Topic: Claymore's Dual Ethereum AMD+NVIDIA GPU Miner v15.0 (Windows/Linux) - page 469. (Read 6590718 times)

Satori Malware Variant is Robbing ETH BitCoin by Replacing Wallet Address - Claymore Miner Compromised, Check your settings

Art of Steal: Satori Variant is Robbing ETH BitCoin by Replacing Wallet Address
17 JANUARY 2018 on Botnet, BitCoin, ETH BitCoin, Satori
The security community was moving very fast to take actions and sinkhole the Satori botnet C2 after our December 5 blog. The spread of this new botnet has been temporarily halted, but the threat still remains.

Starting from 2018-01-08 10:42:06 GMT+8, we noticed that one Satori’s successor variant (we name it Satori.Coin.Robber) started to reestablish the entire botnet on ports 37215 and 52869.

What really stands out is something we had never seen before, this new variant actually hacks into various mining hosts on the internet (mostly windows devices) via their management port 3333 that runs Claymore Miner software, and replaces the wallet address on the hosts with its own wallet address.

From the most recently pay record till 2018-01-16 17:00 GMT+8, we can see:

Satori.Coin.Robber is actively mining, with lastest update 5 minutes ago.
Satori.Coin.Robber owns an average calculation power of 1606 MH/s for the last 2 days; the account has accumulated 0.1733 ETH coins over the past 24 hours
Satori.Coin.Robber has already got the first ETH coin paid at 14:00 on January 11, 2017, with another 0.76 coin in the balance
Also worth mentioning is that the author of Satori.Coin.Robber claims his current code is not malicious and leaves an email address(see the section below for more details):

Satori dev here, dont be alarmed about this bot it does not currently have any malicious packeting purposes move along. I can be contacted at [email protected] 
A Series of Security Issues on Claymore Miner Remote Management
Claymore Miner is a popular coin-mining software used by quite a lot of mining devices these days.

According to its document, the Claymore Miner Windows version provides a remote monitoring and/or management interface on port 3333 (the EthMan.exe file in the “remote management” directory). And by default earlier versions allow not only remote reading for mining status, but also operations like restart, upload files and some other control operations.

Apparently, the above feature is a security issue. As a fix, after version 8.1, the Claymore Miner will not use port 3333 but -3333 (a negative one) as the startup parameter by default, which means read-only monitoring actions are supported, but other controlling actions are all denied.

But this is not the end. In November 2017, CVE-2017-16929 went public, which allows remote read and/or write to arbitrary files for Claymore Miner. The corresponding exploit code has also been disclosed.

The scanning payload (the exploit code) we are going to discuss here is different from all above though. It works primarily on the Claymore Mining equipment that allows management actions on 3333 ports with no password authentication enabled (which is the default config). In order to prevent potential abuse, we will not discuss too much details in this article..............

What CPU did you try?
Try to specify "-tt 0" option to disable temperature control, does it help?

Try latest drivers ( or earlier windows with Blockchain drivers )

no change with new version ( with high priority ), I tryed and with other CPU act the same way when 12 cards
if possible send me e-mail to write you there

hy claymore is the DAG FIX on Linux only the DAG 160? is it possible to get 27,5 mhs (Rx470) with linux? i only get <20 mhs (after DAG 160)

lg

Yes, letters must work exactly as for "-di". From readme:

-mode   Select mining mode:
   "-mode 0" (default) means dual Ethereum + Decred/Siacoin/Lbry mining mode.
   "-mode 1" means Ethereum-only mining mode. You can set this mode for every card individually, for example, "-mode 1-02" will set mode "1" for first and third GPUs (#0 and #2).
   For systems with more than 10 GPUs: use letters to specify indexes more than 9, for example, "a" means index 10, "b" means index 11, etc.

I use Linux ubuntu 16.04 - with the latest driver. the last weeks works everythink fine... now i get only 18. MHS per card (before 27.5) AMD 470

What is the problem? BIOS? DAG?

Hi Claymore,

To disable dual mining on some cards,
use -mode 1-[card index]
is there a way to disable dual mining on card index >9?use abced?

Or maybe enable dual mining on some cards via -mode 0-[card index]?

This is my full line...

EthDcrMiner64.exe -epool stratum+tcp://us-west.pirlpool.eu:8004 -ewal WALLET -epsw x -allcoins -1 -eworker GTX1060s -gser 3 -minspeed 180 -r 1 -dcoin pasc -dpool mine.pasl.fairpool.cloud:4009 -dwal WALLET+GTX1060s -dpsw x -dcri 17

Try with -gser 1 , if that doesn't work, try with -gser 2

Can anyone shed some light on possible failure, im running this rig on a wifi adapter as well.

Claymore just crashes and says this at the end:
1368   WATCHDOG: GPU error, you need to restart miner
1368   Rebooting



00:31:56:941   1c74   Set global fail flag, failed GPU6
00:31:56:941   19a4   GPU 1, CUDA error 11 - cannot write buffer for DAG
00:31:56:942   1c74   GPU 6 failed
00:31:56:942   1d7c   Setting DAG epoch #164 for GPU7
00:31:56:942   1d7c   GPU 7, CUDA error 11 - cannot write buffer for DAG
00:31:56:943   18b4   Setting DAG epoch #164 for GPU6
00:31:56:944   18b4   GPU 6, CUDA error 11 - cannot write buffer for DAG
00:31:56:947   1ccc   Set global fail flag, failed GPU3
00:31:56:949   1ccc   GPU 3 failed
00:31:56:949   1db8   Set global fail flag, failed GPU0
00:31:56:949   14bc   Setting DAG epoch #164 for GPU3
00:31:56:950   1db8   GPU 0 failed
00:31:56:948   1c7c   Set global fail flag, failed GPU5
00:31:56:950   14bc   GPU 3, CUDA error 11 - cannot write buffer for DAG
00:31:56:951   1c7c   GPU 5 failed
00:31:56:950   1d2c   Setting DAG epoch #164 for GPU0
00:31:56:951   1d2c   GPU 0, CUDA error 11 - cannot write buffer for DAG
00:31:56:953   1cb8   Setting DAG epoch #164 for GPU5
00:31:56:953   1cb8   GPU 5, CUDA error 11 - cannot write buffer for DAG
00:31:57:122   1d90   got 248 bytes

Cool latest works with compute mode enabled? anyone else verify?

Adrenalina 18.1.1, win10 1709, Claymore 10.5 va perfecto, recuerda poner en modo computo los drivers de amd o no funcionara.

-dpool dc.suprnova.cc:3252 -dwal ShadowKagaho.1 -dpsw x -allpools 1

In my DECRED mining is having problem please someone can help me to solve the problem! Thank you for your attention right now.

-ethi   Ethereum intensity. Default value is 8, you can decrease this value if you don't want Windows to freeze or if you have problems with stability. The most low GPU load is "-ethi 0".
   Also "-ethi" now can set intensity for every card individually, for example "-ethi 1,8,6".
   You can also specify negative values, for example, "-ethi -8192", it exactly means "global work size" parameter which is used in official miner.

I have my rigs set to -ethi 16

What does it actually do with a higher number? Without stating the obvious!

From what I can see it gives a better hashrate but thats about it.

I'm currently using 17.12.2 Adrenalin Drivers on CM10.4 with temp & voltage controls. W10 Pro x64 1703

Been working fine (Touch Wood)

With Compute mode turned on and BOIS mods with DAG fix

Knocking out 178-179MH/s on a 6 card rig of RX480 8GB at around 860w

drivers adrenalin works with bios mod and DAG fix?

No more PM, so I write here, after sending logs,
CPU model: Celeron G3930
CPU LOAD: 53%-56% normaly taken by EthDcrMiner64.exe, everything else is up to  5%
MB: ASRock H110 Pro BTC+
RAM: 4gb ddr4

it only takes 4gb to mine... PoS is coming late 2018
its coming, start selling ur rigs.