[4+ EH] Slush Pool (slushpool.com); Overt AsicBoost; World First Mining Pool

[slush]

apparently, if you don't hold it you don't own it is true for servers as well

That's the point. Next time I'll be the only person who'll have a physical access to the machine. No f***ing web consoles, email recovery features and no 3rd party administrators next time. I'm really tired by these situations and incompetent people who are harming my own reputation.

[zif33rs]

Uhhh..hate to be that tinfoil hat guy..but..Slush..anyway to confirm this is...uh..you?  With a hacking involved all sorts of rumors are going to pop up. I would instigate damage control asap.

[gbx]

What about the user database?  Was it compromised?  I'd hate to see bitcoins sent to the wrong address.

[Lucko]

What about the user database?  Was it compromised?  I'd hate to see bitcoins sent to the wrong address.

Good point but I'm afraid about password. But I guess that even if it was stolen it is irreversibly coded right?

[jerethdaminer]

so pool got hacked? what was comprimised

[slush]

What about the user database?  Was it compromised?  I'd hate to see bitcoins sent to the wrong address.

I have a database snapshot taken before bad guys overtook the database. So there's no reason to think payout addresses have been modified. Any change of wallet on pool profile requires email confirmation by account owner so I think we're on safe side here.

Unfortunately the user database can be considered as compromised, so the attacker knows user's emails :-(.

[slush]

Stratum servers have been migrated to (not-compromised) EC2 backends, I just see few first connections. So mining continues and no action is required by you.

I'll set up database and website in few hours on trusted machines, so the pool will be in normal operation soon.

[VacantPaper]

I lost some amount of bitcoins, but I'll be able to recover it from my pocket.

I want to say thank you Slush, you really put a lot of effort in to this and we all appreciate it so much. If there is anything we can do please let us know

[PuertoLibre]

What about the user database?  Was it compromised?  I'd hate to see bitcoins sent to the wrong address.

I have a database snapshot taken before bad guys overtook the database. So there's no reason to think payout addresses have been modified. Any change of wallet on pool profile requires email confirmation by account owner so I think we're on safe side here.

Unfortunately the user database can be considered as compromised, so the attacker knows user's emails :-(.

Should we consider our passwords compromised?

[Miz4r]

So is it safe to keep mining on Stratum now? I don't want my mining power working for the profit of some hacker..

[slush]

So is it safe to keep mining on Stratum now? I don't want my mining power working for the profit of some hacker..

Yes, stratum.bitcoin.cz is now pointed to Amazon EC2 instances, which are safe.

[TiborB]

So is it safe to keep mining on Stratum now? I don't want my mining power working for the profit of some hacker..

I just used netstat and reverse lookup to confirm where the existing stratum connections were going (they were still opened to ovh address 94.23.174.94 in my case).
Restarted workers where it was needed to make sure they connect to EC, 54.214.x.x.

Hope this helps.
   T

[aigeezer]

So is it safe to keep mining on Stratum now? I don't want my mining power working for the profit of some hacker..

Yes, stratum.bitcoin.cz is now pointed to Amazon EC2 instances, which are safe.

When I couldn't get stratum.bitcoin.cz to connect an hour or so ago I switched to stratum2.bitcoin.cz (remembering your advice from the DDoS attack) and it seems to have been mining normally. Is that OK for you?

[slush]

Yes, stratum.bitcoin.cz, stratum2.bitcoin.cz and stratum3.bitcoin.cz points to safe servers.

[irritant]

So is it safe to keep mining on Stratum now? I don't want my mining power working for the profit of some hacker..

I just used netstat and reverse lookup to confirm where the existing stratum connections were going (they were still opened to ovh address 94.23.174.94 in my case).
Restarted workers where it was needed to make sure they connect to EC, 54.214.x.x.

Hope this helps.
   T

same here, is work done at ovh address lost?

[slush]

No work is lost, but mining on Amazon is recommended. If you restart the miner using stratum.bitcoin.cz, you'll be switched there.

[DoomDumas]

seems v___.bitcoin.cz points to OVH...    minning on this adress since the DDoS !

IIRC, you own this work too, so things seems all fine !


The most important point I want to write :

Thank you so much Slush, You're the King of pool operators !   I'll always mine at your pool !

Thank you very much, you rule !

[Quantus]

I got two Questions.
 Are my Bitcoins safe and Do I need to change pools?

[DoomDumas]

1 - Your bitcoin in the Slush pool = no lost for you.
Slush have a nice system to keep most BTC offline, so if lost occurs, he will be able to refund from his pocket, as he stated earlier !

2 - No need to change pool : mining on stratum.bitcoin.cz is safe.

Imo, no problem at all.. Slush is fast to respond to emergency, professional and trustworthy pool operator who communicate with users.

Slush first post I know about it : https://bitcointalk.org/index.php?topic=1976.msg1925445#msg1925445
Other following Slush post confirm we are all fine mining there

[jerethdaminer]

but intruder has emails and information but would have to hack each email individually? hopefully to much effort anything we need to do to resecure any thing comprimised