Quote from: tbonetony on August 04, 2016, 06:18:58 PM

Quote from: cryptichermit on August 04, 2016, 06:05:34 PM

Quote from: tbonetony on August 04, 2016, 05:53:33 PM

Quote from: VRobb on August 04, 2016, 05:49:24 PM

Hey Tony,
As I understand it the S9 has an open API that will let anyone logon to it and change what they want if they can get on your network. Typical from Shitmain, get behind a firewall and you should be good until those with more knowledge of this chime in and give you better/more detailed advice.
This is assuming you have an S9, not sure about the others but if one is open...

Thanks for the reply. I do unfortunately open a port forwarding on my main router just so I can check my miner status outside the house.

Here's the router log of the access:

Code:

[DoS Attack: RST Scan] from source: 46.4.73.199, port 443, Thursday, August 04, 2016 10:34:56
[DHCP IP: 192.168.1.19] to MAC address 24:77:03:07:44:8c, Thursday, August 04, 2016 10:34:53
[DoS Attack: RST Scan] from source: 46.4.73.199, port 443, Thursday, August 04, 2016 10:33:56
[DoS Attack: RST Scan] from source: 24.244.4.25, port 80, Thursday, August 04, 2016 10:32:41
[admin login] from source 192.168.1.51, Thursday, August 04, 2016 10:32:39
[DoS Attack: RST Scan] from source: 46.4.73.199, port 443, Thursday, August 04, 2016 10:32:36
[DHCP IP: 192.168.1.17] to MAC address 00:44:fa:86:16:43, Thursday, August 04, 2016 10:32:07
[DHCP IP: 192.168.1.17] to MAC address 00:44:fa:86:16:43, Thursday, August 04, 2016 10:31:46
[DoS Attack: RST Scan] from source: 46.4.73.199, port 443, Thursday, August 04, 2016 10:30:56
[DoS Attack: SYN/ACK Scan] from source: 91.225.237.39, port 80, Thursday, August 04, 2016 10:30:54
[DoS Attack: RST Scan] from source: 46.4.73.199, port 443, Thursday, August 04, 2016 10:14:46
[color=red][b][LAN access from remote] from 178.156.11.35:13328 to 192.168.1.17:80, Thursday, August 04, 2016 10:13:32[/b][/color]
[DoS Attack: Xmas Tress Scan] from source: 212.71.238.108, port 52100, Thursday, August 04, 2016 10:12:42

and 10:13 is about the exact time my miner got disconnected from my pool.

The access IP was 178.156.11.35 from Spain but it could be through a proxy.

Well you are port forwarding directly to the miner on port:80, and you left default user/pass as root?
It's like an open invitation for a hack. Good thing you noticed quickly.
If you are going to open ports on your network you'll want to set up a specific VNC over SSH using a locked box.
Most people find it just easier to use a third party client like teamviewer or hamachi - but still you'll be going to a designated box that from there can use browser to control miners.

I totally agree that was stupid and lazy setup in first place but I am now so concerned how could someone from the other end of the world locate my public ip? I have never revealed that access port with anyone.

Did you ever change the default host name? you can pretty easily scan IP blocks for the default host name and gain access that way. On another note, how many pools do you have defined? If only a single pool, if the pool goes dead then it will mimic and attack by locking up the miner and you have to do a hard reset.