Quote from: mjgraham on February 25, 2016, 12:59:53 PM

Quote from: coinflow on February 24, 2016, 03:53:01 PM

Quote from: emdje on February 20, 2016, 10:43:34 PM

Quote from: coinflow on February 19, 2016, 09:34:56 PM

Is it possible to update a miner with your image simply via apt-get update/upgrade, once it is installed and running?
What version of glibc is in use? See here: http://arstechnica.com/security/2016/02/extremely-severe-bug-leaves-dizzying-number-of-apps-and-devices-vulnerable/

No that is not possible, and I don't know which version of glibc is used I would have to check that when I have some more time.

I'd recommend to check that as soon as possible. Since it is a really severe thing.

ldd --version gives me
ldd (Debian EGLIBC 2.13-38+rpi2) 2.13

while it is a big deal I am not sure how bad in this case it is, I mean it has been around since 2008 , been out for 7 months already, if these were right on the internet w/o a firewall maybe I would be worried, I am up for some scenarios to talk about

In my understanding it means that if the application compiled against the vulnerable glibc does a gethostbyname() call it can be owned. Now since a miner typically resolves the IP of the pool it wants to connect to, the miner might be pretty easy to attack as you can relatively easy predict that it will resolve its pool sooner or later. It is unclear to my understanding if the DNS server your miner uses would discard an actual malformed answer that would trigger the vulnerability.

The firewall you have in front of your miners doesn't help anything here (except you have it locked down so much, that the miner only can connect to the pools ip and port, else the attacker just launches a reverse shell with nc or whatever is en vogue right now.
So theoretically you could just remove any DNS servers from your Pi (echo "" > /etc/resolv.conf) and instead of the name of your pool, add the IP of the pool in the web frontend (and hope your pool doesn't switch providers or whatever could make a change of IP necessary).

Other than that running "apt-get update; apt-get upgrade" and waiting for a new miner binary to be released there is not much we Terminator operators can do right now. Let's hope this will be before real exploits are being published. AFAIK there are currently only 2 PoC exploits in the wild which make it unlikely that the the average Terminator out there is targeted but that might change quickly once there is for example a module for metasploit.