Quote from: comeonalready on March 23, 2014, 08:19:05 AM

Quote from: Zamboniman on March 23, 2014, 08:11:04 AM

Quote from: comeonalready on March 23, 2014, 08:05:46 AM

Quote from: Zamboniman on March 23, 2014, 08:03:30 AM

Quote from: comeonalready on March 23, 2014, 07:57:22 AM

Quote from: Zamboniman on March 23, 2014, 07:55:50 AM

Quote from: comeonalready on March 23, 2014, 07:51:28 AM

Quote from: Zamboniman on March 23, 2014, 07:43:03 AM

Quote from: utahjohn on March 23, 2014, 07:39:39 AM

Could be an infected source code for a miner or wallet which is compiled on each platform (windows, linux etc) ...

My rigs don't have wallets running on them.

Infected source code in all sgminer, cgmniner, bfgminer, and even Cudaminer? Code I've downloaded from github and compiled myself in each case?

Seems highly unlikely. Possible, but very unlikely.

You seem to have a good sampling of configurations, so it seems like agood place to start. Do you they all run on the same local area network? If so, are they using private ip addresses with your router running network address transalation? Are they dynamically assigned or manually entered into the configuration of each mining computer?

Yes, all running on the same local network. Some are using static IP's and some dynamically assigned IP's via DHCP from the router, which is running proprietary software from the router manufacturer, though some of the rigs are bridged to the router via another router running open source dd-wrt. Quite a few different variables here. All are using Google's DNS, 8.8.8.8 and 8.8.4.4.

Many nat routers run a dns forwarding service on them. If your internet service provider assigns your public ip address via dhcp, and you assign private ip address internally via dhcp, some routers will configure the dns server for those computers to the internal ip address of the router which will forward requests onto the router's configured dns server.

If you check your ip configuration on one or more of the mining computers, does it/they point to the internal router ip address in the dns server field, or directly to an external dns server? (I ask this an many nat routers running dns forwarding service are more vulnerable to attacks than internet dns servers are.) This is a real long shot, but as it only takes a minute or to check, worth a look.

This is a good question.

Most of the rigs are configured to use 8.8.8.8 and 8.8.4.4. Two of them I obviously didn't change when I set them up and they are pointing to the router, which is configured to use 8.8.8.8 and 8.8.4.4.

All were affected equally.

If all were miners affected equally, and not just the miners using the router ip address for dns servers, then I think we can rule out the dns forwarding/masquerading service on your router from having been compromised. Thanks for checking. I hate to have to ask, but are you absolutely 100% certain?

I am certain of some using direct DNS and some pointing to the router. I am certain some are using DHCP and some are static IP's. I am certain one router (connected to the external internet) is running proprietary Dlink software and the other bridged router is running dd-wrt. I set all of this up myself.

This does not entirely rule out some very clever hack on the router side of things, or injected in multiple miner's source codes. It just seems rather unlikely to me at this point.

As many of us as possible need to enable verbose logging to file for when this happens again. And it will almost certainly happen again, as there is money to be made by attackers exploiting whatever weakness allowed them to do so this time around. I have had logging enabled since the very beginning, but none of my equipment was affected by this problem. I did notice a few atypical packets logged on my firewall making me suspect that a local router attack could be part of the redirect to a rogue server, which is why I asked you about yours, as you actually witnessed the redirection of your hashpower.

Agreed.

I've been awaiting a reoccurence all day. Nothing so far, at all. If it's local I'm betting it's the d-link router software, as it's connected to the external internet. But my money is leaning a bit towards not local. Not enough though for me to be completely convinced. Too many unknowns at this point.