Search content
Sort by
Showing 15 of 15 results by ghash.io
GHash.IO was vulnerable to this exploit, but it is already fixed. Thanks to everybody for cooperation.
Hi guys.
Read an article yesterday, and I think I know why some pools are so "unlucky".
In fact they're not unlucky, they're attacked through share multiplication issue. There is a vulnerability found in the majority of stratum mining protocol implementations. I've published the disclosure of this bug few weeks ago.
Vulnerability is caused by incorrect algorithm of verification for uniqueness. Instead of checking raw solutions, most of the pools are doing this through checking the hex-encoded representation. This allows miner to create multiple versions of the same share through applying uppercase function to hex encoded solution.
This vulnerability seems as intentionally made i.e. backdoor. Simplest workaround is to use lower() method:
As far I know, stratum-mining/eloipool/node-stratum-pool are vulnerable. Example of affected pools is ghash.io... Some pools like BtcGuild are not affected for unclear reason. Probably because they're using proprietary software.
Read an article yesterday, and I think I know why some pools are so "unlucky".
In fact they're not unlucky, they're attacked through share multiplication issue. There is a vulnerability found in the majority of stratum mining protocol implementations. I've published the disclosure of this bug few weeks ago.
Vulnerability is caused by incorrect algorithm of verification for uniqueness. Instead of checking raw solutions, most of the pools are doing this through checking the hex-encoded representation. This allows miner to create multiple versions of the same share through applying uppercase function to hex encoded solution.
Quote
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0ad31ee"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0ad31eE"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0ad31Ee"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0ad31EE"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0aD31ee"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0ad31eE"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0ad31Ee"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0ad31EE"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
{"id":102,"method":"mining.submit","params":["eobot.41355", "19", "5e490000", "552ce06a", "c0aD31ee"]}
{"id":103,"method":"mining.submit","params":["eobot.41355", "19", "5e440000", "552ce06e", "3b39f0a2"]}
This vulnerability seems as intentionally made i.e. backdoor. Simplest workaround is to use lower() method:
Code:
@@ -192,7 +192,12 @@ def submit_share(self, job_id, worker_name, session, extranonce1_bin, extranonce
# Check nonce
if len(nonce) != 8:
raise SubmitException("Incorrect size of nonce. Expected 8 chars")
+ # normalize the case to prevent duplication of valid shares by the client
+ ntime = ntime.lower()
+ nonce = nonce.lower()
+ extranonce2 = extranonce2.lower()
+
# Check for duplicated submit
# Check nonce
if len(nonce) != 8:
raise SubmitException("Incorrect size of nonce. Expected 8 chars")
+ # normalize the case to prevent duplication of valid shares by the client
+ ntime = ntime.lower()
+ nonce = nonce.lower()
+ extranonce2 = extranonce2.lower()
+
# Check for duplicated submit
As far I know, stratum-mining/eloipool/node-stratum-pool are vulnerable. Example of affected pools is ghash.io... Some pools like BtcGuild are not affected for unclear reason. Probably because they're using proprietary software.
If it is a pool that communicates with the general community it will usually refund the fees. BTCGuild's Eleuthria did that as well before on a large fee block.
GHash.io may very well refund the fees and we would never know - their communication with the mining community isn't the greatest.
Try making a ticket and see where that gets you
We have refunded genuine mistakes and they have been documented here on this forum https://bitcointalk.org/index.php?topic=602152.0
Hi there. I have started to testing ghash.io pool. I have started to mining with non-existsing worker, but I can't see my hashrate. Where is it?
Hi Dougless,
You must create a worker name and put that name into your miner software. On our support pages are various instructions depending on what software your miner is running.
https://support.cex.io/hc/en-us/categories/200118987#hardware-configuration
or
https://support.cex.io/hc/en-us/articles/201689623
Re: IS GHASH.IO Cheating Miners? Paying LESS THAN 50% of expected?
The outstanding issue regarding blocks 327321 and 317304 has been resolved and rewards distributed. Many thanks for your patience.
https://support.cex.io/hc/en-us/articles/203393233-25-August-2014-Missing-Block-Rewards
https://support.cex.io/hc/en-us/articles/203393233-25-August-2014-Missing-Block-Rewards
Re: IS GHASH.IO Cheating Miners? Paying LESS THAN 50% of expected?
Look at block 317304 and block 317321. According to blockchain.info it was solved by ghash.io, according to ghash.io they did not solve it so they aren't paying miners for it. Those are the only 2 out of the last 100 blocks as I only just checked because someone else noticed it first.
It could be just 2 blocks that they kept for themselves either because their software is broken (again) or because they needed an extra ~$25k for hookers and blow. I really dont know but it does make me want to dig deeper into which blocks they have paid on and which ones they should have paid on. If it is 2% of all blocks then there is a serious problem in not disclosing that to people, if they are going to charge a fee they need to declare it and not claim 0% pool fee.
Edit: ha! beat me to it
Edit 2: I am currently pulling blocks from blockchain.info associated with ghash.io to see what is going on. I will also look at what IPs were used to see if one is particularly bad about it or not. I am going to go back a couple hundred more blocks and if I dont see anything give up. Program is running now to do all this.
Edit 3: in the last 167 blocks solved by ghash/cex pool only those 2 did not get paid out. They still have not been at the time of this writing.
It could be just 2 blocks that they kept for themselves either because their software is broken (again) or because they needed an extra ~$25k for hookers and blow. I really dont know but it does make me want to dig deeper into which blocks they have paid on and which ones they should have paid on. If it is 2% of all blocks then there is a serious problem in not disclosing that to people, if they are going to charge a fee they need to declare it and not claim 0% pool fee.
Edit: ha! beat me to it
Edit 2: I am currently pulling blocks from blockchain.info associated with ghash.io to see what is going on. I will also look at what IPs were used to see if one is particularly bad about it or not. I am going to go back a couple hundred more blocks and if I dont see anything give up. Program is running now to do all this.
Edit 3: in the last 167 blocks solved by ghash/cex pool only those 2 did not get paid out. They still have not been at the time of this writing.
GHash.IO pays every found block to its miners, so your investigation regardless of the number of edits will not reveal anything other than that.
We are aware of a discrepancy relating to 2 recent blocks and have announced we are investigating such on our Official thread. https://bitcointalk.org/index.php?topic=627111.msg8522350#msg8522350
ghash is fee free yes but you have to withdraw via cex which has some of the highest fees around! cex are activly telling people to mine elsewhere because they are not making enough money from everyones hardware, they want people to buy their 'cloud mining' so they can such the life out of everyones money. i left cex/ghash due to their fees eating up over 75% of mined btc even though they claim they do not take that much. as time goes on there will be more and more block at cex that you will gain a -ve reward at the time i left it was about a 1 in 10 where it cost me to mine with cloud that equated to a loss more than 20% of the time. they are turning into a scam site!
Hi ozycash, your information is not quite accurate.
GHash.IO pool fee is zero, this is correct.
CEX withdrawal fee is 0.0001 BTC and zero if you use the auto feature. These are not very high!!
We are a multi-service company, some of our users are independent miners, some use the cloud mining service, some are traders and some are all 3.
Cloud mining maintenance is $0.18 per 1 GHS per month.
Today Aug 4th GHash.IO celebrates the date of it's first ever mined block (4th Aug 2013).
Since then we have hit many milestones. As of now close to 414,000 BTC has been mined on our pool.
We have created an info graphic of numbers and facts you might find interesting.
GHash.IO: From the first block to the #1 pool
http://blog.cex.io/ghash-io-from-the-first-block-to-the-1-pool/
Since then we have hit many milestones. As of now close to 414,000 BTC has been mined on our pool.
We have created an info graphic of numbers and facts you might find interesting.
GHash.IO: From the first block to the #1 pool
http://blog.cex.io/ghash-io-from-the-first-block-to-the-1-pool/
Re: IS GHASH.IO Cheating Miners? Paying LESS THAN 50% of expected?
issues with ghash?
anyone experiencing the same as well or am i totally wrong?
example.. 1 TH mining power i should be earning 0.02684 daily according to bitcoinwisdom with best conditions at current diff.
past 3-4 days or so i'm making less than 0.012 per th.
previously when ghash was mining every 3rd or 4th block i would get close to expectations -20% to -25%
1) is this acceptable?
2) if the total hash rate of ghash has dropped and my hashrate remains the same per block found, i should not have my overall earnings affected over time?
is my logic correct? where am i mistaken?
i have checked my miners and they are hashing at normal speed.
anyone experiencing the same as well or am i totally wrong?
example.. 1 TH mining power i should be earning 0.02684 daily according to bitcoinwisdom with best conditions at current diff.
past 3-4 days or so i'm making less than 0.012 per th.
previously when ghash was mining every 3rd or 4th block i would get close to expectations -20% to -25%
1) is this acceptable?
2) if the total hash rate of ghash has dropped and my hashrate remains the same per block found, i should not have my overall earnings affected over time?
is my logic correct? where am i mistaken?
i have checked my miners and they are hashing at normal speed.
DrG is correct, variance is what you are seeing. When you tally your daily returns also look at the number of blocks solved in that same period and track that. Then you will we the impact of longer block times from difficulty / luck issues.
Re: Quote of the day: They will not control us! We will be victorious!
So people even get scared from seeing a quote these days. 
It seems.
Now we have a new one. Quote of the day: You would never know, I would never show!
But just for the paranoid, it is just a beautiful song. https://www.youtube.com/watch?v=HptBdEw2xgY
Considering Bitcoin protocol operation and situation within the mining processes, GHash.IO, as the leading mining pool, would like to make a voluntary statement.
Based on the closed round table discussion, which took place on July 9th in London, GHash.IO states that it will not exceed more than 39.99% of the overall Bitcoin hashrate. If GHash.IO approaches the respective border, it will be actively asking miners to take their hardware away from GHash.IO and mine on other pools
None of the existing technical solutions against the 51% attack threat is able to solve the problem in a long-term perspective, taking into account interests of existing mining pools, individual miners and Bitcoin community. Thus, Bitcoin adherents should focus on temporary acts until the lifetime solution is found.
To make sure the respective solution appears in the nearest future, GHash.IO and CEX.IO are initiating a committee, which will consist of major Bitcoin market players, mining pools and other voluntary Bitcoin companies, with the purpose of accelerating and motivating developers to find a technical solution for the 51% threat by accumulating funds and directing them to this process. An original policy document, which describes operational processes of the committee, will be presented shortly. The committee will drive closer communication and cooperation between developers working on the Bitcoin protocol and solving the 51% issue, and businesses, highly interested in expanding the industry, and promote Bitcoin to a broader audience.
With this statement, we invite other mining pools to become more transparent to the community, issue similar statements from their sides and declare that they wont overcome 39.99% of the Bitcoin hashrate as well. We believe that mining pools should support the statement, since any of them can possibly take leading positions and appear on GHash.IO place.
We also do encourage Bitcoin market players to join the upcoming committee, assist in supporting Bitcoin developers, actively participate in the Bitcoin community, become ultimately transparent, join forces for developing Bitcoin and promote cryptocurrency to the world.
Our statement is available to view on our blog: http://blog.cex.io/official-statement-on-51-threat-and-closed-round-table/
A summary from the round table discussion can be viewed and downloaded here: http://www.scribd.com/doc/234153249/CoinSummit-Bitcoin-Meeting
Based on the closed round table discussion, which took place on July 9th in London, GHash.IO states that it will not exceed more than 39.99% of the overall Bitcoin hashrate. If GHash.IO approaches the respective border, it will be actively asking miners to take their hardware away from GHash.IO and mine on other pools
None of the existing technical solutions against the 51% attack threat is able to solve the problem in a long-term perspective, taking into account interests of existing mining pools, individual miners and Bitcoin community. Thus, Bitcoin adherents should focus on temporary acts until the lifetime solution is found.
To make sure the respective solution appears in the nearest future, GHash.IO and CEX.IO are initiating a committee, which will consist of major Bitcoin market players, mining pools and other voluntary Bitcoin companies, with the purpose of accelerating and motivating developers to find a technical solution for the 51% threat by accumulating funds and directing them to this process. An original policy document, which describes operational processes of the committee, will be presented shortly. The committee will drive closer communication and cooperation between developers working on the Bitcoin protocol and solving the 51% issue, and businesses, highly interested in expanding the industry, and promote Bitcoin to a broader audience.
With this statement, we invite other mining pools to become more transparent to the community, issue similar statements from their sides and declare that they wont overcome 39.99% of the Bitcoin hashrate as well. We believe that mining pools should support the statement, since any of them can possibly take leading positions and appear on GHash.IO place.
We also do encourage Bitcoin market players to join the upcoming committee, assist in supporting Bitcoin developers, actively participate in the Bitcoin community, become ultimately transparent, join forces for developing Bitcoin and promote cryptocurrency to the world.
Our statement is available to view on our blog: http://blog.cex.io/official-statement-on-51-threat-and-closed-round-table/
A summary from the round table discussion can be viewed and downloaded here: http://www.scribd.com/doc/234153249/CoinSummit-Bitcoin-Meeting
Question: Are your staff still messing with your wallet addresses & double spending against the Bitcoin network?
Thanks
The issue you refer to was thoroughly investigated and shared by us at the time, it related to people who are no longer involved with CEX.IO We are very aware of our security obligations and treat it with the highest priority.Thanks
Indeed, a very valid question. Can't see this thread lasting long
Edit: I also have a question:
Will you be completely ignoring every question from your users who post on this thread in the same way that CEX do on their "official" thread?
Ta
Our aim is to share important information regarding developments within CEX.IO and Ghash.IO to the wider community. Edit: I also have a question:
Will you be completely ignoring every question from your users who post on this thread in the same way that CEX do on their "official" thread?
Ta
We welcome interaction and will endeavour to communicate effectively.
I just wish they would add more coins that are more profitable to mine.
We are actively asking our users what coins they would like to see added. Do you have any in mind? We would welcome your thoughts.
We have recently added new coins to GHash.IO Multipool. Rdd, USDe, POT, ANC and MYR are now in the game. Happy mining!
https://ghash.io/MULTI
We are constantly tracking new coins. If you have any feature suggestions on certain cryptocurrencies, feel free to leave your feedback in comments. In case of high profitability, a coin will be added to GHash.IO Multipool.
Please, pay your attention that our Multipool supports only scrypt mining at the moment.
https://ghash.io/
INFORMATION
GHASH.IO is the #1 Crypto & Bitcoin Mining Pool, which allows mining Bitcoins with personal hardware or cloud-based mining power.
The latter is possible due to shared credentials between GHash.IO and CEX.IO Bitcoin Crypto Exchange. Apart from mining Bitcoins, GHash.IO holds a Multipool Pro, an advanced scrypt mining feature. With Multipool Pro, users are able to mine the most profitable altcoins at any given moment and even switch the rewards to Bitcoins or Litecoins automatically.
CONTACT
support@cex.io
webmaster@ghash.io - only for marketing issues
WEBSITE
Official site: https://ghash.io/
Multipool Pro: https://ghash.io/MULTI
CEX.IO site: https://cex.io
SOCIAL
Twitter - http://twitter.com/ghash_io
Facebook - http://facebook.com/ghash.io.pool
This is the official thread for GHash.IO Mining Pool at Bitcointalk.org.
INFORMATION
GHASH.IO is the #1 Crypto & Bitcoin Mining Pool, which allows mining Bitcoins with personal hardware or cloud-based mining power.
The latter is possible due to shared credentials between GHash.IO and CEX.IO Bitcoin Crypto Exchange. Apart from mining Bitcoins, GHash.IO holds a Multipool Pro, an advanced scrypt mining feature. With Multipool Pro, users are able to mine the most profitable altcoins at any given moment and even switch the rewards to Bitcoins or Litecoins automatically.
http://blog.cex.io/wp-content/uploads/2014/05/ghash-how-works.png
http://blog.cex.io/wp-content/uploads/2014/05/ghash-options.png
http://blog.cex.io/wp-content/uploads/2014/05/ghash-options.png
CONTACT
support@cex.io
webmaster@ghash.io - only for marketing issues
WEBSITE
Official site: https://ghash.io/
Multipool Pro: https://ghash.io/MULTI
CEX.IO site: https://cex.io
SOCIAL
Twitter - http://twitter.com/ghash_io
Facebook - http://facebook.com/ghash.io.pool
This is the official thread for GHash.IO Mining Pool at Bitcointalk.org.