Bitcoin wallet source code

Bitcoins, the cryptocurrency burst onto the scene in 2009 and has continued to grab headlines. This digital currency has attracted a lot of attention, for good and bad reasons, mostly because of the currency’s speculation value and its anonymous nature. This week, Appthority takes a look at the state of Bitcoin on Android, focusing on two apps currently available in the Google Play store.

Bitcoin on AndroidWatkins found that the wallet applications on Google Play were derived from the Bitcoin wallet source code available on Github. “For the most part, there was little in the way of risky behaviors, likely due to the scrutiny and transparency of the app, ” said Watkins. Score one for open-source development!

However, Watkins also said that all the mining apps Appthority tested “failed to function entirely.” Though bitcoin transactions can be as seamless as cash, earning bitcoins is a bit more complicated.

“The landscape of Bitcoin apps on Google Play can be confusing, with the quality of bitcoin apps running the gamut from poor to excellent, ” Watkins told SecurityWatch. “The Appthority Service discovered sketchy apps, apps that didn’t work at all, and some apps that were junk apps existing only to serve up adware.”

Coinbase – Bitcoin Wallet
The Coinbase app says that it lets you “securely buy, use, and accept bitcoin.” The app also says that it uses “bank level security” and also features for sending bit coins but QR code and NFC without transaction fees.

Appthority noted that Coinbase has a few things going for it. The app did indeed secure logins with an encrypted connection, for example. When you login, the app creates a token with a two-hour time limit and a refresh token for further use. But while the tokens are encrypted in transit, they’re both stored in plain-text on your Android.

Secure storage seemed to be an issue for the app, as Appthorty discovered that Coinbase stored other sensitive information without encryption. For example, an optional PIN used to secure the app is stored on the device with neither obfuscation or encryption.

“While this level of security is better than most, it’s typical for banking apps to have a much smaller expiration window for tokens and some sort of obfuscation for the oauth tokens, ” Watkins told SecurityWatch. “Otherwise, if the mobile device gets compromised, the tokens can be obtained and used to login and make transactions as the user without user and password authentication.”

Bitcoin Tapper
While Coinbase is a tool to manage cryptocash, Bitcoin Tapper claimed to actually earn you money. “Earn FREE Bitcoins by tapping on the Bitcoin every day, ” crows the app’s description in Google Play. In my experience, any time the word “free” is in all-caps, it’s a sign something strange is going on.