Comment prévenir et se remettre des virus ASIC et des attaques à distance

How to Detect an ASIC Virus?

First of all, you need to know how to detect the ASIC virus. If you don’t, you may find yourself complaining about tons of capacity being stolen. Let’s say you have a specific address for your mining rewards. A hacker can bypass this address through malware, resulting in expense for you and profit for the hacker. The point is, with the cryptocurrency hype, these types of viruses were brought to the surface. The most significant year that marked the heyday of ASIC viruses was 2018. This is where hidden malware increased by over 4000%. The following year, malware evolved and spread to different devices.

When you know the history of these viruses and how hackers modified them, it is easier for you to determine whether your ASIC has been infected or not. In addition, hackers are more and more innovative. As a result, it is more difficult for you to stay up to date with their changes. In addition, you should never assume that you are 100% protected against vulnerabilities in your system.

A good way to spot infections is to have a honeypot or a good firewall in place. Most infections caused by ASICs try to spread from machine to machine. So you should see this activity on your network. There are also more and more tools that allow you to monitor your machines and alert you if an infection is detected. In addition, a few manufacturers are also catching up with this reality and are offering more and more tools to scan, detect and eliminate infections on your machines.

How the virus infects an ASIC

The virus is quite old, previously, it affected Antminer S9/T9/L3 and similar models. The virus has since been updated, so now it also infects Antminer 15 and Antminer 17 series. Most ASIC virus hits all Antminer models through SSH and the ASIC web interface, using a tar vulnerability or lack of signature verification. When HTTP is detected, the virus uses the tar vulnerability to flash ASICs. If there is no signature protection, it just goes through the ASIC firmware script. New viruses are regularly created and constantly modified by hackers.

Malware is becoming harder to detect and more dangerous every day. Sometimes ASICs can get infected soon after purchasing them from China. The malware is often installed on models already in use to resell them and further steal hashrate. But more often than not, users will jump in on the bait to speed up performance and profitability and download a virus firmware on their own.

How to Prevent ASIC Viruses

You’ve heard the saying « prevention is better than cure » more often than you can count. But the truth is, cryptojacking is a growing term in the cryptocurrency world. There is no denying that ASIC viruses pose a serious threat to your mining revenues. If they infect your organization, they threaten your entire business. You must remain vigilant at all times. Since phishing is the main method used by hackers to distribute this type of malware, it is important to take proper training as a preventive measure. But that might not be enough, as you can still have a hard time figuring out which websites you shouldn’t go to. That is why you should follow these 4 useful tips to effectively prevent hackers from taking over your applications and your computer.

1. Set up a firewall

The best way to prevent at least one infected machine from attacking your entire network, and therefore all of your mining equipment and ASICs, is to set up a good firewall with strict networking rules. For example, it might be a good idea to create traffic rules that prevent ASICs from communicating with other ASICs on the network and to whitelist connections strictly to the pool you are dealing with and your monitoring software.

2. Use endpoint protection

It is essential to treat the computer you work on in the mine as critical as the machines you are trying to protect. Infections will come from the weakest links, so make sure they are well protected. Nowadays, anti-virus and terminal software vendors have added tools capable of detecting crypto-mining malware to their products. But, it is important to find a vendor who is constantly updating their software. The point is, on the other end of the spectrum, you have hackers who are constantly modifying the script to avoid being detected by your endpoint software.

3. Use monitoring tools

It would be best if you used monitoring tools to see the status of your machines at all times. For example, you can see if an infection changes the username used for your mining operation or if it completely changes the pool and wallet. Most mining monitoring tools now allow you to include automated notifications, so you can really customize your needs and potentially send yourself an email or SMS alerts as soon as an anomaly is detected, saving you a lot of waste in case of infection.

4. Consider optimized firmware

More and more firmware includes virus detection, even in the ASIC firmware itself. Some firmware like BraiinOS+ will also include the StratumV2 protocol, which turns out to be a huge improvement over its predecessor, StratumV1. In particular, the traffic is now encrypted, preventing a MITM attack where your hashrate could be hijacked outside your network. A good suite of tools with the right technologies will go a long way in your cyber hygiene at your mine.

How to Cure an Infected ASIC

In some cases, with ASIC viruses, it is enough to reset the IP address and immediately install the official firmware to get rid of the malware completely. However, as we know, any virus spreads very quickly to all devices. If you are using dozens or hundreds of ASICs, it will be difficult to quickly disconnect them from the network and reflash them one by one. In this case, you might want to look at firmware that has anti-virus capabilities. Built-in antivirus, checking and recognizing the presence of malware. If the device is clean, you can revert to your original firmware or continue to use the modded version. In some cases, you will have to use specific tools to remove certain infections, as is the case with hAnt, for example, where you will have to use Bitmain’s APminerTool to clean the machine.

In summary, it is important to know effective ways to detect, prevent, and cure ASIC viruses. This should help you minimize any malware risk. Most importantly, it saves you money on any ransom demanded by hackers. Moreover, it saves the profits that you can lose when your system is hacked. While not all measures are foolproof, and hackers are constantly changing their techniques, it is still essential that you prepare for any possibility of an attack. The last thing you want in your hands is a system that remains vulnerable to any kind of mining virus script that exists.