Hive OS weird events

[tpd09]

Hello everyone - last night 2 of my 4 workers switched mining somehow to a different pool and wallet.

Had to delete the wallet.dat file and update my rig.conf files to get them back to my pools and wallets.

anyone had similar experiences?

[socks435]

I haven't experience the same thing. Maybe someone knows your password so change your password immediately. Or maybe you set it to auto switching pool.

[mak013]

Usually this is a user problem. Try to find how you can be hacked. Change passwords, check your main PC with different antivirus programs. I think HiveOS team have no necessity to steal your rigs.

[RabbiTANK]

I don't get it, you aren't supposed to get hacked or anything since you are running on a Linux build mining OS, the culprit can't be hiveOS, may be your email is compromised, try changing your email password and activate 2FA, I use 2FA with nicehash on my PC

[P00P135]

I don't get it, you aren't supposed to get hacked or anything since you are running on a Linux build mining OS, the culprit can't be hiveOS, may be your email is compromised, try changing your email password and activate 2FA, I use 2FA with nicehash on my PC

You log into a website to make changes to your mining wallets, pools, ect.. which can be hacked if you use stupid passwords or the same email passwords that have been compromised in the past.

[Claudio99]

I don't get it, you aren't supposed to get hacked or anything since you are running on a Linux build mining OS, the culprit can't be hiveOS, may be your email is compromised, try changing your email password and activate 2FA, I use 2FA with nicehash on my PC

You log into a website to make changes to your mining wallets, pools, ect.. which can be hacked if you use stupid passwords or the same email passwords that have been compromised in the past.

Exactly, it's why its a bad idea to use same password for every single website you create account on, information might get leaked, email can be compromised and hackers will start inserting that same password into every websites you've visited before

[tpd09]

The most weird thing is I did not get any notification on telegram for "new device login". - Should my account been compromised. Im sure hiveos guys have nothing to do with this.

[HaloGenius]

The most weird thing is I did not get any notification on telegram for "new device login". - Should my account been compromised. Im sure hiveos guys have nothing to do with this.

If your rig has a real IP address (direct connection) and you have not changed your SSH password than the attacker can SSHing into your rig (many bots constantly scan to get new victims) and change miner settings.
Generally, it's a bad idea mining on the rig with real IP ("white").

[tpd09]

thats what has been happening. they do it day after day at night.

so I need to white list my ip right? but if dynamic?

[tpd09]

for anyone facing the same issues with hacked rigs - refer to this:
https://hiveos.farm/guides-security/

[melpheos]

thats what has been happening. they do it day after day at night.

so I need to white list my ip right? but if dynamic?

How come your rig(s) have a public IP address directly attached to it
This is extremly rare for an ISP to provide such service.
You should check your box/firewall settings as it's probably a DMZ which is configured