Topic: Need Antminer s9 serial connect to eliminate NEW VIRUS!!! (Read 745 times)

You have to write to bitmain and ask for the antivirus files. They replied in chinese. Download from qq account. About 300mb++. I got the files but i donno how to share it here.

---

https://m.v.qq.com/play.html?vid=g0889oguw7c&ptag=v_qq_com%23v.play.adaptor%233

Watch this video.

I found out. This virus is called "antbuild". It irreversibly "spoils" the processor (burns one time programmable memory), so that the processor stops loading from any standard firmware, including when trying to boot from the SD card, it is blocked until reboot. The image in flash memory, obviously, virus modifies so that it can be accepted by the processor and only this firmware. Even if you reprogram the flash memory on a separate external device with uninfected firmware, you still get the effect of 2 LEDs (talking about blocking the processor). In addition to stealing terrahash, attackers gain access to your board and it can be used as a bot for bad purposes.
Complete cure of the virus is possible only after replacing the processor with a new one. It seems that there are firmware that can bypass this virus (although they cannot completely cure it), but I have not yet managed to defeat it. Be careful, virus is very dangerous, it is constantly being modified and "improved". Be sure to break the network, separate the workers separately, infected separately, suspicious quarantine separately. Never use miners, even new ones, without a complete flashing from scratch with your own hands. There are cases when, it seems, new miners became sources of infection.
if someone knows how to get rid of the consequences of the virus except soldering the processor, please write.

I agree with MigaoMiner if your problem still persists nand IC is your problem replacing it might solve the issue but I think it's rarely happened.

Did you follow what I said above? if not then do it first then update here this is our way to help you fix the issue and to troubleshoot the issue.

If you have a doubt and your miner still under warranty why not contact bitmain for warranty repair?

There is no perfect miner even in different miners and different brands/manufacturers having the same issues it always depends on us if how we care our miners. If you running those miners at higher temp the lifespan of your miner reduced.

---

Why not do some test sample:

Get the damaged Control board and get a known good/working control board now, check the SD card terminal of both damaged and the good one as your reference. Make sure to put the negative pole in the ground and the red/positive put it to terminal one by one test them on both damaged and the working one.

If you see difference it means the damage one is having connection issue that is why the SD card is not detected.

They are not that unreliable, you are simply doing something wrong, but prefer to blame "the virus". But you are welcome to sell them for scraps, i know someone who loves buying those super cheap "damaged" S9 miners and "resurrect" them.

Or hire someone to fix them for you...

I seriously doubt you can't run bOS from the sdcard in all those "50" miners (as long as they are not the newer S9s).

---

Yes i have seen the bad nand syndrome before, but you can still run bOS from sdcard just fine in those, it is one sure way to find out the nand is damaged, because when you attempt to flash it from bOS web ui, then move jumper and reboot, it doesn't work.

This OP could have both the nand and sdport damaged, which is why the official method doesn't work either. Virus can't damage the port, but they could damage the nand. Many miners are run in conditions that rust gets to them, so a damaged port isn't that strange.

I have the same problem for some Controller card.
Bring to technician, load new binary file using NAND programmer n replaced the old NAND.

back to live ..

For many miners, in a short time, the processor or the SD port was suddenly damaged? How high is the probability of simultaneous damage to processors (surprisingly coinciding with virus infection) in 10, 20, 50 or more miners at the same time (I know people who have this happened on several dozen miners)?
Are xininx bitmain control boards so unreliable?

The virus cannot do this. You probably have a damaged controller, or just a damaged sd port as suggested above. Once you move the jumper its like you don't have the nand, it reads the sd card at boot and executes whatever is in it.

It doesn't happen to anyone at all. Just get a new controller and be done with it.

No there's no virus that can block the nand memory from flashing it through SD card maybe the control board of your miner is c5 control board so your problem is the compatibility issue. Or maybe the SD card terminal from the control board has full of rust and dirt if that's the case you need to clean the terminal of sd card then resolder it to make sure the terminal has a connection if you put the SD card again.

Also if you want to clean your miner just flash it in WebGUI and use the latest firmware with anti-virus capability then use the APMinerTool that has an anti-virus feature to scan the miner.

I tried to load the infected s9j miner from the SD card (all jumpers are installed correctly). Its behavior is the same - loading from the memory card is blocked and the green and red LEDs on the front panel are constantly on (as if the processor could not find a suitable boot device).
I checked the memory card in another miner that is not infected with the virus. Download braiins-os was successful.
Thus, it is confirmed that the matter is not in NAND memory and not in a bad SD card, namely, in some way the virus blocks the loading of the operating system from any possible devices, except for the NAND flash, which is installed on the board.
As I understand it, no one has come up with a way to deal with this? It’s very sad when you have many such control boards (I imagine if this happens with professional miners on hundreds of devices!)

It can't. If you are using S9s, you should try booting braiinsOS from the sd card, and see for yourself. Remember bOS only works from S9 to S9i, nothing later (no Hydro, K or SE).

Once you boot BraiinsOS and see everything is working, you could try flashing it to nand (from its Web UI) and see if it works, if it does, you can then go back to Bitmain's using their sd T9+ image firmware method.

One weakness tho, would be the controller flash nand storage. I don't know how evil that malware is, but it is theoretically possible to force damage the nand by endlessly writing data to it. Most damaged flash media still allows reading, which would be perfect for a very unethical thief...

Sometimes people come saying they can't mysteriously install to nand anymore (and obviously Bitmain firmware never restores).

Bitmain fw only blindly copies itself to nand, if the nand is damaged that does nothing. But bOS can run without nand, with the jp4 jumper eternally moved into the boot from sd position. Just buy the cheapest smallest sd card you can find.

Hello. I also had a problem: miners became infected with a virus that, in addition to dropping the hash rate on the pool (the hash rate looks normal in the interface), blocks downloading from the SD memory card. I connected directly to UART and in the terminal I downloaded the firmware and ran the firmware script. Previously, I even replaced the command files for working with flash memory with obviously not infected ones (in case the virus only imitates the firmware process). However, this did not help, some time after the start, the hash on the pool begins to leak to the side. Obviously, you can only cure the virus if you boot from another medium. Therefore, apparently, the virus blocks SD.
Is there any solution for this case at the moment? How can a virus block the download from the card if the boot device is selected by the microprocessor hardware devices long before the start of the infected program from the flash.

Well, i did left out the part where you are supposed to use a secure device to keep your passwords. One step at a time... A secure OS with a secure computer would do. Windows is big no no, Linux/bsd is better but should not be the same device you use for web browsing. Its similar to handling wallets.

The password database is well encrypted, you can backup the file to google drive, dropbox or whatever cloud storage you fancy. You can also have more than one password database file, be creative...

Using no password manager is the worst scenario. A physical book is ok i guess, but its in clear view and can get lost...
Either way it is not scalable to keep hundreds of passwords in your brain, that's why that brain wallet idea was so foolish. The password manager also happens to be a great password generator. People should get in the habit of using them. Then you can add your ideas on top of that.

---

You are very wrong in your "hacker" scenario, but i won't get into details as this is too much derailing, suffice to know you are very very wrong thinking that is helping you in anyway. No wonder you are so stubborn with 8 bit addressing.

Perhaps you should, i don't know, use nmap (with proper options for quick scanning) to see how many seconds it takes to scan all your devices. If the guy is in because, say, that windows laptop or usb a malware was tailored for you (or your type), you are finished. "Hackers" do not go for "low hanging fruit", do not equate the average script kiddie with the guys checking people with money, and/or mining equipment that can grant them even more money, especially crypto...

2 days? Lol. Its more like 2 minutes...

Now, how the heck could you bring the word company when talking about a password manager? WTH is a password manager company? Do you even saw what i linked? A password manager is a program, and the one i linked is a Free and open-source software, you know, like Bitcoin... You would be an idiot to trust a company to handle your passwords, that's like trusting your money to a bank, or your coins to an exchange...

Even your password idea is poor, because there is a way to mix and match generated or password sourced words like bits and bytes to speed up brute forcing, and there you are using Root (big no) which becomes a separate cell to the rest, your password is suddenly as strong as 12345a, ie: it isn't. Here, I'll show you how a truly good password looks like, and hope you don't use it:


I just made it with my Free and open-source software password manager in under a second, i could copy it and paste it anytime i wanted. Mostly i seek whats the max length and character groups accepted by a device or web site and max it.

And yes, i know it doesn't end there, that simply alleviates one of the many possible vectors for penetration. Computer security can be a career profession on its own right. But this is too much derailing for someone not changing an Asic miner default password.

Heck a good one could even be stealing you coins already without you noticing, by being subtle, like those lame dev fee firmware that take only a little from time to time... Ensuring longevity over quick grabs...

I hate password management companies.

As for what is easy a hacker does not want to brute force an unknown group of miners. Since they don’t know what is there.

An example.

Modem firewall
Router firewall

Switch
Mining router 1 firewall. Switch 20 miners
Mining router 2 firewall switch 20 miners

If you are a hacker.

You can see the modem
You can see the first router.

But miner router 1 and miner  router 2. Look like ips on  first router.

You don’t know what is there.

Vs.
modem
Router
Switches
Miners.

If I hack and see second setup.

A modem then a router then a large subnet with 192.168.x.x.x

And 1000 ips on that I am working on hacking that. Since it looks promising.

While the setup
Modem
Router
Switch
Miner router
Miner router

Looks like

First router has 6 or 7 ips.  2 of those ips are the mining routers but they do not easily show that you have 50 or 100 or even a few thousand ips.

So a hacker  would pass over the less promising  setup that only seems to have 5 or 6 or 7 ips.

Hackers will go for low hanging fruit.

As for Root12345a

That is not so easy as it is 100000 x 26 x 26 which is 6000000 plus combos not counting Root so say 100
Words in beginning .

Means 6,000,000 x 100 that is 600,000,000 combos.

Plus two miner routers each have a password.

And as I said the mining routers appear as a single ip.

So as a hacker do I spend a day or 2 on a router with a subnet like this 192.168.x.x.x. With over 1200 ips working.

Or do I spend a day or 2 on a router with a subnet like this 192.168.x.x with only 6 ips working.

I am willing to bet the house that this is the case,  it's highly unlikely that the hacker will attempt accessing your miner on a network layer only, it's stupid and nobody would do that, they will have to breach a lot of securities to get to the miner, nobody would do that when they can simply get you to download a malware/trojan and give them full access from whitin your local areal network where things become much easier


just make sure the passwords are random and not based on the miner's name or IP because that is as bad as having a single password.

Downside to password manager is you lose or get hacked that one master password you can say goodbye to all your accounts.

I really don't think password managers are a good solution.

What I used to do for my miners was have a logbook give every miner a number and a random password in the logbook this way someone would need physical access to get your miner passwords.

The less you keep in digital format the less you have to lose.

You have to use password manager to generate a decent password for your miners. Not bothering to change the default password is asking for trouble, you think a little nat and firewall will protect you, but you neglected that windows computer that got a malware and scanned your network for asic miners...

Number one problem with security is people habits... That's what they exploit most.

If you use a password manager, you only have to remember only one (good) password, and yet have everything with a different passwords... Try KeepassXC.

Of course there is more, but lets start with the basics.

Well I tested the attack toolkit last night and I must say it's a free-ride for hackers is bitcoin and mining.
After only a few moments tested I had over 300+ ip's of machines 95% of which were not behind any sort of firewall or protection.

I did not attempt to brute them but I would guess with some good word lists and time most of them would fall.

I am also convinced there is an exploit out there for miners that would allow this kind of thing.

Don't say I didn't warn you when the ransomware starts to hit the miners.

That is a great idea until it is not!
Remember that computers don't have "logic" that password does look difficult to us humans, but it is derived from a terribly simple code, i can write a code that would generate more complex passwords than these, but once anyone understand how the code works ( not very difficult to do so) those passwords will be as simple as 123.

That is a long subject , but long story short , always "think" of your own complex password, because it is nearly impossible that any function out there will create a similar one.

I think you can try to generate a root password from this site https://passwordsgenerator.net/ to use it for your SSH root password.

This password below is harder to brute-force than a simple world

Sample


Just make sure that you save this password or make a backup so that you can use the password when you need to access or remotely use the miner.

Phill, i was a little paranoid i used a password that i even tend to forget ( wrote that on a piece of paper of course) the word Root with other five numbers is relatively easy to brute force.

In most cases length is less important than what combination you use, all brute force attacks use a "dictionary" which is a .txt file with a dozen words in it, the password combination you suggested is highly likely to be there in the .txt files they use.

You need to come up with something that nobody/software can come up with, some stupid shit like


You can put all your gears on a Vlan and it will be very hard to get to them, but remember it takes one mistake to allow the virus to get to them.

it would be best if you have a PC that never goes online,and only that PC is set up on the same LAN the gears use.

A simple trick is

Root
Root

Needs to be

Root
Root12345a

Not 12345 but any 5 digit number.
With any single letter. Upper or lower case.

It takes a long time to brute force that.

Yet is fairly easy to remember .

There are other ways to protect.

Modem
router a
five port switch
Router 1 to switch to bitmain sha 256
Router 2 to switch to bitmain script
Router 3 to switch to other miners

I have found the above to work well.
It also lets me find and examine miner status a bit easier.

I have had this experience before , and to confirm the brute force theory only miners with default root/root got infected. But a simple reset using IP report button method and then imiedtly change the password to a complex one solved the issue.

Hate to say this but maybe locking SSH access in the new firmware update does makes a lot of sense in terms of security, provided that if you only change the root pass using the web browser, the virus can still access it via SSH, and changing the SSH password is not something everyone can do despite the fact that it only takes a couple seconds.

This may actually be a legit issue recently an attack tool for miners has been released it scans shodan with the API for miners with open ports then brutes the miners allowing the attacker access to the machines it may be possible you have weak credentials on your machines and they have been compromised via brute force attempt.

Once attackers gain access they can update your miners it could be possible they have custom firmware that might make it difficult to recover the miner but you should be able to use the above guides to flash the miners with clean firmware.

My farm 9/10 miners got infected this virus too,
Have you all found any solutions to unlock the sd card nand flash?
Pls help

If you flash the miner without blinking it means that the control board can't detect the SD card or the flashing couldn't start or maybe you are using a fake SD card with fake capacity.

You should use a working SD card 4gb or higher to make the flashing work. There's sometimes that everytime you make a program recovery the program you make from SD card is corrupted because your PC might be infected. So try to make SD card recovery on a fresh PC or clean PC to avoid corrupted program recovery.

Is it possible that they changed something on a hardware level  before shipping the miners? I mean something to block you from Sdcard flashing a firmware? By all means it is hard to believe that on a software level you can't replace the firmware, what happens when you hard reset it using the IP report?

im having the same issue with a hacked miner ... it infected my other 18 mining s9 .....

have you managed to solve this issue ?

if you did ... please give me a solution

thanks

yea, i can flash uninfected miners without any problem, with same SD card, with same firmware.

running processes hashes main ones i checked and hashes aren't changed.

Bmminer, single-board-test,dropbear,lighttpd, monitorcg,ntpd

it opened some kind of socket, when opened netstat, killed all socket connections and run bmminer, virus was still there. flashed with web-interface, with no internet access, killed all sockets, run bmminer miner, opened internet, virus is still there.

this all is happening on newest firmware, with serial connection.

Just to make sure, when you are trying to flash from SD, you're moving the jp4 jumper into the other position?

On a side note, check on size and hash for /usr/bin/ntpd , some viruses I've seen overwrite that file with the payload.

You can also run "top" to see which processes are taking cpu/memory and compare those size/hash against the normal.

when you get the virus, it doesn't allow you SD flash, you can change the password for ssh, but it doen't matter, it's there even after flashing software from web.

ssh wasn't a problem to begin with, in my network only one IP can access to 22 port.

there IS virus for s9 right now.

steps i've done so far:

1) i isolated the one miner from other miners, tried flashing with SD card, doesn't work. tried flashing with different firmware from web-interface, doesn't help, Hard reset either.

2) blocked all internet access from firewall, tried step 1. opened internet access, virus is still there.

3) took miner to different location with different ISP/IP different network configuration(thought network was infected), tried step 2, opened internet access, virus is still there.

and one more thing, every infected miner have same issue with flashing with SD card, it just doesn't work. Leds never blink, and from onboard 3 green leds only 1 is on always. it doesn't matter its official firmware, brains-OS , any other firmware, it doesn't flash.

and half of miners infected were on latest firmware.

No there's no virus for s9 miner possible there is someone can remotely access to your miner if your miner has open ports and never change the SSH root and password there is a possibility that they can remotely access your miner. That is why Bitmain release a 2019 firmware to prevent these issues.

If you have this problem the only solution that I know to remove this is by flashing it through SD card and the change your SSH root and password so that no one can access your miner.

If hackers have access to your miner they can manually update the firmware to their modified firmware where even hard reset the miner the result will be the same as yours.

So you should change everything from your port to SSH access credentials before you connect it to the internet.

i can confirm this is virus.

first of all:  SD flash, restting in any way doesn't helps. all infected miners try to communicate with each other with 123 port. all infected miners goes to F2pool, antpool and btc.com AND  35.186.233.235:443 which is google drive IP, (first miner goes here). bmminer hash isn't changed.

i don't know how to remove the virus, but you can get back your hashrate with two solutions:

1. get into miner (over ssh or comport) , change the name of bmminer and run manually.

2. block all IPs that miner goes to from firewall, (this solution build up the ram so you have to restart the miner every hour or so).

3. there is asicdip custom software which says it blocks the access for this virus, but didn't tested it and it takes 2 %, and its not for me.

will update if I will find solution.

Do you already have the CP2102 bridge and have you wired it correctly? GND = GND, but TX and RX need to be switched. Also be careful.. GND is the middle pin on the xilinx board but not on the USB.

I used to have the chinese version of the program. I can try to find it if you really need it, but you can most likely fix your issue with the suggestions provided above.

Indeed, not virus but the controller's nand flash storage can get damaged. This is why its useful to test with Braiins OS booting from the sd card with jp4 jumper moved.

Bitmain solution simply tries to (blindly) reflash back the firmware. If this nand storage is damaged no amount of reflashes would do anything.

I doubt the accuracy of this statement , not specifically denying the problem just doubting the cause.

In most cases any miner virus won't be really able to lock you from SD flashing , have you flashed any miner with an SD card before ? Just want to make sure that you are not making any mistakes.

You should also check your pc for viruses, there is a good chance that whichever virus affecting it sits on one of the pcs on your network.

Or you control board is not reading SD card because your SD card slot from the control board is full of dust. Try cleaning it with lacquer flo and remove the dust and resold the SD card terminal this mostly solve my issue in other devices. So possible it might also work in s9 miner.

Never heard that there is a virus that can prevent you from flashing even other devices through SD card.

Anyway, since you mention about usb and serial maybe this thread is what you're looking for check this https://bitcointalksearch.org/topic/rescuing-a-bricked-t9-and-s9-control-board-howto-2386296.

How did this virus infect your miners? Did you ever change the web and ssh passwords?

I don't think a virus can block jp4 jumper to boot from sdcard. Did you ever try booting Braiins OS? This should work without fail.

Hello guys!
We have virus which decreasing hash rate and steal it.

Can anybody help how to connect to Bitmain Antminer S9 Miner via CP2102 USB/Serial bridge? (Virus is blocking SD card flashing)
How to erase existing infected software on board and flash it with new firmware?

Thank you in advance for help! Hope this virus will avoid you!