Quote from: Balthazar on May 05, 2015, 03:07:23 PM

Hi guys.

Read an article yesterday, and I think I know why some pools are so "unlucky".

In fact they're not unlucky, they're attacked through share multiplication issue. There is a vulnerability found in the majority of stratum mining protocol implementations. I've published the disclosure of this bug few weeks ago.

Vulnerability is caused by incorrect algorithm of verification for uniqueness. Instead of checking raw solutions, most of the pools are doing this through checking the hex-encoded representation. This allows miner to create multiple versions of the same share through applying uppercase function to hex encoded solution.

Quote

{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0ad31ee"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0ad31eE"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0ad31Ee"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0ad31EE"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0aD31ee"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}

This vulnerability seems as intentionally made i.e. backdoor. Simplest workaround is to use lower() method:

Code:

@@ -192,7 +192,12 @@ def submit_share(self, job_id, worker_name, session, extranonce1_bin, extranonce
   # Check nonce
   if len(nonce) != 8:
   raise SubmitException("Incorrect size of nonce. Expected 8 chars")

+ # normalize the case to prevent duplication of valid shares by the client
+ ntime = ntime.lower()
+ nonce = nonce.lower()
+ extranonce2 = extranonce2.lower()
+
   # Check for duplicated submit

As far I know, stratum-mining/eloipool/node-stratum-pool are vulnerable. Example of affected pools is ghash.io... Some pools like BtcGuild are not affected for unclear reason. Probably because they're using proprietary software.

lol.

I'm guessing you haven't actually looked at the code for eloipool. No where in the code does it check the ascii-hex version of anything share related.

FUD.