Avalon Nano 3 [unofficial thread]

[wolverine5pl]

anyone had problems with unable to log in thru browser? tried power it off few times but no luck.
how to do factory reset?

[joker_josue]

they are low cost low effort dca and hodl miners.



If you point it to nicehash or viabtc you won’t get a payout until you get to 0.001 btc.

that is about 400 days.
when you get the payout it comes as a single tx which means you get free consolidation.

if you point to nice hash you can be no kyc.

if you make a clean address no-one knows who owns it.

your cost for all that is 130 for the unit and 400 days power which at medium is 1000 kwatts that is about 130 usd. for me

so 260 usd to get  0.001 anyonmous no kyc btc in 400 days

I like to think that is far more likely to be okay 👌 due to btc going up then me hitting a block in those 400 days.

It really is an appropriate way to do the math and see the advantages of this equipment.

We are talking about a year to get a return. And BTC is more likely to go up, than if it mines a block.

Is there a tutorial to configure NiceHash on these devices?

[wolverine5pl]

honestly no one having issue with unable to log back to webgui??

[whoismeanyway]

Hi there! Just ordered a second Nano. After I will add it to my app, will I use the same credentials for the pool to add it with the first?

[hawer357]

honestly no one having issue with unable to log back to webgui??

Honestly, the UI is crap. On my device, I chanced the login password and it never accepted it. It still is the default one. Many functions are broken on the UI. Showing always same Hash rate, no valid JSON response, etc. etc.

If I were you, I would try finding the old firmware and reflash the device. How about support from Canaan?

[brontolo10]

Hi,
  Now available PSU on Canaan Shop here

https://shop.canaan.io/products/adaptor-for-nano-us?VariantsId=10406

B10

[whoismeanyway]

honestly no one having issue with unable to log back to webgui??

try a different browser, also check if something running in the background blocks the page to get refreshed.Otherwise try a plugin to do that.

Also delete cache and history.

[jeyzeus]

honestly no one having issue with unable to log back to webgui??

I had an issue logging in via the web gui after my unit was hacked.

If you wanna reset your miner to default settings & password, then open the Avalon remote app and remote the miner.

Disconnect the miner.

Then power it back on and press the FUNC function key (before the indicator flashes red), for five seconds until the white light flashes to indicate success. Then press RESET or disconnect the power to restart. Then add back all of the network credentials via the app, then connect to the web gui.

You might need to a couple of factory resets for the login credentials to revert back too root/root

[jeyzeus]

To all the people that acted like it was "just me" here's the official word from Canaan:

We sincerely thank you for your feedback regarding the relevant security issues. Your feedback will help make the Avalon Nano 3 better and better. We apologize for the problem that occurred. Upon seeing your tweet, we immediately gathered our R&D Team to analyze and evaluate the relevant issues.

1. We discovered that the Nano's web backend had an issue where the login username and password were not verified. Malicious trojans in the local network could exploit this vulnerability to submit mining pool configuration information through a POST command to http://<yourIP>/get_home.cgi without logging in, thus stealing hash power. We have started developing the necessary firmware and expect to fix this vulnerability and release the new firmware by July 19.

2. The Nano's design purpose is relatively simple. It runs on a real-time operating system (FreeRTOS), which is not a complex professional network device and is only suitable for secure home intranets. We recommend enabling the router's firewall and not mapping the Nano host to a public IP address to prevent external hackers from directly accessing the Nano. It is also necessary to regularly check for malicious programs in the home network environment. In safe network environments without trojans, such as non-hotel or library public networks, the Nano is secure.

3. In the design of Nano, we respect users' privacy and will never set any backdoor programs. Canaan's products and services are always subject to local and international regulations regarding cybersecurity and data privacy. Canaan remains transparent by disclosing our source codes and encourages industry monitoring of potential vulnerabilities. We are committed to continually improving our products and services.

4. Starting in December, we will gradually open-source the relevant programs and release open-source firmware to ensure that all programs have better security and are compilable.

5. We appreciate every customer's understanding and support. The sales of Nano 3 have far exceeded our expectations, which is due to our customers' high expectations and recognition of us. We are very sorry for the issues that have arisen. Therefore, we will launch a compensation plan together with the release of the new firmware.

tl;dr they're releasing a new firmware for this within 1-2 weeks. after December, they plan on open sourcing the relevant firmware.

There's a vulnerability in the miner that can allow a trojan to override the the mining pool info without the proper credentials

[hawer357]

To all the people that acted like it was "just me" here's the official word from Canaan:

We sincerely thank you for your feedback regarding the relevant security issues. Your feedback will help make the Avalon Nano 3 better and better. We apologize for the problem that occurred. Upon seeing your tweet, we immediately gathered our R&D Team to analyze and evaluate the relevant issues.

1. We discovered that the Nano's web backend had an issue where the login username and password were not verified. Malicious trojans in the local network could exploit this vulnerability to submit mining pool configuration information through a POST command to http://<yourIP>/get_home.cgi without logging in, thus stealing hash power. We have started developing the necessary firmware and expect to fix this vulnerability and release the new firmware by July 19.

2. The Nano's design purpose is relatively simple. It runs on a real-time operating system (FreeRTOS), which is not a complex professional network device and is only suitable for secure home intranets. We recommend enabling the router's firewall and not mapping the Nano host to a public IP address to prevent external hackers from directly accessing the Nano. It is also necessary to regularly check for malicious programs in the home network environment. In safe network environments without trojans, such as non-hotel or library public networks, the Nano is secure.

3. In the design of Nano, we respect users' privacy and will never set any backdoor programs. Canaan's products and services are always subject to local and international regulations regarding cybersecurity and data privacy. Canaan remains transparent by disclosing our source codes and encourages industry monitoring of potential vulnerabilities. We are committed to continually improving our products and services.

4. Starting in December, we will gradually open-source the relevant programs and release open-source firmware to ensure that all programs have better security and are compilable.

5. We appreciate every customer's understanding and support. The sales of Nano 3 have far exceeded our expectations, which is due to our customers' high expectations and recognition of us. We are very sorry for the issues that have arisen. Therefore, we will launch a compensation plan together with the release of the new firmware.

tl;dr they're releasing a new firmware for this within 1-2 weeks. after December, they plan on open sourcing the relevant firmware.

There's a vulnerability in the miner that can allow a trojan to override the the mining pool info without the proper credentials

Thank you very much. Did this come via Indiegogo, do you have a link?

[joker_josue]

Thank you very much. Did this come via Indiegogo, do you have a link?

You can find it here: https://www.indiegogo.com/projects/avalon-nano-3-blockchain-smart-home#/

But, at this moment, I don't know if it's worth buying via indiegogo, since it's already possible to buy on the official website.

[hawer357]

Thank you very much. Did this come via Indiegogo, do you have a link?

You can find it here: https://www.indiegogo.com/projects/avalon-nano-3-blockchain-smart-home#/

But, at this moment, I don't know if it's worth buying via indiegogo, since it's already possible to buy on the official website.

I was actually surprised where the above info is coming from. I already have an Avalon Nano 3, I wouldn't buy an other one, but I wasn't able to find the info you quoted  above.

[CanaanInc.]

We sincerely thank you for your feedback regarding the relevant security issues. Your feedback will help make the Avalon Nano 3 better and better. We apologize for the problem that occurred. Upon seeing your tweet, we immediately gathered our R&D Team to analyze and evaluate the relevant issues.

1. We discovered that the Nano's web backend had an issue where the login username and password were not verified. Malicious trojans in the local network could exploit this vulnerability to submit mining pool configuration information through a POST command to http://<yourIP>/get_home.cgi without logging in, thus stealing hash power. We have started developing the necessary firmware and expect to fix this vulnerability and release the new firmware by July 19.

2. The Nano's design purpose is relatively simple. It runs on a real-time operating system (FreeRTOS), which is not a complex professional network device and is only suitable for secure home intranets. We recommend enabling the router's firewall and not mapping the Nano host to a public IP address to prevent external hackers from directly accessing the Nano. It is also necessary to regularly check for malicious programs in the home network environment. In safe network environments without trojans, such as non-hotel or library public networks, the Nano is secure.

3. In the design of Nano, we respect users' privacy and will never set any backdoor programs. Canaan's products and services are always subject to local and international regulations regarding cybersecurity and data privacy. Canaan remains transparent by disclosing our source codes and encourages industry monitoring of potential vulnerabilities. We are committed to continually improving our products and services.

4. Starting in December, we will gradually open-source the relevant programs and release open-source firmware to ensure that all programs have better security and are compilable.

5. We appreciate every customer's understanding and support. The sales of Nano 3 have far exceeded our expectations, which is due to our customers' high expectations and recognition of us. We are very sorry for the issues that have arisen. Therefore, we will launch a compensation plan together with the release of the new firmware.

Please join our official telegram group https://t.me/Canaanio

There is probably a backdoor in the firmware. An attacker can change the custom root password (no, it's not root in my case, it's a complex one) or there is a manufacturer password.  Stay behind your firewall and do not open any ports to the outside.

Furthermore, the current firmware file 2024032701_110811(Download at Canaan offical) https://www.canaan.io/tmp/file/heaternano3slaverk2102024032701110811-61ee.zip does not make any visible changes and worse, does not change the firmware version in the API or the web backend.

http://<yourIP>/get_home.cgi

API data can be accessed without a password. For example, the Wifi SSID, the mining address, firmware, temperature, pool and so on.
My pool address changed several times. Always directed to https://web.public-pool.io/#/ with changing receiving addresses, but with my own worker name (after the .)

Be careful.

However, one thing is quite funny: the hacker or bot relies on solo mining. Not a good source of income.  

[brontolo10]

Welcome here Canaan !!!

B10

[CoinMLS]

The power supplies are now available on the Canaan website. Unfortunately the shipping to the US makes them pretty pricey unless you're ordering multiples.