Quote from: parshuram on July 01, 2017, 12:59:58 AM

MINING ON ETHOS

SETTINGS ON REMOTE CONFIG - DIGITAL OCEAN.

SO ALL THE SETTINGS OF POOL AND WALLET ARE SAVED IN ONE CONFIG FILE ON OCEAN AND EVERY RIG TAKES UP THAT SETTING.

NOW AT NIGHT MOSTLY BETWEEN 1-4 AM . SOMEONE USED TO ACCESS THE DROPLET AND CHANGE THE WALLET ADDRESS TO HIS OWN AND POOL TO EUROPE SERVERS AT ETHERMINE.ORG. BUT SOMEHOW THE RIGS NEVER MINED AND SHOWED 0 HASHRATE . AND CHANGING IT TO OLD CONFIG FILES AGAIN AFTER 4 AM AROUND

AS WE WERE MONITORING THE POOL ONLY, SO WE CONSULTED MANY PEOPLE THAT RIGS ARE MINING BUT ARE NOT SHOWING UP IN THE POOL. BUT OBVIOUSLY NO ONE AGREED.

SO TODAY HE CHANGED THE SERVERS TO INDIAN SERVER NEAREST TO OUR RIGS AND THEY MINED LIKE 4-5 MINUTES. I BECAME AWARE OF THE ISSUE AND CHECKED HIS WALLET ADDRESS ALL MACHINES WERE ONLINE.

BUT AS SOON AS I SHUT DOWN THE RIGS HE CHANGED THE CONFIG FILES TO ORIGINAL SETTINGS.

HERE IS THE WALLET ADDRESS : https://ethermine.org/miners/85b4203fff14f350b388f8d6f9b082ed184d4b69

AND WHY IN HIS WALLET ADDRESS, ONLY WHEN THE WORKERS ARE ACTIVE THEN ONLY WE CAN SEE THEM OTHERWISE THEY ARE REMOVED FROM POOL AT THAT TIME ONLY. USUALLY INACTIVE WORKERS STAYS ON THE POOL FOR A DAY AT LEAST.

TRIED CHANGING DIGITAL OCEAN PASSWORD TWICE.

DOES ANY ONE KNOWS THIS ? ANYONE EVER BEEN ATTACKED THE SAME WAY PREVIOUSLY ?

HERE ARE SOME SCREENSHOTS OF TODAY, YOU CAN CHECK OUT THE TIMINGS AT THE TOP LEFT FOR MORE CLARITY -

http://imgur.com/a/nvaMB - THESE TWO WHEN EVERY RIG WAS MINING AT HIS ADDRESS AT 2:52AM

http://imgur.com/a/wRHxN - THIS ONE OF THE MORNING AT 6:13 AM

KINDLY HELP AND GUIDE.

THANKS .

Now, do you use SSH or another method to access the cloud, that might be the point of hacking also. Lastly, without more info it is hard to say what you should do, but there is a site called miningrigrental.com and you can rent out your mining rig by pointing it at that site...blah, blah. We used to use the site because you can point the site at your mining sites so that when it is not being rented it is mining for you and with multiple rigs it is easier to change those settings online than using SSH or another method like that. Just a thought for an added line of security.