2023-01-07
On 2022-12-27 the pool received the following email: From: Woon Jin woonjin81 at proton dot me
To:
[email protected] admin at mmpool dot org
Subject: mmpool info mined block this month
Hi my friend
My name is Woon Jin - Im security and pentesting enginer and I contact you to explain more about mmpool problems that appear this month
First of all keep all your private keys in safe places!.
First step for me was to give all credentials to conect to your btc server.
The btc server was accesed first with user main, I checked that wallet that was stored local and I see 0 transactions.
I copied that wallet and go away for months.
I keeped an eye on that public addreses from pool and I see no transactionas from 2016 or 2017 and I go away.
after some time I come back and check again that address and I see some coinbase transactions from some block mined.
I come back to that btc server and I tried to modified the pool config file but no admin privilege and I tried to got admin privilege with a linux kernel expl.
but was a btc server crash first time and then the root privilege escalation was succesful.
I put a new mining address and keep waiting months.
after a lot of time in a day I received a mining pool notification and bang the block mined.
all founds are keeped in safe place. for more details mail me back
I attached her the old privat key for your user main. don't forget to check all your devices about security issues and don't forget about ckpool secutiry issues.
-----BEGIN OPENSSH PRIVATE KEY-----
[redacted]
-----END OPENSSH PRIVATE KEY-----
Sent with [Proton Mail](
https://proton.me/) secure email.
I confirmed that the private key was the key to SSH to the server. I replied requesting more information and return of the funds. On 2022-12-28 I received the following:
Hi friend admin
Hard time here in Shangqui no job no salary and covid pandemic low money level for people here
No more details I have keep you credentials in safe place update software
Old software and webs have more bugs
Firewall is good to be install update ckpool software netcat works well.
Happy year admin
Sent with Proton Mail secure email.
I didn't reply to this email but received another on 2023-01-01: Hi admin
No waste time audit source code
https://bitbucket.org/ckolivas/ckpool/src/master/ old scripts expl no public avaiable
solo.ckpool.or no firewall ssh open exp no work source no bug
solo.ckpool.org has address 51.81.56.15
solo.ckpool.org has IPv6 address 2604:2dc0:100:240f::1
scan hostname: 51.81.56.15
51.81.56.15 : 22 : TXT : SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5
51.81.56.15 : 80 : TXT : 51.81.56.15 : 22 : TXT : SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5
51.81.56.15 : 80 : TXT : 51.81.56.15 : 443 : TXT : 51.81.56.15 : 443 : TXT : 51.81.56.15 : 3333 : TXT : 51.81.56.15 : 3333 : TXT : 51.81.56.15 : 4334 : TXT : 51.81.56.15 : 4334 : TXT : 51.81.56.15 : 8333 : TXT : 51.81.56.15 : 8333 : TXT : Sent with Proton Mail secure email.
I have heard nothing from them since. I am updating the pool software to remove vulernabilities. Once that is done, the pool will be resumed. The bitcoins stolen by the attacker are not retrievable, if you have resources to track them down from the emails that would be useful. As a pool that shares the distribution of mined bitcoins to the users, so is the loss of mined bitcoins through attacks like this distributed. The block will be treated as unfound and the DGM reward system will treat it as if it had not been mined. This will mean the rewards will continue to be funded to miners in future blocks as the DGM system "catches up" for what looks like an unlucky mining period.
On 2022-01-07 I received an email from a pool user with an attempt to obtain information about the pool operator embedded in the email. I am doing my best at keeping the pool operational, and while I've been running it have been responsible for the distribution of many bitcoins. I appreciate all your patience and use of the pool. I hope we can continue to operate in a fair manner following this. to sad. I liked the payout sceme for the blockfinding miner. But now it's over!