Quote from: aarons6 on March 27, 2017, 11:34:41 AM

Quote from: mrmaigo on March 27, 2017, 11:04:21 AM

Quote from: aarons6 on March 27, 2017, 10:45:24 AM

Quote from: mrmaigo on March 27, 2017, 10:09:31 AM

One of my miners has been hijacked with Eth Manager Tongue

his address is daggerhashimoto.usa.nicehash.com:3353 -ewal 1D8J2tkRbt5R7TNZKdBYdq8qx2aJDFqU1M
https://www.nicehash.com/?p=miners&addr=1D8J2tkRbt5R7TNZKdBYdq8qx2aJDFqU1M

you have yourself a virus. this is a very old address.

damn, any more information on it?

no but ive seen something like this before.. you can search that wallet on here for a thread back in 2015..

if the manager has a way to only allow certain ip addresses id set it to yours only. ive never checked out the manager.

ETHman is just the manager. Any ip anywhere can connect to a miner with the -mport flag on. Everyone using Claymore needs to be setting "-mport 0" to disable the manager or "-mport -3333" to leave the monitoring open.

Did a bit of poking and prodding. This is what I found.
ETHman lets you see the speed/temp of the miner AND send the epools/dpools.bat and reboot.bat remotely and run them. The miner itself defaults to leaving the door open (WTF Claymore?!?). Just get the ip of someone using claymore and do a port scan and you're in.

I'm figuring that's what happened to me. My pools and reboot bats where changed, then the miner was restarted to change the miningpool.

It's was only for about 9 hours, I'm not going to cry about it. BUT its a huge ass hole in Claymore.

This shit needs to be bolded and posted at the top, not hidden at the bottom of the documentation.

Quote

-mport remote monitoring/management port. Default value is -3333 (read-mode), specify "-mport 0" to disable remote monitoring/management feature.
Specify negative value to enable monitoring (get statistics) but disable management (restart, uploading files), for example, "-mport -3333" enables port 3333 for remote monitoring, but remote management will be blocked.
You can also use your web browser to see current miner state, for example, type "localhost:3333" in web browser.
Warning: use negative option value or disable remote management entirely if you think that you can be attacked via this port!
By default, miner will accept connections on specified port on all network adapters, but you can select desired network interface directly, for example, "-mport 127.0.0.1:3333" opens port on localhost only.