Are you sure you are still connected to CleverMining? There are a lot of hijack attacks going on lately.

That was my first thought also, that either the API or the API manager was breeched.
- open port for the API, API web management with weak or no password, etc

I have no open ports for API, or Web Management. I use PFSense for my router/firewall. I have a dedicated laptop with fresh install of Win 7 with Logmein, then SSH onto the Rigs from that point.

This is quite puzzling.

Particularly because of how there have been reports from pretty much all multipools (which are the most likely targets, or rather the most likely to report it due to having the majority of all scrypt miners).

I'm not buying the idea the stratums themselves are compromised at least. Especially on multipools the stratum servers are quite custom. It's unlikely all of these have a common attack vector.

Has anyone reported having this issue using a miner that is not based/derived from cgminer? Like a cudaminer user?


But yes, looks like we're going to need some packet logs from before through after a switch occurred.


On a serious note though, we'll hit a shut-off point for GPU users in countries with high electricity costs soon.
These users might actually do well in selling off their GPUs to recoup some of the investment.

Those who have gridseed units (and didn't pay stupidly much for it) will be able to survive a much larger profitability drop before reaching a point where they have to shut down.
As long as they bring in more than they cost in electricity (which is really low for these units), they'll keep running.
Of course the owner might not see ROI if profitability keeps dropping, but that still won't cause the owner to shut down the unit. At most they'll sell the unit and it'll keep on chugging for a new owner.

Nutshell: Total scrypt hashrate is going to keep climbing for a while.

I would hope serious miners calculated their electricity costs and don't let themselves caught off guard like that

This is the version I am using.  So far so good.  I did have cgminer hang twice on one rig in the last few days, once where GPUs went idle, and another when they kept running submitting 100% rejects to CM.  I think those instances were unrelated though.

Is there a main thread to discuss this specific issue anywhere?

Your pool operator Terk seems to have an excellent grasp of what is going on in this hashpower theft attack.  

If I could add a point or two, if the mitm attack is a dns hijack, in #2 above, if a server host name is configured in miner client, and that server host name is still contained with the operating system's cache of host name to ip address mappings, then the miner should connect back to the legitimate server when a stratum connection breaks.  However, if the cache entry has already expired, then the server host name would need to be resolved again and possibly receive an illegitimate ip address in return.

So in the very short term in order to minimize your attack surface, you could disable external host name to ip address resolution, by hard coding a server ip address into the miner configuration, or by creating a static host name to ip address mapping in your operating system's version of a hosts file.  Either of these attack mitigations must be accompanied by disabling client.reconnect messages in your miner software (for now), in case the mitm attack is affecting more than just dns resolution.

In #3 above, the hashpower thieves are likely using client.reconnect to capture your miners at an illegitimate server if they are unable to steadily maintain the mitm attack.  For without it, you miner would just connect back to the legitimate server if that hijacked stratum connection were to break.

Terk, if you have a minute, I would really like to get your perspective as a pool operator on this stratum mining protocol enhancement suggestion.  Thanks.
https://bt.irlbtc.com/view/433634.msg5867183#msg5867183

My point is not about ROI about rather about running cost.
These gridseeds have a very low cost to keep running, which means they'll continue to account for a large amount of the network for scrypt coins, even while profitability continues to drop.

And yes, my point is GPUs will either shut down or switch, thus leaving ASICs as only viable scrypt miners.
While ROI is relevant for the purchase of new units, it is not for the large amount of existing units already out there.
Existing units will keep running until the profit drops below the cost of running them.

But I already addressed all of that in my earlier post.

From what I read recently, 10 gridseed units, each of which contains 5 gridseed chips, are capable of scrypt hashing at 3 - 3.4MH/s at a total power consumption of 100 watts, or 10 watts per gridseed unit, presumably plus whatever it costs to run the device to which they are connected (computer, special purpose controller, whatever).

That comes to just about 35ish watts per 1MH/s, which is a lot less than the 150 watts per 1MH/s figure you suggest for a future generation asic device.  And the gridseeds are available and running now.  This compared to GPUs which consume a bare minimum of approximately 250 watts per 1MH/s at present?