Topic: mmpool.org - 1.5% fee DGM/PPS - tx fees/vardiff/merge mine/tor - page 2. (Read 361911 times)

I am sorry for the loss you suffered.

Even if it is not fraud by the pool owner he still is liable for not securing the mining address correctly.

You certainly would have a civil case against him if you find him.

your loss is 6 x 16.8k = 100.8k or more I hope you can find him out and get restitution from him.

2023-01-07

    On 2022-12-27 the pool received the following email:

    From: Woon Jin woonjin81 at proton dot me
    To: [email protected] admin at mmpool dot org
    Subject: mmpool info mined block this month
    Hi my friend
    My name is Woon Jin - Im security and pentesting enginer and I contact you to explain more about mmpool problems that appear this month
    First of all keep all your private keys in safe places!.
    First step for me was to give all credentials to conect to your btc server.
    The btc server was accesed first with user main, I checked that wallet that was stored local and I see 0 transactions.
    I copied that wallet and go away for months.
    I keeped an eye on that public addreses from pool and I see no transactionas from 2016 or 2017 and I go away.
    after some time I come back and check again that address and I see some coinbase transactions from some block mined.
    I come back to that btc server and I tried to modified the pool config file but no admin privilege and I tried to got admin privilege with a linux kernel expl.
    but was a btc server crash first time and then the root privilege escalation was succesful.
    I put a new mining address and keep waiting months.
    after a lot of time in a day I received a mining pool notification and bang the block mined.
    all founds are keeped in safe place. for more details mail me back
    I attached her the old privat key for your user main. don't forget to check all your devices about security issues and don't forget about ckpool secutiry issues.
    -----BEGIN OPENSSH PRIVATE KEY-----
    [redacted]
    -----END OPENSSH PRIVATE KEY-----
    Sent with [Proton Mail](https://proton.me/) secure email.

    I confirmed that the private key was the key to SSH to the server. I replied requesting more information and return of the funds. On 2022-12-28 I received the following:

    Hi friend admin
    Hard time here in Shangqui no job no salary and covid pandemic low money level for people here
    No more details I have keep you credentials in safe place update software
    Old software and webs have more bugs
    Firewall is good to be install update ckpool software netcat works well.
    Happy year admin
    Sent with Proton Mail secure email.

    I didn't reply to this email but received another on 2023-01-01:

    Hi admin
    No waste time audit source code
    https://bitbucket.org/ckolivas/ckpool/src/master/
    old scripts expl no public avaiable
    solo.ckpool.or no firewall ssh open exp no work source no bug
    solo.ckpool.org has address 51.81.56.15
    solo.ckpool.org has IPv6 address 2604:2dc0:100:240f::1
    scan hostname: 51.81.56.15
    51.81.56.15 : 22 : TXT : SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5
    51.81.56.15 : 80 : TXT : 51.81.56.15 : 22 : TXT : SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.5
    51.81.56.15 : 80 : TXT : 51.81.56.15 : 443 : TXT : 51.81.56.15 : 443 : TXT : 51.81.56.15 : 3333 : TXT : 51.81.56.15 : 3333 : TXT : 51.81.56.15 : 4334 : TXT : 51.81.56.15 : 4334 : TXT : 51.81.56.15 : 8333 : TXT : 51.81.56.15 : 8333 : TXT : Sent with Proton Mail secure email.

I have heard nothing from them since. I am updating the pool software to remove vulernabilities. Once that is done, the pool will be resumed. The bitcoins stolen by the attacker are not retrievable, if you have resources to track them down from the emails that would be useful. As a pool that shares the distribution of mined bitcoins to the users, so is the loss of mined bitcoins through attacks like this distributed. The block will be treated as unfound and the DGM reward system will treat it as if it had not been mined. This will mean the rewards will continue to be funded to miners in future blocks as the DGM system "catches up" for what looks like an unlucky mining period.

On 2022-01-07 I received an email from a pool user with an attempt to obtain information about the pool operator embedded in the email. I am doing my best at keeping the pool operational, and while I've been running it have been responsible for the distribution of many bitcoins. I appreciate all your patience and use of the pool. I hope we can continue to operate in a fair manner following this.

I have emailed [email protected] several times since 27 December 2022 and I have received no reply since then.

The admin assured me in 2021 that the pool would remain operational and encouraged more mining.  I rented mining rigs and found the majority of the blocks in 2021.
Those rewards were paid out as promised.  The admin encouraged more mining

This year, I mined more and doubled down in the last quarter to try to find a block before the end of the year for this pool.
It was a long and difficult round with low luck.  It seemed to go on forever.  I went in deeper.
A block was found and I was elated to get some of the year-long investment back... or so I thought.

We were robbed before the payout happened.
The admin put the pool on hold for an audit and then dropped communications.

I have been patient, but this is fraud.
I don't have any other course of action: I will find the admin in person and continue the conversation.    
I emailed the admin to say exactly that message today.  Still no reply.  

So, backing up to last year...
On 27 December, I received this final message for 2022.  At the time I agreed to keep it confidential while the admin worked out the details.  But since I have had no reply, here are all the details of that final message.  The typos and removed information was exactly as I received it.  The facts don't match what actually happened since the alleged perpetrator talks about 2016 and 2017 and this all went down between December 2021 and December 2022.  But anyway, here it is.


Somebody please quote this post for me.  
I will apologize if I am so lucky to be wrong about this fraud ... or I will find the admin and discuss it in person.


        ctya
(Calmer Than You Are )

I have been contacted by the person who took the pool funds today. They have provided proof that they accessed the server. They apparently gained access a long time ago, and waited for the opportunity to obtain the funds. Here's part of their communication:

===
The btc server was accesed first with user [removed}, I checked that wallet that was stored local and I see 0 transactions.
I copied that wallet and go away for months.
I keeped an eye on that public addreses from pool and I see no transactionas from 2016 or 2017 and I go away.
after some time I come back and check again that address and I see some coinbase transactions from some block mined.
I come back to that btc server and I tried to modified the pool config file but no admin privilege and I tried to got admin privilege with a linux kernel expl.
but was a btc server crash first time and then the root privilege escalation was succesful.
I put a new mining address and keep waiting months.
after a lot of time in a day I received a mining pool notification and bang the block mined.
==

They say the funds are "in a safe place" and asked my to email them back for details which I have done today. Please keep the specific details above confidential for now while I communicate with them. I'll let you know as soon as they reply, or within 24 hours if I haven't heard back.

Personally, I can't find a scenario where the hacker would find it beneficial to return the funds.

On my end, I still doubt the administrator's good faith. It seems completely insane to not check the address associated with the coinbase after a random server reboot.

I'm waiting to see, but I'm not optimistic.

maybe he can do something to fix what happened.

2022-12-28
I've received an email from someone claiming responsibility for stealing the coins, with proof that they obtained access to the server through an exploit. I'll post an update here about the correspondence with them soon. The pool server is currently down while the software and setup is audited.

Well I am still pointing a s17 and while it would not save the lost block if it hit it would help out a bit.

I will keep it pointed til 2023

2022-12-23
Unfortunately it looks like the pool backend has been comprimised and the address in the coinbase transaction was changed to one under the attackers control. It looks like they generated an address to be similar to the original pool address. The coins haven been moved from that address, possibly to a coin mixer based on the look of the transactions. The configuration files of the pool were last changed in December 2021, a couple of days after the server experienced a reboot. I'm working on the theory that they were changed by the attacker then. I'm currently analysing the server looking for evidence. There will likely be downtime at some point as I investigate. I'm considering options on how to handle the situation and will post here after discussion with other parties involved in the pool operation and miners. If the attacker is reading this, I implore them to consider returning the funds. This is a small pool operation with a few miners, and the loss of these funds is devastating.

Interesting ... the last pool to lose a block (which was the administration's fault)
members of the community paid him to continue running the pool when he wanted to quit

...
The theft or loss of pool funds is not the miners' responsibility.
Miners pay a 1.5% administration fee in exchange for the administration of the pool and its processes.
...