Nice work getting control back ( took me a while to read all that happened in the last 2 hours since i was on getwork and my pc had to restart due to a breaker blowing... Darn you pressure washers on the same circuit!!!! )
Would not hurt to open the confirm mail and check to see if, in the full headder, there is any Blind Carbon Copy sends which would mean that the whole server system may have been compromised and Slush's server was the most tasty treat to get at first.
Didn't do a reverse DNS to see who/where the host is but.... have a friend that was IT for schools in Alberta and he showed me how easy it was to monitor ANY mail in the schools from one of the IT desktops and ' force ' it to do blind carbon copies. Technically not in the server room, but in the base domain addresses ( for those at home, same side of the router ).
My personal experience in this kind of attack is usually reading about it in forums....
Hope this is the last of it and I'm 1/10th of the way to a half decent GPU mining card and hope to get decent hash/shares soon.
Topic: [4+ EH] Slush Pool (slushpool.com); Overt AsicBoost; World First Mining Pool - page 823. (Read 4382671 times)
April 23, 2013, 08:10:58 PM
April 23, 2013, 08:03:18 PM
The pool has been hacked.
Very sorry to hear it. What a pain in the ass!
April 23, 2013, 08:00:00 PM
If I can only find out if my workers are up and running, left everything on and went to work. Wife is sound asleep and without site up I cant check but I presume that since they were up and on stratum before everything happened then I should be still mining. 
If you see workers hashing on Stratum, they should be fine. I'll keep site offline because with database down it won't display anything useful.
April 23, 2013, 07:47:07 PM
If I can only find out if my workers are up and running, left everything on and went to work. Wife is sound asleep and without site up I cant check but I presume that since they were up and on stratum before everything happened then I should be still mining.
April 23, 2013, 07:46:38 PM
Let us know when you have a new IP even if DNS isn't ready.
Thanks for doing all of this Slush. I know it's supposed to be sleepy time for you
Thanks for doing all of this Slush. I know it's supposed to be sleepy time for you
April 23, 2013, 07:41:14 PM
Also, just as an FYI, i do network security in a completely different sector, but the attacks are usually the same. The "sneak forwarding" is a common targeted attack.
I cross-checked my mailbox setup and no forwarding is configured here. For now I fully blame OVH for this issue.
Interesting analysis. Is it possible that the algo for the OTP is "known" ? So the attacker would simply have to know what the next OTP password is once it's been submitted?
I'd guess he is using a vasco or rsa token with appropriate key size...
Nothing so elaborate. You'd be amazed at the power that an administrator can wield. Your server security is only as strong as those that have physical access to them honoring their word. Occam's razor applies greatly when it comes to hacking.
You are absolutely right. The point was merely there is no need to predict the next OTP. Especially with Trudy having physical access.
Exactly. Not to get to far off topic, but just today i was asked to "hack" into a windows 2003 exchange server for a mew customer that was wanting to get rid of his now previous third party IT provider without asking for the admin passwords. I was able to gain access within an hour with physical access. Hopefully when you move Slush, it will be to a much more neutral site with stricter internal protocols... working on the assumption that this was an internal job and that the move should solve the problem.
April 23, 2013, 07:37:14 PM
You are absolutely right. The point was merely there is no need to predict the next OTP. Especially with Trudy having physical access.
Not only that I take physical security seriously, but there're no indicator that the attacker has a real access to the mailbox. Password to OVH has been changed for second time after I changed the password to the email and after I cross-checked that I keep the only active session to the mailserver. After this, even the knowledge of OTP private key won't give an access to the mailbox to attacker.
April 23, 2013, 07:32:56 PM
Also, just as an FYI, i do network security in a completely different sector, but the attacks are usually the same. The "sneak forwarding" is a common targeted attack.
I cross-checked my mailbox setup and no forwarding is configured here. For now I fully blame OVH for this issue.
Interesting analysis. Is it possible that the algo for the OTP is "known" ? So the attacker would simply have to know what the next OTP password is once it's been submitted?
I'd guess he is using a vasco or rsa token with appropriate key size...
Nothing so elaborate. You'd be amazed at the power that an administrator can wield. Your server security is only as strong as those that have physical access to them honoring their word. Occam's razor applies greatly when it comes to hacking.
You are absolutely right. The point was merely there is no need to predict the next OTP. Especially with Trudy having physical access.
April 23, 2013, 07:29:17 PM
Also, just as an FYI, i do network security in a completely different sector, but the attacks are usually the same. The "sneak forwarding" is a common targeted attack.
I cross-checked my mailbox setup and no forwarding is configured here. For now I fully blame OVH for this issue.
Interesting analysis. Is it possible that the algo for the OTP is "known" ? So the attacker would simply have to know what the next OTP password is once it's been submitted?
I'd guess he is using a vasco or rsa token with appropriate key size...
Nothing so elaborate. You'd be amazed at the power that an administrator can wield. Your server security is only as strong as those that have physical access to them honoring their word. Occam's razor applies greatly when it comes to hacking.
April 23, 2013, 07:27:58 PM
For now it is mining on OVH machine, but now I'm migrating DNS to EC2 machines, which are trusted.
April 23, 2013, 07:26:26 PM
Pool just found new block. Because database isn't running and shares are not stored, I'll spread blocks mined during database outage to miners who'll continue mining on the pool since the database will be up again.
We are mining again? You told us tomorrow... Well I guess today morning but because I read tomorrow I removed your pool from config because I thought the stratum might come up hacked... I'm adding them again but for the last block you might use data that you have... It was a long one and I would hate to be lousing everything because of that...
April 23, 2013, 07:21:48 PM
Also, just as an FYI, i do network security in a completely different sector, but the attacks are usually the same. The "sneak forwarding" is a common targeted attack.
I cross-checked my mailbox setup and no forwarding is configured here. For now I fully blame OVH for this issue.
Interesting analysis. Is it possible that the algo for the OTP is "known" ? So the attacker would simply have to know what the next OTP password is once it's been submitted?
I'd guess he is using a vasco or rsa token with appropriate key size...
April 23, 2013, 07:19:27 PM
Stratum is back, great job!
Cheers,
T
Cheers,
T
Way to never read anything before making your post... keep living the dream. I know you will never read this
Can you please shed some light on this comment?
I doubt it
If I agreed with you, we both would be wrong. Never mind, no offence taken on my side whatsoever.
April 23, 2013, 07:18:13 PM
Pool just found new block. Because database isn't running and shares are not stored, I'll spread blocks mined during database outage to miners who'll continue mining on the pool since the database will be up again.
April 23, 2013, 07:16:56 PM
Also, just as an FYI, i do network security in a completely different sector, but the attacks are usually the same. The "sneak forwarding" is a common targeted attack.
I cross-checked my mailbox setup and no forwarding is configured here. For now I fully blame OVH for this issue.
Interesting analysis. Is it possible that the algo for the OTP is "known" ? So the attacker would simply have to know what the next OTP password is once it's been submitted?
April 23, 2013, 07:13:46 PM
Stratum is back, great job!
Cheers,
T
Cheers,
T
Way to never read anything before making your post... keep living the dream. I know you will never read this
Can you please shed some light on this comment?
I doubt it
April 23, 2013, 07:10:36 PM
Stratum is back, great job!
Cheers,
T
Cheers,
T
Way to never read anything before making your post... keep living the dream. I know you will never read this
Can you please shed some light on this comment?
April 23, 2013, 07:08:43 PM
Also, just as an FYI, i do network security in a completely different sector, but the attacks are usually the same. The "sneak forwarding" is a common targeted attack.
I cross-checked my mailbox setup and no forwarding is configured here. For now I fully blame OVH for this issue.
April 23, 2013, 07:07:29 PM
I set up Stratum mining to not waste hashrate on the pool. However I didn't fix the hole because I think that the hole is OVH itself, so it's clearly possible that attackers shut down the pool again. I'll migrate out of OVH ASAP.
April 23, 2013, 07:05:24 PM
Stratum is back, great job!
Cheers,
T
Cheers,
T
Way to never read anything before making your post... keep living the dream. I know you will never read this
Jump to: