So....
did anyone investigate the possibility that the API for pool manipulation was being abused? If can modify peoples pool settings to create a pool with specific settings and then switch to that pool - which probably points at an http URL which then sends the stratum reconnect command to point to whatever the wallet address is at the time...
this, in theory could be done via javascript in your browser, miner monitoring software, malware, etc.
this tactic seems much easier than a large-scale man in the middle attack.
anyone whose miner is currently redirected and is running the curses interface, hit "S" for settings, then hit "W" for write. Write it out to some config file and view it. If it has more information in it than you put into it, post it here for people to evaluate.
From reviewing the code, it appeared to me that the client.reconnect message must have been received on an active stratum connection that had already passed the mining.subscribe, mining.authorize messages. So at the very least the server to which it was connected must have been able to emulate a stratum mining server up to that point.
As for gathering the rest of that type of information from miners, it's not much unlike herding cats. I had posted a list of information for affected miners to supply in order to help narrow down the cause, but not a single reply was posted. Perhaps some might have sent directly to poolwaffle?
(I really wanted to see it happen on one of my miners!)
Yes, basic stratum functionality can be emulated by anything that does TCP/IP & sockets. Just accept everything and say that it's good regardless of what they send you.
Also, consider this, a pool can redirect from http to stratum, so I wouldn't rule out basic http as the genesis just yet, but I haven't gone through to see where that occurs in the chain.
Ya, not a single one of my miners - 4 rigs in two locations got redirected. None of them using SGMiner or CGMiner - From what another user told me, the api functions from cgwatcher or cgmonitor did not work against YACMiner until it was renamed cgminer.
... how long who long who knows LOL 
