Quote from: CryptoDocker on March 19, 2018, 12:38:54 AM

Quote from: astrosmurf on March 18, 2018, 01:01:23 PM

Quote from: cloudhax on March 18, 2018, 02:20:51 AM

Quote from: astrosmurf on March 17, 2018, 11:58:01 AM

Wow, a new record has ben set, I've been hacked after just 30 mins. or so this time, after starting from scrath with a new flashed OS on the memory stick and changing absolutely every password, RIG IDs, stats passwords - everything new except my IP adress. But I did whitelist my own IP adress range, which I assume means that every other IP adress should be blacklisted, so how I can still be hacked is beyond me. 2FA activated for HiveOS as well.

I've already wasted too much time attempting to make this work. It seems there must be some security flaw here as all the precautions above still isn't enough. I really wanted to make this work as I love everything else about HiveOS, but getting hacked pretty much every day is intolerable.

Bye bye HiveOS.

bye I guess? but I've been running this for months and never been "hacked". my guess is you have your rig wide open to the internet, or some machines on your network are compromised and are using that as a jumping point to get to your rigs. even if you had compromised machines, just change the ssh password and remove any existing ssh keys from ~/.ssh/authorized_keys. and if you have your rigs open to the internet you need to get them behind a router/firewall that is properly configured and secured

Thanks cloudhax!

Believe me, I'd much rather stay with HiveOS rather than change, but I'm tearing my hear out ATM and I'm running out of ideas.

I really appreciate your feedback and suggested solutions, so please allow me to follow up with some questions below:

"my guess is you have your rig wide open to the internet, or some machines on your network are compromised and are using that as a jumping point to get to your rigs."

Could very well be, I have both Mac OS X and Win10 machines on the same LAN/WAN, so I can't rule out what you suggest. All those machines appear to be running like normal (but I realize they could still be compromised), and all have fairly recent OS updates installed with what I assume must be recent security updates.

"even if you had compromised machines, just change the ssh password and remove any existing ssh keys from ~/.ssh/authorized_keys."

I haven't used SSH on any of my machines, at least to my knowledge. (I'm also a linux noob, so this is above my level of technical competence ATM. I have dabbled in Mc OS X terminal and been able to follow detailed instructions describing command line solutions for stubborn OS X problems, but that's about it.)My Mac's have eternal sharing turned off in their Control Panels, which I believe is Apple's GUI name for SSH. I don't know anything about SSH on my HiveOS rigs, as they have been running at default, and I haven't tampered with SSH at all.

"and if you have your rigs open to the internet you need to get them behind a router/firewall that is properly configured and secured".

My rigs are left just as open as my ISP's default router will allow. What goes on in that closed box really isn't documented at all, it's the property of my ISP which is a cable TV company. My rigs are left at HiveOS default settings as far as "open to the internet" applies. So I guess a hardware router/firewall solution could be the answer, but I'm hesitant to throw more money at this problem unless somebody else have had the same problem and can verify that such a solution really fixed it - in which case I'd love to hear more about it in detail, including vendor model, setup details etc.

Advance thanks! :-)

It doesn't really make sense getting hacked under 30 mins especially with 2FA turned on?

This might sound silly but are you sure its just not an incorrectly set up wallet or something? I know when I was first getting the hang of it and I messed up the wallet it wouldn't read it properly so would default to the ones that come preinstalled on the OS by the dev?

Make sure you delete all the wallets and just have the 1 wallet that you want to use and test that for a while

Thanks CryptoDocker;

Your suggestion isn't silly at all, it's easy to do basic oversights like that, and overcomplicate stuff when troubleshooting.

The main reason why I believe I was hacked was because not only the wallet, but the name of my entire rig, changed. You know when you first set up HiveOS and it appears like "worker" and lists your IP adress? After my rigs stopped mining to my account they would appear under different rig names than my own, always something like "mark3" or mark6". I don't think this would would be the case if its only a matter of the rig going back to the dev's default example mining account? But please correct me if I'm wrong.