Disappeared Coins: Steal Hashrate in Stratum Secretly
summary
Two novel MITM schemes reliably steal miner hashrate from Stratum v1: a stealthy set_extranonce job-injection proxy that intercepts subscription/authorize messages, resets extranonce fields, and forwards shares to a malicious pool (tested against btc.com backend with a proxy, mining rigs using three GPUs; malicious pool accepts injected shares after about 10 normal submissions), and a simpler time-segment method that hijacks TCP, alternates connections every N minutes, and works broadly but incurs reconnect overhead and obvious traffic patterns.
AI-written summary · about
chapters (6)
related talks
34mHashrate and privacy
21mRise of Coinminers
26mSecurity and Attacks on Decentralized Mining Pools
40mTrick or treat?
36mMining Botnets Reemerge, Bringing Shifts into the Threat Landscape
29mSecurity of Cryptocurrency wallets/mining
54mWhen Good Turns Evil: Using Intel SGX to Stealthily Steal Bitcoins
22mBitcoin Mining Firmware and Stratum v2