Its more likely that the attack is coming from one of the computers on your internal network rather than from outside.
Unless you have forwarded ports to access your miners from outside your network, or worse, your miners have public IP addresses, the most likely cause of the hack is a compromised windows computer on your network.
I was thinking about that bro and it probably was the case because I have the whole family connected to the same network and everyone is browsing different sites and places which are probably aren’t safe, and I can’t control all of them. I have my modem setup pretty safe and the WiFi isn’t even visible and it doesn’t have any ports open as far as I know and isn’t controlled from the outside but I did have a not very secured 5G Netgear router hooked up to it which I disconnected and hopefully now I’ll be safe. So far no more machines have been hacked.
And gladly it is just my home network where I just got several miners working and not my actual farm!!!
And no, nobody uses windows in my house, it’s all phones and tablets.
Thanks.
Mine on! I can smell that block already!!!
Your network is definitely compromised. What about the miners? Did you set up (different) passwords on each? With 2018 or earlier firmware you had to set up both web and ssh passwords, not too sure about 2019 where you are not supposed to log in with ssh, but an earlier version (May?) has an exploit in the web server that re enables ssh access...
Also, rather than losing controllers, try the recovery procedure from (micro)SD, and if that doesn't cure it try booting BraiinsOS from the sd card and see if they work that way its better to sacrifice a cheap (small) sd card than a controller (if S9s until the i model).
Perhaps you could isolate your miners from your family network, you could have them on different network segments (both physically or logically). Ideally the miners would have their own router firewall, i would setup a white list that only lets them connect to the intended pool (and maybe Bitmain, i think the things phone home iirc before they start hashing), and having a local caching dns server is wise (dnscrypt-proxy does wonders).
A proper firewall is generally choosing what is allowed and what is not, ports and sites. Usually something like single button "medium" setting is nearly useless, especially for things whoever designed the firewall didn't think of (such as Bitmain asic miners getting malware).
While i commend you for not using Windows, be aware that both Android and iOS/OSX are not perfectly safe, Apple may be a little better but don't blind trust them, especially when your device gets too old and is put out of support. You are essentially doing a sysadmin work in your home like you would in a company...
Thanks a lot for the information you provided! I really appreciate it! And yes I’ve had one of the worst days in BTC mining this morning when I woke up I found out that the hacker was able to ruin 14 more S9’s!!!!! 14 machines gone in a minute! Apparently he works somewhere in China in the day time when it is night here and I wake up to a surprise! Today’s surprise was SHOCKING!
I have already contacted Bitmain for an advice on what to do and if there is a way that I can repair the controllers by uploading a newer firmware because these machines were from 2017-2018. So I will be waiting for their reply as soon as they start their workday.
At first he hacked 3 so I just disconnected the router connected to my modem thinking that it was causing the problem, since the SSID wasn’t hidden unlike my modem SSID. But when I realized that 14 more are mining for him this morning I started to dig in the log of the modem itself and found about 22 of these Dos Smurf attacks!!! From February second to today’s morning!
2020-02-04 09:00:49 [Error][Alarm-Log] AlarmID:303500,AlarmLevel:Error,DoS attack. Type: smurf. Source IP address: 192.168.1.102. Destination IP address: 192.168.1.255. Source MAC address:
So I contacted the the ISP provider and they confirmed me that I was hacked by WiFi although I’m not sure how since the SSID was hidden. Remotely they have reset everything and I’ve changed all of the passwords. Even on the miners themselves! But I did that yesterday and apparently that didn’t help. Also the modem had a specific check box for preventing these Dos smurf attacks but apparently that didn’t work.
I’m closely monitoring the network tonight to see if there will be any more attacks on my modem, because now I just have a few miners running
Maybe someone had clicked a wrong link from one of the devices who knows.
And I did noticed that the only ones that he wasn’t able to hack (so far) are the last ones that I got so they must have had a newer firmware protecting them from being hacked like that.
All my hope is on Bitmain now and that they answer soon and maybe be able to find a solution for me. Start them with a preloaded firmware on a sd card or just try to upload it through my network on them, I really don’t know but I am afraid to even turn the power on the ones that have been compromised now, thinking that if it was hacked then maybe he can hack my whole new reseted network again and I will loose the rest of the miners? Do you think it is safe to connect one of them to my fresh network or I shouldn’t even try? Or what do you think?
If the Bitmain won’t be able to help me with a firmware upgrade then I really don’t care what I have to load on a Sd card and where it will mine as long as they just don’t sit around like furniture. Now 17-18 have been ruined!
Please let me know your thoughts guys I’d really appreciate if someone with the knowledge be able to give an advice