Quote from: uninexus on November 17, 2016, 09:28:48 AM

Hey Claymore,
Discovered a disturbing issue with one of my machines. It has happened twice now - at first I thought it was a glitch.
My config file appears to have been over-written remotely - only the t address has been replaced to allow mining to a different address.
I don't believe that is your development fee ;-)
Here is the address in question on http://zcash.flypool.org/: t1LkBCiHBkoKocxEDrQXTnhWo1TuhVhys9J
Only one of my systems is exposed and the issue (exploit?) has happened on that one only.
From the log:
23:45:58:250   20d0   Remote management: file config.txt was downloaded
23:45:58:250   20d0   srv bs: 0
23:45:58:250   20d0   sent: 40
...
23:46:00:849   2528   recv: 50
23:46:00:849   2528   srv pck: 49
23:46:00:865   2528   Remote management required restart
...
23:46:01:917   2528   Restarting OK, exit...
Do we have a sneaky attacker using a way to mine for himself /herself ?
Tell me I am not going crazy here. I need to secure it.

It's a good idea to read Readme and use "-mport 0" or at least "-mport -3333" if you think that you can be attacked via remote management port.