Windows 10: Microsoft's Store is not a safe haven

Symantec discovered eight application in the official Microsoft Store that ran cryptomining operations without informing the user about it in the background when installed.

One of the main arguments for integrating the Microsoft Store in Windows 8 and Windows 10, unveiled in 2011 by Microsoft, was that it protected users from installing malicious or problematic applications on their devices because of a review process and other safeguards.

While it is certainly the case that Windows Store offers a safer environment, it is far from the safe haven that Microsoft would like it to be.

We talked about deceiving apps, copycat apps, and deceptive apps in the past, and covered Microsoft's attempts to improve quality by pruning low quality applications.

The introduction of PWA support appears to have opened the door for another type of unwanted software: cryptomining.



Symantec discovered eight applications in Microsoft Store that started cryptomining operations as soon as they were installed and launched by users from the Microsoft Store.

The applications were published by three developers but there is strong evidence that a single person or group is responsible for all of them. Evidence comes from the use of the same mining key and Google Tag Manager key, and that all applications used the same origin (but different domains).

The apps were fairly popular, judging from the 1900 ratings that they received between publication in April 2018 and December 2018. It is certainly possible that part of the ratings came from fake accounts or services that rate apps in return for payment.

Microsoft does not reveal installation counts for applications; it is unclear if the applications landed on thousands, hundred of thousands, or even more devices running Windows 10.

Windows 10 users were exposed to these applications in various ways: when they searched for apps in the Store, browsed the free listings, or were directed to the Store from websites that linked to these applications.

The applications fetched a JavaScript mining library using Google Tag Manager when they were launched for the first time after download and installation. All applications included privacy policies but mining operations were not mentioned in any of them or the descriptions.

The applications used the majority of the computer's CPU cycles according to Symantec for mining operations.

Symantec informed Microsoft about the applications, and Microsoft has removed them in the meantime from the Store.

Closing Words


While it is certainly arguable that cryptocurrency mining is less harmful than a device's infection with malicious software or ransomware, it is clear that Microsoft Store users need to be careful when it comes to the installation of apps from the Store.

I recommended that users verify app developers before they install apps in 2013. Microsoft's Store is not the only Store that hosted cryptomining applications or extensions. The particular form of unwanted software was found in extension stores, e.g. in Mozilla's or Google's for the Firefox or Chrome browser, and on Google Play previously already.

Now You: do you use Store applications?

Ghacks needs you. You can find out how to support us here or support the site directly by becoming a Patreon. Thank you for being a Ghacks reader. The post Microsoft's Store is not a safe haven appeared first on gHacks Technology News.

read more...

 

App store and Microsoft account

Thank you for the advice

I see what you mean about the password but i think its a backward step to compromise my Microsoft password to to use the app store

 

Microsoft Store

Hi James,

To resolve your concern about Windows Store, we suggest for you to follow these steps:

• Press Windows key + R key to open Run.
• Type wsreset.exe and press
  Enter.
• Restart the PC, sign in with your Microsoft user account and check if you are able to find Windows Store.

Let us know how it goes.

 

Microsoft Store is not working

Hi,

Thank you for responding.

Do let us know the exact issue you are facing in accessing the Windows Store?

Have you tried to reset the Windows Store as stated in the above response?

If the issue still persists after deploying the above troubleshooting steps, try the below and check if it helps.

Step 1: I suggest you to run Windows Store Apps Troubleshooter
and check.

Windows Store Apps Troubleshooter, troubleshoots problems that may prevent Windows Store Apps from working correctly.

1. Press
Windows + X keys from the keyboard, click on Control Panel.

2. In the
Control Panel window, select Category and then select
Large icons.

3. Click on
Troubleshooting.

4. Click
View all and then click Windows Store Apps.

5. Click
Next and follow on-screen instructions.

Step 2: I suggest you to install all the pending updates on your device.

Steps:

• Connect to the internet.
• Press Windows key and type
  updates.
• Click on Check for updates.
• Under Windows Updates, click on
  Check for updates.
• Try to install the updates being shown.

• • • 
      

Hope it helps. Reply to the post with an updated status of this for further assistance, we will be happy to help you.