So ... I was helping someone with a miner ... and they said they had another miner (s9) that was using "awesome miner"
To my unhappy surprise, I found that "awesome miner" seems to have placed a massive security hole in their miner:
"api-allow" : "W:0/0",
which means anyone with any access to the network the miner is on, can change ANYTHING, including pools being mined to and usernames on the pool
e.g. change it to mine to a bitcoin address on a pool so you can't even track who it was mining to ...
What the original Bitmain (s9) settings are:
"api-groups" : "A:stats:pools:devs:summary:version",
"api-allow" : "A:0/0,W:*",
Which means no one can do any changes, and anyone can ONLY do the reports: stats, pools, devs, summary and version
(also note that W:* is an error and is ignored)
Now while some may think that this is not an issue if their miners are ALL locked away securely behind a perfect firewall, there are also Windows viruses (awesome miner is for windows) that find miners like this and DO change the miner settings like this.
I reference these posts ...
https://bitcointalksearch.org/topic/m.51394035and
https://bitcointalksearch.org/topic/m.51384025Though someone in that thread also made comment about awesome miner creating the problem ...
Edit: so after some more discussion with the person who owns the miner, the problem is that awesome miner defaults to an allows someone to do this.
It should not even be an option in the GUI
Thanks for your detailed feedback.
First of all it's important to point out that Awesome Miner doesn't take any action to change the API access parameters on the ASIC by itself. As you know, almost all ASIC miners are by default running with Restricted API access, only allowing external applications to monitor the mining. This is also the case when you add your miners to Awesome Miner. As you pointed out in your Edit, Awesome Miner do however provide a feature where the user can make changes to the API access configuration.
For users that want to make operations on their ASIC miners via Awesome Miner, it's possible to use a feature called Configure API Access where the user can tell Awesome Miner to update the API access settings (api-allow). The user is given the option to select from where connections should be allowed. Either from any IP address or from a specific IP address (or range of IP addresses). There is also one single example on this screen - illustrating how to configure access for local network IP addresses only. In addition, there is a link to our web site where we give several examples of how to configure the API to only allow connections from specific IP addresses.
So from a user interface point of view, we try to suggest how the feature can be used. It's however true that the box selected by default is "Any IP address", and it's of course possible to discuss if that's a good decision. At the same time, given that we present a single example configuration, with limited IP access, and the user still decide to go for "Any IP address", it also indicates that some users just want things to work without having to spend 30 more seconds to make it more secure.
Keep in mind that it's surprisingly common that users leave their ASIC miners running with default web passwords, and I assume that for a user that is fine with running with default web passwords also would be fine with running with "Any IP Address" for the API. Just like Awesome Miner provides the feature to Configure API Access, it also provides features to update the web passwords for many miners to get a non-default password. The bottom line is that Awesome Miner is a toolbox of features that allows you to do operations that both can be used to make your miners more secure, but also less secure.
If you get virus on the Awesome Miner computer and you configured the Cgminer API to only allow privileged API access from this single IP address - you would still be in trouble. If you leave the Cgminer API with the default settings to only allow monitoring, you will be safe. This is also the default when you use Awesome Miner with an ASIC.
I do agree that Awesome Miner could be improved to be better at promoting secure configurations.
For the posts you are referring to it's also interesting to see that it happens to be Whatsminer ASIC. In the past I almost suspected that these ASICs were delivered miners with api-allow set to "W:0/0" from the factory, although I've never been able to confirm that. Also, the feature in Awesome Miner for setting API Access is only designed for Antminers.
Thanks!