Eligius: 0% Fee BTC, 105% PPS NMC, No registration, CPPSRB - page 193.

sdjernes

newbie

Activity: 49

Merit: 0

Ok, I have two effected sites and one non effected site.

Site 1:
Cox Cable Business Connection Omaha, NE
Public Subnet Router: Centos 6.x iptables / Hurricane Electric ipv6 tunnel
Firewall: Untangle 10.1
Miner Control: MinePeon 2.4.5 w/ bfgminer 3.10.0
Pool effected: Eligius
Effected behavior: Miner acts as if it is connected to pool but no data is passed so all mining offline.
Pool not effected: Ghash.io

Second miner site 1
Avalon 55nm based system
CGminer 4.0
This system appeared to be working correctly, but for safety switched its pools temporarily.

Site 2
Cox Cable Business Connection Omaha, NE
Firewall: SonicWall
Miner Control: bfgminer 3.9.0 on Ubuntu 12.04

Unaffected site
Charter Cable Residential Service Plattsmouth, NE
Firewall: WNDR3700 v2 w/ DD-Wrt Hurricane Electric ipv6 tunnel
Miner Control: MinePeon 2.4.5 w/ bfgminer 3.10.0
Unaffected Pool: Eligius

Quote from: wizkid057 on April 26, 2014, 04:31:59 PM

I spent the better part of the day investigating this issue.

It's not a pool side hack - No pool servers are or were compromised
It's not a pool-side close network hack - No datacenter infrastructure is compromised
It only affects certain clients, is not pool wide, and affects affected clients repeatedly

Presumably there is some issue with some client side routing hardware that is being exploited. Anyone effected, please post how your connected to the net. PC->Router->Cable Modem, etc, with makes/models of such so we can possibly narrow this down.

not.you

legendary

Activity: 1726

Merit: 1018

Quote from: Lucko on April 26, 2014, 05:15:42 PM

EDIT: I have a computer with Teamviewer on all locations... That is the only thing I can think of connecting them...

I have a bunch of scrypt miners that all have teamviewer installed but none of them have been diverted.

Quote from: RealMalatesta on April 26, 2014, 05:39:09 PM

Would be interesting to know if on client-side anybody is mining nxt or using "BTsync Remote Storage".

Never mined nxt but I have BTsync installed on one box that mines scrypt on multipool. Not sure why you would suspect BTsync of being involved though.

As far as I can tell none of my miners (scrypt or sha256) have ever been diverted. Most of them are on the same network which uses a static IP through a business class ISP. The one with BTsync is on a home DSL.

RealMalatesta

legendary

Activity: 2380

Merit: 1150

Quote from: Lucko on April 26, 2014, 12:44:40 PM

This jumping to 46.28.205.80 happens on ghash too... And every time at same time... So it might be something automatic...

17 rigs, 3 locations

Btw: The company behind this IP is part of the dragonara-network. And if you check their network and how they "ddos"-protect, it seems pretty obvious where this is coming from. They are trying to get into the BTC business, best thing may be to call their "manager" on Monday and tell him that this whole ddos-shit should stop...

RealMalatesta

legendary

Activity: 2380

Merit: 1150

Quote from: wizkid057 on April 26, 2014, 04:31:59 PM

I spent the better part of the day investigating this issue.

It's not a pool side hack - No pool servers are or were compromised
It's not a pool-side close network hack - No datacenter infrastructure is compromised
It only affects certain clients, is not pool wide, and affects affected clients repeatedly

Presumably there is some issue with some client side routing hardware that is being exploited. Anyone effected, please post how your connected to the net. PC->Router->Cable Modem, etc, with makes/models of such so we can possibly narrow this down.

Would be interesting to know if on client-side anybody is mining nxt or using "BTsync Remote Storage".

Luke-Jr

legendary

Activity: 2576

Merit: 1186

Quote from: anth0ny on April 26, 2014, 05:24:58 PM

Quote from: wizkid057 on April 26, 2014, 04:31:59 PM

I spent the better part of the day investigating this issue.

It's not a pool side hack - No pool servers are or were compromised
It's not a pool-side close network hack - No datacenter infrastructure is compromised
It only affects certain clients, is not pool wide, and affects affected clients repeatedly

Presumably there is some issue with some client side routing hardware that is being exploited. Anyone effected, please post how your connected to the net. PC->Router->Cable Modem, etc, with makes/models of such so we can possibly narrow this down.

Also OS. If TCP sequence numbers are being predicted, it could be that the OS isn't making the initial sequence number hard enough to guess.

Really there's no excuse for not using SSL, though.

Already on it...

BFGMiner 4.0 will support TLS for stratum (GBT already supports it)
Eloipool has a 'tls' branch now (ready for testing - hint hint wizkid057!)

anth0ny

full member

Activity: 196

Merit: 100

Quote from: wizkid057 on April 26, 2014, 04:31:59 PM

I spent the better part of the day investigating this issue.

It's not a pool side hack - No pool servers are or were compromised
It's not a pool-side close network hack - No datacenter infrastructure is compromised
It only affects certain clients, is not pool wide, and affects affected clients repeatedly

Presumably there is some issue with some client side routing hardware that is being exploited. Anyone effected, please post how your connected to the net. PC->Router->Cable Modem, etc, with makes/models of such so we can possibly narrow this down.

Also OS. If TCP sequence numbers are being predicted, it could be that the OS isn't making the initial sequence number hard enough to guess.

Really there's no excuse for not using SSL, though.

DaveF

legendary

Activity: 3500

Merit: 6320

Crypto Swap Exchange

Quote from: wizkid057 on April 26, 2014, 04:31:59 PM

I spent the better part of the day investigating this issue.

It's not a pool side hack - No pool servers are or were compromised
It's not a pool-side close network hack - No datacenter infrastructure is compromised
It only affects certain clients, is not pool wide, and affects affected clients repeatedly

Presumably there is some issue with some client side routing hardware that is being exploited. Anyone effected, please post how your connected to the net. PC->Router->Cable Modem, etc, with makes/models of such so we can possibly narrow this down.

#1
2 S1's behind an old linksys running DD-WRT (V24-sp2)
Our own IP space (Juniper running BGP)

#2
1 S1 running behind a TRENDnet TW100-BRV214
However a few Technobits running on a TL-MR3020 pointing to BTC were not hit
On cable

#3
S1 and a generic Avalon behind a ZuniConnect router pointing to GHash were hit.
On cable.

-Dave

Lucko

hero member

Activity: 826

Merit: 1000

Yes but to affect me it would need to be implemented on 2 ISP in our country... To affect MrTeal we are talking about different country. Even different continent... It is big...

EDIT: I have a computer with Teamviewer on all locations... That is the only thing I can think of connecting them...

eleuthria

legendary

Activity: 1750

Merit: 1007

Quote from: PatMan on April 26, 2014, 04:57:26 PM

Quote from: Lucko on April 26, 2014, 02:36:02 PM

To affect that many pools I think it must be a bug in stratum not MITM...

Surely though, if it were a bug in stratum, ALL pools would be affected. P2pool uses stratum but has no issues at all.

Peace.

Don't forget it would also affect all users if it was a bug in stratum. It's mostly the same users getting hit each time, and they are a very small subset.

EDIT: As Lucko posted, it hit his machines on 4 different pools, at 4 different locations on 2 different ISPs. That makes no sense that it would do that unless it's something specific to him. If the problem was pool side, or even widespread, you'd be seeing *massive* speed fluctuations on pools when these redirects happen. It isn't related to some clients not supporting it, since BTC Guild actually uses client.reconnect for it's public servers. EVERYBODY actively mining on the BTC Guild public stratum servers supports client.reconnect.

DaveF

legendary

Activity: 3500

Merit: 6320

Crypto Swap Exchange

Quote from: not.you on April 26, 2014, 02:42:01 PM

As a miner side fix you can block that IP on your firewall (ideally at the router but even the windows firewall should work for some types of miners). If your miner gets redirected it should be unable to connect to the pirate pool and then switch to whatever you have configured for a failover.

Holy crap, that's so obvious I can't believe I didn't think of that.

You would not believe the route I was going to stop this from happening.

-Dave

not.you

legendary

Activity: 1726

Merit: 1018

How can you tell if an ant S1 is effected from the client side? Now that the pool is in fail-safe I can't tell. It seems to be connected and submitting shares from what I can see.

May or may not have anything to do with it but I did read about a backdoor in wireless routers that effected a wide variety of makes and models: http://arstechnica.com/security/2014/01/backdoor-in-wireless-dsl-routers-lets-attacker-reset-router-get-admin/

Although I don't know how even that backdoor would allow the stratum hijack.

nottm28

hero member

Activity: 574

Merit: 500

Quote from: wizkid057 on April 26, 2014, 04:31:59 PM

I spent the better part of the day investigating this issue.

It's not a pool side hack - No pool servers are or were compromised
It's not a pool-side close network hack - No datacenter infrastructure is compromised
It only affects certain clients, is not pool wide, and affects affected clients repeatedly

Presumably there is some issue with some client side routing hardware that is being exploited. Anyone effected, please post how your connected to the net. PC->Router->Cable Modem, etc, with makes/models of such so we can possibly narrow this down.

Might be useful to post some info so people can identify themselves as affected. Is there any clear and easy way for people to know they are affected. Then the list of kit people use might be useful.

PatMan

hero member

Activity: 924

Merit: 1000

Watch out for the "Neg-Rep-Dogie-Police".....

Quote from: Lucko on April 26, 2014, 02:36:02 PM

To affect that many pools I think it must be a bug in stratum not MITM...

Surely though, if it were a bug in stratum, ALL pools would be affected. P2pool uses stratum but has no issues at all.

Peace.

Lucko

hero member

Activity: 826

Merit: 1000

Location 1:
ScyrptGuild
PC running cgminer 2.11.4 connected to Cisco(no idea what is the number) that transfer it to optic. ISP 1
Location 2:
BTCGuild
Minepeon running cgminer 3.6.4, connected to TP-link WR741ND connected to cable modem(no idea). ISP 2
Location 3:
Eligius
Antminers conected to WRT54GL connected to cable modem(no idea). ISP 2
Location 4:
Ghash
TL-MR3020 running cgminer 4.0.0 and 4.2.3, connected to WRT54GL connected to cable modem(no idea). ISP 2

All were effected at some point.

EDIT: There are also some other devices that I didn't write about that were effected but they are small part of the hashing power... And it happened to all devices at about same time... I also experiencing cgminer restarts on TL-MR3020...

wizkid057

legendary

Activity: 1223

Merit: 1006

I spent the better part of the day investigating this issue.

It's not a pool side hack - No pool servers are or were compromised
It's not a pool-side close network hack - No datacenter infrastructure is compromised
It only affects certain clients, is not pool wide, and affects affected clients repeatedly

Presumably there is some issue with some client side routing hardware that is being exploited. Anyone effected, please post how your connected to the net. PC->Router->Cable Modem, etc, with makes/models of such so we can possibly narrow this down.

not.you

legendary

Activity: 1726

Merit: 1018

As a miner side fix you can block that IP on your firewall (ideally at the router but even the windows firewall should work for some types of miners). If your miner gets redirected it should be unable to connect to the pirate pool and then switch to whatever you have configured for a failover.

Lucko

hero member

Activity: 826

Merit: 1000

To affect that many pools I think it must be a bug in stratum not MITM...

mdude77

legendary

Activity: 1540

Merit: 1001

Quote from: Lucko on April 26, 2014, 02:00:00 PM

Quote from: DaveF on April 26, 2014, 01:45:54 PM

Quote from: Lucko on April 26, 2014, 12:44:40 PM

This jumping to 46.28.205.80 happens on ghash too... And every time at same time... So it might be something automatic...

17 rigs, 3 locations

What software were you using to connect?

-Dave

Mix of everything... BFG CG miners different versions(don't fix if it is not broken) running on PCs routers and pi's and for getwork ASICMiner blades slush mining proxy... All is effected... It is a pools(not only one) side problem not a miners problem...

EDIT: Got some miners running on BTCGuild and ScryptGuild redirected... It looks like it is not only BTC and all big pools...

time to use local p2pool nodes?

M

Lucko

hero member

Activity: 826

Merit: 1000

Quote from: DaveF on April 26, 2014, 01:45:54 PM

Quote from: Lucko on April 26, 2014, 12:44:40 PM

This jumping to 46.28.205.80 happens on ghash too... And every time at same time... So it might be something automatic...

17 rigs, 3 locations

What software were you using to connect?

-Dave

Mix of everything... BFG CG miners different versions(don't fix if it is not broken) running on PCs routers and pi's and for getwork ASICMiner blades slush mining proxy... All is effected... It is a pools(not only one) side problem not a miners problem...

EDIT: Got some miners running on BTCGuild and ScryptGuild redirected... It looks like it is not only BTC and all big pools...

DaveF

legendary

Activity: 3500

Merit: 6320

Crypto Swap Exchange

Quote from: Lucko on April 26, 2014, 12:44:40 PM

This jumping to 46.28.205.80 happens on ghash too... And every time at same time... So it might be something automatic...

17 rigs, 3 locations

What software were you using to connect?

-Dave

Topic: Eligius: 0% Fee BTC, 105% PPS NMC, No registration, CPPSRB - page 193. (Read 1061594 times)