Calendar 2 developer Qbix integrated an xmr-stack miner that runs when users agree to default terms. Specifically, users are presented with a dialog box that notes the app dedicates CPU cycles to mining digital coins in return for access to premium features.

Though set as the default option, customers can elect to pay a one-time fee or subscription rate to unlock all premium features. Alternatively, users can access a version of the app without any extras for free.

Unfortunately, Qbix founder Gregory Magarshak in a statement to the publication said the mining rollout has run into two issues, the first being a bug that caused the miner to run even when the default setting was not selected. A second flaw allows the miner to consume more than the designed 10 to 20 percent of a host Mac's CPU duty cycle.

Apple failed to respond to requests for comment on Calendar 2's mining activities, specifically whether they breached App Store terms of service, and allowed the app to remain on the App Store. The company's guidelines are largely undefined when it comes to cryptocurrencies, and there appears to be few contingencies in place for strategies like the one put in place by Qbix.

In response to the report, Magarshak decided to remove the mining function from his app, citing problems with the miner's source code, the feature's buggy launch and a personal distaste of "proof of work" computing.
We have decided to REMOVE the miner in the app. The next version will remove the option to get free features via mining. This is for three reasons:

1) The company which provided us the miner library did not disclose its source code, and it would take too long for them to fix the root cause of the CPU issue.

2) The rollout had a perfect storm of bugs which made it seem like our company *wanted* to mine crypto-currency without people's permission, and that goes against our whole ethos and vision for Qbix.

3) My own personal feeling that Proof of Work has a dangerous set of incentives which can lead to electricity waste on a global scale we've never seen before. We don't want to get sucked into this set of incentives, and hopefully our decision to ultimately remove the miner will set some sort of precedent for other apps as well.

Ultimately, even though we technically could have remedied the situation and continued on benefiting from the pretty large income such a miner generates, we took the above as a sign that we should get out of the "mining business" before we get sucked into the Proof of Work morass of incentives.
Following the report and subsequent statement from Magarshak, Calendar 2 is no longer available for download on the Mac App Store. Whether it was Apple or Qbix that pulled the app is unknown.

Comments

  • Reply 1 of 12
    cornchipcornchip Posts: 1,954member
    Oi!
    SpamSandwichanton zuykov
  • Reply 2 of 12
    tonkinitetonkinite Posts: 7unconfirmed, member
    Is it possible other Apps are doing this surreptitiously? I’ve noticed other Apps like White Noise are pulling a fair amount of resources... 
  • Reply 3 of 12
    MplsPMplsP Posts: 4,043member
    tonkinite said:
    Is it possible other Apps are doing this surreptitiously? I’ve noticed other Apps like White Noise are pulling a fair amount of resources... 
    The way it drains battery, I'm wondering if WhatsApp does!
    racerhomie3
  • Reply 4 of 12
    chasmchasm Posts: 3,610member
    I hope this incident will prompt Apple to do a thorough investigation of Kenny have currently in the App Store maybe secretly mining. This should be completely against the rules, with or without user knowledge. Cryptocurrency mining for others is, in effect, a virus.
  • Reply 5 of 12
    seanismorrisseanismorris Posts: 1,624member
    There isn’t enough information about mining cryptocurrency to allow users to make educated decisions.

    For instance, while I’m reading a book on my IPad, I might benefit from an app mining CC.  But there are unknowns...

    How long does it take to make X dollars?  How much power (and cost of that power) is mining using?

    The cost of powering the device might be more than the mining of CC...

    If you use apps that integrate CC the user might benefit.  But, what about the users parent that gets the electronic bill?

    Allowing CC in apps (not dedicated to mining) sounds like a lawsuit waiting to happen.  They’re like unapproved micro transactions...
  • Reply 6 of 12
    racerhomie3racerhomie3 Posts: 1,264member
    Damn.
    Can iOS be exploited like this?
  • Reply 7 of 12
    anton zuykovanton zuykov Posts: 1,056member
    Damn.
    Can iOS be exploited like this?
    Why not? It is an routine/alg that can be run! Apple static analysis will likely not pick it up!
  • Reply 8 of 12
    MacProMacPro Posts: 19,851member
    Damn.
    Can iOS be exploited like this?
    Luckily the head gardener in our walled garden can and just did, prune such weeds.  ;)
    jony0
  • Reply 9 of 12
    There isn’t enough information about mining cryptocurrency to allow users to make educated decisions.

    For instance, while I’m reading a book on my IPad, I might benefit from an app mining CC.  But there are unknowns...

    How long does it take to make X dollars?  How much power (and cost of that power) is mining using?

    The cost of powering the device might be more than the mining of CC...

    If you use apps that integrate CC the user might benefit.  But, what about the users parent that gets the electronic bill?

    Allowing CC in apps (not dedicated to mining) sounds like a lawsuit waiting to happen.  They’re like unapproved micro transactions...
    I have a miner on my work-PC, (i7-4770k, Quadro K1200, few years old and medium spec I'd say). I have to leave my computer on at night so I can remote access it from home - 9/10 times it's sitting idle so when I head home I fire up the miner. I use "awesome miner" which continually switches to the most profitable crypto to mine every hour, I then auto transfer the totals into my chosen coin... ethereum. After about 35hours of mining, I have £1 worth of ether lol. Tiny bump in electricity cost overnight but it only a few pence, nothing to even consider tbh.

    Performance wise, I can happily run the miner while I'm working in something like MS Word or Access but it is impossible to do serious computing while it runs in the background (large inventor model or rendering for example).

    It's definitely a money maker but  I can't imagine a miner restricted to 10-20% of cpu usage generating huge sums.
  • Reply 10 of 12
    linkmanlinkman Posts: 1,046member
    The cost of powering the device might be more than the mining of CC...
    It's not your problem if you are raking in the $ while the other guys are spending the $ for the electricity!
  • Reply 11 of 12
    tipootipoo Posts: 1,158member
    Had they made it the first thing you saw rather than burried in settings (which most users probably never touch), I'd have been totally fine with monetizing that way. 

  • Reply 12 of 12
    urashidurashid Posts: 127member
    Hmmm.  My version (2.5.2) does not show the "Upgrade" icon in the Settings toolbar.  I can't check now, but I am pretty sure it is the latest version.
    I did check its resource usage and while the Network numbers are 0, why does a calendar app need 9 threads?
    edited March 2018
Sign In or Register to comment.