Bitmain Can Remotely Shut Down Your Antminer (and Everyone Else’s)

Major Bitcoin mining hardware producer Bitmain can remotely shut down almost all active Antminer machines. Dubbed the “Antbleed” backdoor, abuse of the vulnerability could probably knock half of all hash power on the Bitcoin network offline, with little more than the press of a button.“Even if Bitmain had no bad intent, this is a gaping security hole,” said our source, who discovered the backdoor but asked to remain anonymous.The backdoor code can be seen on Pastebin and on GitHub, and today a website has been put up for Antbleed as well.How It WorksThe Antbleed backdoor is “stupid simple,” as our source described it.Whenever an Antminer appears online, and once every one to eleven minutes, it contacts a “port 7000 service” on the domain auth.minerlink.com, which is owned by Bitmain. The domain currently does not connect to any IP-address, and therefore does nothing.However, the domain could in the (near) future start connecting to a corresponding IP-address. If that happens, it will report the Antminer’s serial number as well as the MAC address and the IP-address to Bitmain. This could be enough for the company to link the machine to a specific user.“Bitmain can use this data to cross check against customer sales and delivery records making it personally identifiable,” our source explained. “And Bitcoin mining is a small industry, so it shouldn’t even be hard to connect the machines to specific pools, or blocks.”Once connected, the server the Antminer connects to — Bitmain’s server — sends a message back. If that message is “true”, the machine will continue mining. But if that message is “false”, the code produces a piece of text that reads: “Stop mining!!!”It seems obvious that this piece of text would make the machine stop mining, which is indeed confirmed by our source. Additionally, it can be verified by anyone with an affected miner; antbleed.com explains how.All this can be verified, since the backdoor is embedded in open source code. In fact, it seems rather strange Bitmain would include such a backdoor “out in the open”, for anyone to see.Speaking to Bitcoin Magazine, Bitcoin Core developer Peter Todd, who was quick to comment to the issue on Twitter and Reddit, suggested:“Bitmain probably underestimated how much source code actually does get audited — it's a common myth that code never gets read. Also, if you're going to add a backdoor, you do want plausible deniability in case it does get found. Hiding in plain sight, amongst thousands of lines of undocumented code, helps. Perhaps Bitmain will claim this is actually a feature.”What It AffectsThe backdoor probably affects most Antminers in use today: the S9, the T9 the R4, as well as Litecoin’s L3.The commit date indicates the backdoor was introduced in July 2016. This is one month after the first S9 machines were shipped. All machines that shipped since July 2016 should have the backdoor on board, which means they can be shut down by Bitmain. Machines that were shipped before July 2016, but have been updated since, should be vulnerable, too.“It’s difficult to say with certainty how much hash power on the Bitcoin network is subject to the vulnerability,” our source said. “But since Bitmain is by far the market leader for hardware machines, it’s not a stretch to attribute at least half of all hash power to the vulnerable machines. As such, Bitmain could potentially shut down an enormous share of Bitcoin’s hash power with the push of a button. In addition to that, the company can target specific machines or customers.”And it’s not just Bitmain who could shut down the machines. Because the connection is unauthenticated, the code will connect to anything that appears like “auth.minerlink.com“, which can be spoofed by certain third parties. Apart from Bitmain, it could, for example, be an internet service provider, anti-DoS service CloudFlare (used by Bitmain), or anyone who can hijack DNS records: rogue ICANN employees, hackers, the U.S. government, and more.“The nicest possible explanation is that Bitmain is incompetent at security, putting the whole Bitcoin network at risk,” Todd concluded. “But given the history we have of miners threatening with attacks, it wouldn't surprise me if this was added as a last resort option for shutting down competitors if they needed to push something through with hashing power.”This story will be updated as more news becomes available.Bitcoin Magazine reached out to Bitmain for comments, but received no official response at time of publication. The identity of our source is known to us and considered to be reliable.The post Bitmain Can Remotely Shut Down Your Antminer (and Everyone Else’s) appeared first on Bitcoin Magazine.

from Bitcoin Magazine http://ift.tt/2q7zYgC
via IFTTT