Topic: Need Antminer s9 serial connect to eliminate NEW VIRUS!!! (Read 745 times)

You have to write to bitmain and ask for the antivirus files. They replied in chinese. Download from qq account. About 300mb++. I got the files but i donno how to share it here.

---

https://m.v.qq.com/play.html?vid=g0889oguw7c&ptag=v_qq_com%23v.play.adaptor%233

Watch this video.

I found out. This virus is called "antbuild". It irreversibly "spoils" the processor (burns one time programmable memory), so that the processor stops loading from any standard firmware, including when trying to boot from the SD card, it is blocked until reboot. The image in flash memory, obviously, virus modifies so that it can be accepted by the processor and only this firmware. Even if you reprogram the flash memory on a separate external device with uninfected firmware, you still get the effect of 2 LEDs (talking about blocking the processor). In addition to stealing terrahash, attackers gain access to your board and it can be used as a bot for bad purposes.
Complete cure of the virus is possible only after replacing the processor with a new one. It seems that there are firmware that can bypass this virus (although they cannot completely cure it), but I have not yet managed to defeat it. Be careful, virus is very dangerous, it is constantly being modified and "improved". Be sure to break the network, separate the workers separately, infected separately, suspicious quarantine separately. Never use miners, even new ones, without a complete flashing from scratch with your own hands. There are cases when, it seems, new miners became sources of infection.
if someone knows how to get rid of the consequences of the virus except soldering the processor, please write.

I agree with MigaoMiner if your problem still persists nand IC is your problem replacing it might solve the issue but I think it's rarely happened.

Did you follow what I said above? if not then do it first then update here this is our way to help you fix the issue and to troubleshoot the issue.

If you have a doubt and your miner still under warranty why not contact bitmain for warranty repair?

There is no perfect miner even in different miners and different brands/manufacturers having the same issues it always depends on us if how we care our miners. If you running those miners at higher temp the lifespan of your miner reduced.

---

Why not do some test sample:

Get the damaged Control board and get a known good/working control board now, check the SD card terminal of both damaged and the good one as your reference. Make sure to put the negative pole in the ground and the red/positive put it to terminal one by one test them on both damaged and the working one.

If you see difference it means the damage one is having connection issue that is why the SD card is not detected.

They are not that unreliable, you are simply doing something wrong, but prefer to blame "the virus". But you are welcome to sell them for scraps, i know someone who loves buying those super cheap "damaged" S9 miners and "resurrect" them.

Or hire someone to fix them for you...

I seriously doubt you can't run bOS from the sdcard in all those "50" miners (as long as they are not the newer S9s).

---

Yes i have seen the bad nand syndrome before, but you can still run bOS from sdcard just fine in those, it is one sure way to find out the nand is damaged, because when you attempt to flash it from bOS web ui, then move jumper and reboot, it doesn't work.

This OP could have both the nand and sdport damaged, which is why the official method doesn't work either. Virus can't damage the port, but they could damage the nand. Many miners are run in conditions that rust gets to them, so a damaged port isn't that strange.

I have the same problem for some Controller card.
Bring to technician, load new binary file using NAND programmer n replaced the old NAND.

back to live ..

For many miners, in a short time, the processor or the SD port was suddenly damaged? How high is the probability of simultaneous damage to processors (surprisingly coinciding with virus infection) in 10, 20, 50 or more miners at the same time (I know people who have this happened on several dozen miners)?
Are xininx bitmain control boards so unreliable?

The virus cannot do this. You probably have a damaged controller, or just a damaged sd port as suggested above. Once you move the jumper its like you don't have the nand, it reads the sd card at boot and executes whatever is in it.

It doesn't happen to anyone at all. Just get a new controller and be done with it.

No there's no virus that can block the nand memory from flashing it through SD card maybe the control board of your miner is c5 control board so your problem is the compatibility issue. Or maybe the SD card terminal from the control board has full of rust and dirt if that's the case you need to clean the terminal of sd card then resolder it to make sure the terminal has a connection if you put the SD card again.

Also if you want to clean your miner just flash it in WebGUI and use the latest firmware with anti-virus capability then use the APMinerTool that has an anti-virus feature to scan the miner.

I tried to load the infected s9j miner from the SD card (all jumpers are installed correctly). Its behavior is the same - loading from the memory card is blocked and the green and red LEDs on the front panel are constantly on (as if the processor could not find a suitable boot device).
I checked the memory card in another miner that is not infected with the virus. Download braiins-os was successful.
Thus, it is confirmed that the matter is not in NAND memory and not in a bad SD card, namely, in some way the virus blocks the loading of the operating system from any possible devices, except for the NAND flash, which is installed on the board.
As I understand it, no one has come up with a way to deal with this? It’s very sad when you have many such control boards (I imagine if this happens with professional miners on hundreds of devices!)

It can't. If you are using S9s, you should try booting braiinsOS from the sd card, and see for yourself. Remember bOS only works from S9 to S9i, nothing later (no Hydro, K or SE).

Once you boot BraiinsOS and see everything is working, you could try flashing it to nand (from its Web UI) and see if it works, if it does, you can then go back to Bitmain's using their sd T9+ image firmware method.

One weakness tho, would be the controller flash nand storage. I don't know how evil that malware is, but it is theoretically possible to force damage the nand by endlessly writing data to it. Most damaged flash media still allows reading, which would be perfect for a very unethical thief...

Sometimes people come saying they can't mysteriously install to nand anymore (and obviously Bitmain firmware never restores).

Bitmain fw only blindly copies itself to nand, if the nand is damaged that does nothing. But bOS can run without nand, with the jp4 jumper eternally moved into the boot from sd position. Just buy the cheapest smallest sd card you can find.

Hello. I also had a problem: miners became infected with a virus that, in addition to dropping the hash rate on the pool (the hash rate looks normal in the interface), blocks downloading from the SD memory card. I connected directly to UART and in the terminal I downloaded the firmware and ran the firmware script. Previously, I even replaced the command files for working with flash memory with obviously not infected ones (in case the virus only imitates the firmware process). However, this did not help, some time after the start, the hash on the pool begins to leak to the side. Obviously, you can only cure the virus if you boot from another medium. Therefore, apparently, the virus blocks SD.
Is there any solution for this case at the moment? How can a virus block the download from the card if the boot device is selected by the microprocessor hardware devices long before the start of the infected program from the flash.

Well, i did left out the part where you are supposed to use a secure device to keep your passwords. One step at a time... A secure OS with a secure computer would do. Windows is big no no, Linux/bsd is better but should not be the same device you use for web browsing. Its similar to handling wallets.

The password database is well encrypted, you can backup the file to google drive, dropbox or whatever cloud storage you fancy. You can also have more than one password database file, be creative...

Using no password manager is the worst scenario. A physical book is ok i guess, but its in clear view and can get lost...
Either way it is not scalable to keep hundreds of passwords in your brain, that's why that brain wallet idea was so foolish. The password manager also happens to be a great password generator. People should get in the habit of using them. Then you can add your ideas on top of that.

---

You are very wrong in your "hacker" scenario, but i won't get into details as this is too much derailing, suffice to know you are very very wrong thinking that is helping you in anyway. No wonder you are so stubborn with 8 bit addressing.

Perhaps you should, i don't know, use nmap (with proper options for quick scanning) to see how many seconds it takes to scan all your devices. If the guy is in because, say, that windows laptop or usb a malware was tailored for you (or your type), you are finished. "Hackers" do not go for "low hanging fruit", do not equate the average script kiddie with the guys checking people with money, and/or mining equipment that can grant them even more money, especially crypto...

2 days? Lol. Its more like 2 minutes...

Now, how the heck could you bring the word company when talking about a password manager? WTH is a password manager company? Do you even saw what i linked? A password manager is a program, and the one i linked is a Free and open-source software, you know, like Bitcoin... You would be an idiot to trust a company to handle your passwords, that's like trusting your money to a bank, or your coins to an exchange...

Even your password idea is poor, because there is a way to mix and match generated or password sourced words like bits and bytes to speed up brute forcing, and there you are using Root (big no) which becomes a separate cell to the rest, your password is suddenly as strong as 12345a, ie: it isn't. Here, I'll show you how a truly good password looks like, and hope you don't use it:


I just made it with my Free and open-source software password manager in under a second, i could copy it and paste it anytime i wanted. Mostly i seek whats the max length and character groups accepted by a device or web site and max it.

And yes, i know it doesn't end there, that simply alleviates one of the many possible vectors for penetration. Computer security can be a career profession on its own right. But this is too much derailing for someone not changing an Asic miner default password.

Heck a good one could even be stealing you coins already without you noticing, by being subtle, like those lame dev fee firmware that take only a little from time to time... Ensuring longevity over quick grabs...

I hate password management companies.

As for what is easy a hacker does not want to brute force an unknown group of miners. Since they don’t know what is there.

An example.

Modem firewall
Router firewall

Switch
Mining router 1 firewall. Switch 20 miners
Mining router 2 firewall switch 20 miners

If you are a hacker.

You can see the modem
You can see the first router.

But miner router 1 and miner  router 2. Look like ips on  first router.

You don’t know what is there.

Vs.
modem
Router
Switches
Miners.

If I hack and see second setup.

A modem then a router then a large subnet with 192.168.x.x.x

And 1000 ips on that I am working on hacking that. Since it looks promising.

While the setup
Modem
Router
Switch
Miner router
Miner router

Looks like

First router has 6 or 7 ips.  2 of those ips are the mining routers but they do not easily show that you have 50 or 100 or even a few thousand ips.

So a hacker  would pass over the less promising  setup that only seems to have 5 or 6 or 7 ips.

Hackers will go for low hanging fruit.

As for Root12345a

That is not so easy as it is 100000 x 26 x 26 which is 6000000 plus combos not counting Root so say 100
Words in beginning .

Means 6,000,000 x 100 that is 600,000,000 combos.

Plus two miner routers each have a password.

And as I said the mining routers appear as a single ip.

So as a hacker do I spend a day or 2 on a router with a subnet like this 192.168.x.x.x. With over 1200 ips working.

Or do I spend a day or 2 on a router with a subnet like this 192.168.x.x with only 6 ips working.

I am willing to bet the house that this is the case,  it's highly unlikely that the hacker will attempt accessing your miner on a network layer only, it's stupid and nobody would do that, they will have to breach a lot of securities to get to the miner, nobody would do that when they can simply get you to download a malware/trojan and give them full access from whitin your local areal network where things become much easier


just make sure the passwords are random and not based on the miner's name or IP because that is as bad as having a single password.

Downside to password manager is you lose or get hacked that one master password you can say goodbye to all your accounts.

I really don't think password managers are a good solution.

What I used to do for my miners was have a logbook give every miner a number and a random password in the logbook this way someone would need physical access to get your miner passwords.

The less you keep in digital format the less you have to lose.

You have to use password manager to generate a decent password for your miners. Not bothering to change the default password is asking for trouble, you think a little nat and firewall will protect you, but you neglected that windows computer that got a malware and scanned your network for asic miners...

Number one problem with security is people habits... That's what they exploit most.

If you use a password manager, you only have to remember only one (good) password, and yet have everything with a different passwords... Try KeepassXC.

Of course there is more, but lets start with the basics.

Well I tested the attack toolkit last night and I must say it's a free-ride for hackers is bitcoin and mining.
After only a few moments tested I had over 300+ ip's of machines 95% of which were not behind any sort of firewall or protection.

I did not attempt to brute them but I would guess with some good word lists and time most of them would fall.

I am also convinced there is an exploit out there for miners that would allow this kind of thing.

Don't say I didn't warn you when the ransomware starts to hit the miners.

That is a great idea until it is not!
Remember that computers don't have "logic" that password does look difficult to us humans, but it is derived from a terribly simple code, i can write a code that would generate more complex passwords than these, but once anyone understand how the code works ( not very difficult to do so) those passwords will be as simple as 123.

That is a long subject , but long story short , always "think" of your own complex password, because it is nearly impossible that any function out there will create a similar one.

I think you can try to generate a root password from this site https://passwordsgenerator.net/ to use it for your SSH root password.

This password below is harder to brute-force than a simple world

Sample


Just make sure that you save this password or make a backup so that you can use the password when you need to access or remotely use the miner.

Phill, i was a little paranoid i used a password that i even tend to forget ( wrote that on a piece of paper of course) the word Root with other five numbers is relatively easy to brute force.

In most cases length is less important than what combination you use, all brute force attacks use a "dictionary" which is a .txt file with a dozen words in it, the password combination you suggested is highly likely to be there in the .txt files they use.

You need to come up with something that nobody/software can come up with, some stupid shit like


You can put all your gears on a Vlan and it will be very hard to get to them, but remember it takes one mistake to allow the virus to get to them.

it would be best if you have a PC that never goes online,and only that PC is set up on the same LAN the gears use.