Author Topic: [ANN] WeMineLTC Important News  (Read 11669 times)

Offline WeMineLTC

  • Donator
  • Jr. Member
  • ***
  • Posts: 155
    • WeMineLTC
[ANN] WeMineLTC Important News
« on: May 29, 2013, 12:43:20 AM »
Things are getting back to normal on our pool.   The recent rumors of supposed problems on the Litecoin network we believe were actually multiple clever attacks on pool servers, there was no instability in the Litecoin network itself.  Thanks to help from the Litecoin core devs, especially pooler of litecoinpool.org, we have found and fixed a share verification vulnerability in the pool server stratum implementation.   

The affected code is found here:
 
Code: [Select]
def diff_to_target(self, difficulty):
       '''Converts difficulty to target'''
       diff1 = 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff0000
       return diff1 / difficulty
https://github.com/viperaus/stratum-mining/blob/master/lib/template_registry.py#L145
We don’t use this specific build but we had similar code for this part of the template_registry code.

We found new users as of a few days ago that had been using this exploit to cheat the pool and to steal coins from the legitimate miners.  We have taken appropriate steps to stop this from happening again.  We are attempting to inform all Litecoin pools of the exploit as we believe many pools who work off the same base code may be affected.  Suspected fake miners were clocking at up to150MH/s for 3-4 days. We suspect more cheaters were involved over the past 3-4 days which could have been at least partially to blame for the pools bad luck.

During deployment of the fix, we logged changes in valid hash rates.  The biggest detected confirmed cheater was Cryptopower who went from 30MH/s to 1MH/s (someone who also tried to bash our pool in forums), the payout address for this account is LYVLrqSQyrDYN1QqQz2icbsF1rbihSAEmK - they stopped mining altogether about 3 hours after all their shares were being rejected.  There are other accounts who we suspect may have been cheating, but without knowing for 100% sure, it would be dangerous and unfair to publish their information in case they are actually innocent.  We are continuing to analyze the logs to identify accounts that may have been involved.

If we get more info we will post in the news asap.  You will notice things have gone back to normal after sorting this out.

EDIT: if other pool ops have questions about this attack you can pm us on site.\

EDIT2: Since we havent had time to send a pull request to that fork, the fix for those who we have not given it to is:

Code: [Select]
diff1 = 0x0000ffff00000000000000000000000000000000000000000000000000000000
« Last Edit: May 30, 2013, 11:49:32 AM by WeMineLTC »
[PPLNS] [POOL] www.wemineltc.com [STRATUM] [Donation Only] [VARDIFF]

Offline warren

  • Litecoin Dev Team
  • Sr. Member
  • **
  • Posts: 714
  • Linux Software Engineer
Re: [ANN] WeMineLTC Important News
« Reply #1 on: May 29, 2013, 12:56:56 AM »
The Litecoin Devs note in this unfortunate situation that pool operator has been honest.  Two days ago they were the first pool to donate to the Fundraiser, with no expectation of help from us.  I became concerned though when I heard of their pool's recent trouble.  I suggested looking at GBT latency and for orphans, and that wasn't the problem.  I strongly suspected there was a clever new attack on stratum protocol servers, but I personally lack experience with that code.

Last night pooler, a member of the Litecoin Dev Team and owner of the competing litecoinpool.org helped this pool to diagnose the actual cause of these recent troubles.  Code of a common stratum implementation on github turned out to be bad, allowing a modified miner to submit fake shares.  This attack on a PPLNS pool steals money from the real miners.  It is fortunate that this pool was not PPS or they would have easily gone bankrupt.

It is unfortunate for the real miners who were defrauded.  The only good thing that came out of this is all pools can fix this vulnerability.

Note: Pools are the responsibility of pool operators.  Litecoin Dev Team does not publish pool software.
« Last Edit: May 29, 2013, 01:47:58 AM by warren »
If you appreciate our work, please support the Litecoin Development Team with a small contribution.
Follow the latest dev news on Litecoin Project Google+
GPG: AEC1884398647C47413C1C3FB1179EB7347DC10D

Offline Jacob32123

  • Newbie
  • *
  • Posts: 1
Re: [ANN] WeMineLTC Important News
« Reply #2 on: May 29, 2013, 01:15:54 AM »
Thanks to everyone who worked on this.

Offline linuxmonkey

  • Grave Digger
  • Newbie
  • *
  • Posts: 1
Re: [ANN] WeMineLTC Important News
« Reply #3 on: May 29, 2013, 01:25:30 AM »
I must say I feel proud to be a part of the team which makes up WeMineLTC :)

The coder is awesome and as soon as a problem was detected we were working hard to solve it. A few of us flamed us out on reddit and hope that you realize not to jump the gun next time.

Edit: Feel free to PM me if your pool needs the fix :)
« Last Edit: May 29, 2013, 03:15:11 AM by linuxmonkey »

Offline WeMineLTC

  • Donator
  • Jr. Member
  • ***
  • Posts: 155
    • WeMineLTC
Re: [ANN] WeMineLTC Important News
« Reply #4 on: May 29, 2013, 02:20:05 AM »
I must say I feel proud to be a part of the team which makes up WeMineLTC :)

The coder is awesome and as soon as a problem was detected we were working hard to solve it. A few of us flamed us out on reddit and hope that you realize not to jump the gun next time.

Thanks guys, we have helped 5 pools with this issue so far.  We hope to get all of them fixed ASAP to screw these scammers.
[PPLNS] [POOL] www.wemineltc.com [STRATUM] [Donation Only] [VARDIFF]

Offline Litecoin_Messiah

  • Jr. Member
  • **
  • Posts: 25
Re: [ANN] WeMineLTC Important News
« Reply #5 on: May 29, 2013, 02:48:51 AM »
Just fixed my pool too, thanks.

Offline WeMineLTC

  • Donator
  • Jr. Member
  • ***
  • Posts: 155
    • WeMineLTC
Re: [ANN] WeMineLTC Important News
« Reply #6 on: May 29, 2013, 03:07:27 AM »
your welcome m8, happy to help.  we need to stop these thieves in their tracks.
[PPLNS] [POOL] www.wemineltc.com [STRATUM] [Donation Only] [VARDIFF]

Offline SpyderRoll

  • Newbie
  • *
  • Posts: 8
Re: [ANN] WeMineLTC Important News
« Reply #7 on: May 29, 2013, 08:19:32 AM »
I'll give you guys the benefit of the doubt. You guys have been top notch -- appreciate the contribution to the pools and mining community.

Offline feeleep

  • Newbie
  • *
  • Posts: 9
Re: [ANN] WeMineLTC Important News
« Reply #8 on: May 29, 2013, 08:20:54 AM »
your welcome m8, happy to help.  we need to stop these thieves in their tracks.

Thanks guys - fixed my pools as well

Offline thisway

  • Newbie
  • *
  • Posts: 17
Re: [ANN] WeMineLTC Important News
« Reply #9 on: May 29, 2013, 09:09:26 AM »
Thank you guys for informing us.
It would be great if you could tell us how to fix the issue. I would really appreciate it.
New Litecoin Mining Pool
Visit our topic PPLNS LTC Mining Pool | 0% Fee! - Coinat.com

Offline nogten

  • Newbie
  • *
  • Posts: 7
Re: [ANN] WeMineLTC Important News
« Reply #10 on: May 29, 2013, 01:50:36 PM »
Im happy to report that I stuck with WeMineLTC, bravely mining away through the storm and even upgrading to 2 7950s...

actually I stayed here because I had no idea this was going on...:-D

still, it looks like you guys are on the ball and I will be sticking around with my dedicated rig (I need to look up PPLNS dont even know what that means. Im kind of suprised I havent burned my apartment down yet, to be honest...)

Offline Neozonz

  • Donator
  • Jr. Member
  • ***
  • Posts: 77
    • www.mine-litecoin.com
Re: [ANN] WeMineLTC Important News
« Reply #11 on: May 29, 2013, 02:09:02 PM »
Thank you Pooer & WeMineLTC
Litecoin Pool: mine-litecoin.com No Fees. No Transaction Costs. No Nonsense.


Offline shyliar

  • Full Member
  • ***
  • Posts: 385
Re: [ANN] WeMineLTC Important News
« Reply #12 on: May 29, 2013, 02:18:03 PM »
I suspect this has been going on for sometime. I abandoned several pools because it was evident that payouts were not what they should be.
Please support the Litecoin Dev team here https://litecointalk.org/index.php/topic,3874.0.html

Offline emma

  • Scammer
  • Full Member
  • ************
  • Posts: 401
Re: [ANN] WeMineLTC Important News
« Reply #13 on: May 29, 2013, 02:20:49 PM »
Can you please post the fix somewhere ?
or post a guide here.

Offline nearmiss

  • Newbie
  • *
  • Posts: 1
Re: [ANN] WeMineLTC Important News
« Reply #14 on: May 29, 2013, 04:30:18 PM »
Can you please post the fix somewhere ?
or post a guide here.

+1  Please share some details (sent pm awhile ago as well).  Appreciate the effort! I use wemineltc whenever I fall back to mining ltc.