Wonder who this solominer is? 88.6.216.9

[DeepBit]

But what if. Assume MM has root access to your server. Could you think of a way that would allow him to build blocks with shares from your miners, without causing anything weird in your logs?

Well, in theory nothing is impossible.

But in practice it should be extremely difficult, requiring access to many servers and correcting different DB records. Especially considering that during those days I was working hard updating my mining nodes, relayers, monitoring nodes and so on - the software versions and log modes were different all the time.

I would rather expect the most simple explanation :)

[1714466652]

1714466652

[1714466652]

1714466652

[1714466652]

1714466652

[deepceleron]

These guys just turned on a new IP. Either they just got real lucky in finding four of the last 10 blocks, or they have some significant horsepower. The block finding rate for blocks 321-331 was only 68% of difficulty. There is definitely weirdness afoot.


188.127.227.12

171328    2012-03-16 03:53:16    00000000000005c28ce323c9b359a18cd0f84745eb410db2f58359cb09632fff

85.214.124.168

171327    2012-03-16 03:24:26    0000000000000897f9422c236e74294a0c66d5bea681e4caae368e72917bdb74
171325    2012-03-16 02:52:40    000000000000051c3f0ba28aaf5f09ea044e52df538ee023ca8d66d351168f6b
171319    2012-03-16 01:21:22    00000000000000858fc8879e7928912874b4eb48650b8799d85a5793743fb776

171275    2012-03-15 17:27:23    00000000000003a681f718619ddc7e04e0a8a4c1cf8cb0af670c7a663f2629b5
171266    2012-03-15 15:13:53    0000000000000251a8801909669d34b99c230cdfc4f8dd7e438778bc9cfd8b24
171264    2012-03-15 14:57:30    0000000000000a47e75adb826c4522e67c48163a6e72483bedd4585c6d7a185d
171262    2012-03-15 14:26:29    00000000000009231d79ce3c6887a0711ecb299cde90ffd38dac0bec65f77600
171254    2012-03-15 13:08:14    00000000000007bd4819d1cfa789228de1172671b0ba42185d7ba64b57a45262

9 blocks - vs. 18 blocks found by deepbit in the same time, and deepbit's average round time was 28% longer than difficulty.

[P4man]

More food for tinfoil hatters.

Yesterday a guy called "sudo" showed up in bitminters IRC channel, bragging about his botnet and insinuated to be the mystery miner. Transcript below, he hadnt much to say, except for the only evidence he presented, a list of computer names, supposedly only a fraction of what he controls.

Clearly, he could just be a pretender; if he really ran a botnet like that, there is absolutely zero reason for him to come and brag about it.  but why would someone, even a pretender,  come to bitminter channel (and only bitminter) of all places to brag about his botnet, while having absolutely nothing to say about it?  Its the only channel I was in. His name being sudo (ie root), connected through a German node.

Could of course all be coincidence, but let me suggest it might also be a desperate attempt to convince me that MM is a botnet after all, and not some clever ploy to steal blocks from deepbit (and possibly bitminter, remember, same host, same unbelievable bad luck):

Code:

* sudo (~sudo@ip083064192089.rev.nessus.at) has joined #bitminter
<sudo> someon here?
<+DrHaribo> yep
<+DrHaribo> what's up? :)
<sudo> only single miner here or cluster mining talk allowed here?
<+DrHaribo> it's a pretty open channel
<+DrHaribo> and we have people with all sorts of mining setups
<+DrHaribo> what are you mining with?
<sudo> i guess u dont see that
<sudo> (---:
<sudo> u dont *want
<+DrHaribo> sounds ominous ;)
<P4man> is cluster mining an euphemism for botnet?
<sudo> .X
<sudo> hehe
<P4man> as much as I hate botnets in general, i think we could use one :_
<P4man> but thats just me
<sudo> u want see it?
<P4man> see what?
<sudo> i copy paste only 0.5 % of them
<sudo>  http://www.copypastecode.com/185801/ password: mining
<sudo> have fun and enjoy :_X
<+DrHaribo> the next question must be... are you the mysery miner? :D
<+DrHaribo> *mystery
<P4man> not enough hashing power on that list I think.. unless he has more
<P4man> still sizable though.. wow
<sudo> [23:15:32:332] <sudo> i copy paste only 0.5 % of them
* sudo slaps P4man around a bit with a large trout
<P4man> dear god
<sudo> read well and try understand
<sudo> .X
<sudo> proof enough?
<P4man> well the mystery miner has new name it seems
<sudo> i do every day more than 1k usd
<sudo> .X
<sudo> LOOL
<P4man> there goes my theory of stolen blocks
<P4man> pity, I thought it was a neat idea :)
<P4man> I assume you are not looking for a pool with that kind of firepower
<sudo> so now someone intrested?
<P4man> in what?
<P4man> I might be interested in a demonstration though
<sudo> to b a member in my team
<P4man> can you point some of that to bitminter?
<sudo> no sir
<sudo> i have my own pool
<P4man> which isnt relaying transactions.. why not?
<sudo> i do ~1300 gigahashes/s
<sudo> i ahve my own pool
<sudo> only me and my other (friends)
<sudo> .X
<P4man> yes buts it not including transactions in the blocks
<P4man> I just wonder why

Meanwhile, overall network hashrate is still slightly down, deepbit is still at +40% average block length (bitminter possibly even worse, havent calculated) and MM is still mining one block after the other. If this keeps up for a few more days, I no longer believe in coincidence.

[Turbor]

Some guy at Hetzner ?

Edit: just reminded me at this film where Edward Norton plays this retarded cleaner.

[DeathAndTaxes]

People claiming hashrate is down AND their is bad luck like that is some coincidence are missing something ...

there is no way to know hashrate we only know block completion time.  Bad luck = longer blocks = lower estimated hashrate.

[Joshwaa]

Watching. Let me know when to get my tinfoil hat out and my IP traveling Switch hopping Death Ray!

[rjk]

Meanwhile, overall network hashrate is still slightly down, deepbit is still at +40% average block length (bitminter possibly even worse, havent calculated) and MM is still mining one block after the other. If this keeps up for a few more days, I no longer believe in coincidence.

I'll bet the simple explanation is that he has compromised some or many machines that used to be mining already, but for other pools, and forced them to mine for him. Hopefully it isn't a miner software vulnerability.

[DeathAndTaxes]

That wouldn't show up as bad luck.  That would simply show up as all major pools becoming x% less popular.  Deepbit for example isn't showing a decline in the rate of shares/sec blocks are simply taking longer.  The simplest explanation is just variance but even if it was some unknown form of attack it has to be more complex than just redirecting miners.

[P4man]

People claiming hashrate is down AND their is bad luck like that is some coincidence are missing something ...

there is no way to know hashrate we only know block completion time.  Bad luck = longer blocks = lower estimated hashrate.

IM not entirely an idiot, Im talking about the global network hashrate, thats stable or slightly down,  and deepbits luck based on its known hashrate is down too.  Two different things. Deepbit is big, but its not the entire network yet. If 1+ TH comes out of the blue from a botnet or some asic provider, you could reasonably expect a decrease blocks time, at least until the next difficulty adjustment. Ive not seen anything like that. SIPA is showing a flat or downward trend over the time this mystery miner has been producing his blocks. So either its just a coincidence or this is not new, but existing hashing power thats being redirected or the blocks somehow "stolen".

[MrTeal]

Does that list strike anyone as odd? Unless it is 0.5% and it's already been sorted to show only the most powerful machines, there is way too much powerful hardware there. There's 383 machines listed, if that 0.5% it implies he controls 76 thousand PCs. If you had a real random botnet, finding 1000 machines with that kind of horsepower would probably require infecting 1,000,000. You'd think he could find something more profitable and less likely to be detected to do with his botnet than mining.

[DeathAndTaxes]

Never said you were an idiot but stating both bad luck and declining global hashing power is kinda silly.  It is like saying "the thief made a left turn AND he didn't make a right turn". Due to how hashrate is calculated if the network is in a bad luck "slump" it will show declined hashing power.  Both events occurring together is expected.

[DeathAndTaxes]

Does that list strike anyone as odd? Unless it is 0.5% and it's already been sorted to show only the most powerful machines, there is way too much powerful hardware there. There's 383 machines listed, if that 0.5% it implies he controls 76 thousand PCs. If you had a real random botnet, finding 1000 machines with that kind of horsepower would probably require infecting 1,000,000. You'd think he could find something more profitable and less likely to be detected to do with his botnet than mining.

Botnets can do multiple things.  It actually would be smart for an operator to take an inventory of victims and direct the more capable one towards mining and use the less capable ones for less computationally intensive tasks like bulk spam email or DDOS.

Not saying that makes the claim valid just indicating someone could have a 1 million node botnet and use just the 100K most capable of mining for mining.

[MrTeal]

Does that list strike anyone as odd? Unless it is 0.5% and it's already been sorted to show only the most powerful machines, there is way too much powerful hardware there. There's 383 machines listed, if that 0.5% it implies he controls 76 thousand PCs. If you had a real random botnet, finding 1000 machines with that kind of horsepower would probably require infecting 1,000,000. You'd think he could find something more profitable and less likely to be detected to do with his botnet than mining.

Botnets can do multiple things.  It actually would be smart for an operator to take an inventory of victims and direct the more capable one towards mining and use the less capable ones for less computationally intensive tasks like bulk spam email or DDOS.

Not saying that makes the claim valid just indicating someone could have a 1 million node botnet and use just the 100K most capable of mining for mining.

That makes sense, but would it not imply a simply massive botnet? Looking at the list, there's a lot of hardware you simply couldn't run full out without being detected. As a generalization, high end hardware is more likely to be run by more sophisticated users. A lot of that hardware is higher end nVidia stuff, anGetting 140MHash/s out of those 580s and 480s at full bore would tip off anyone that something is wrong.

Am I incorrect in thinking that anyone with this sort of botnet would have to run these higher end machines at much lower hashrates than they're capable of to maintain responsiveness and avoid detection? I would think that if they're running on gaming hardware they'd also have to disable mining when the computer launches a game or GPGPU app, where the slowdown would be pretty instantly noticeable. If this is true, it would have to be one of the largest botnets around.

[P4man]

Never said you were an idiot but stating both bad luck and declining global hashing power is kinda silly. 

Still having trouble distinguishing between deepbit and the entire network it seems.  Or are you saying the entire network (except for the mystery miner) is being unlucky for over 10 days now ?

[DeathAndTaxes]

Never said you were an idiot but stating both bad luck and declining global hashing power is kinda silly.  

Still having trouble distinguishing between deepbit and the entire network it seems.  Or are you saying the entire network (except for the mystery miner) is being unlucky for over 10 days now ?

Yes.  I thought I made that clear.  A 5% reduction in found blocks relative to expected for the entire network over a 10 day period is rare but not impossible.  

Just to beat this zombie horse dead:

IF the entire network in aggregate (note this doesn't mean every pool just the aggregate effect across all miners) is having a period  "bad luck" then it would reflect in a lower reported hashrate.  So while sipa may show a decline or flat hashrate in reality hashate has increased and is just reported "low" due to bad luck.

Also I don't see this major drop in hashing power.  Anything shorter than the 8 day average is essentially useless from a statistical point of view.




This lack of hashing power decline can be seen in the pools also.  Deepbit for example hasn't show any significant decline in hashrate.

Now the network calculates hashrate based on blocks (~1.5 mil dif shares) and pools calculate it based on diff 1 shares.  Obviously Deepbit internal number is going to have less variance.

Seeing as the major pools haven't shown a major decline in hashing power there likely isn't any.

This does bring up an interesting idea.  One could calculate the network normally and also take the reported hashing power of the largest pools as a countervalue.  Unless both numbers are moving in the same direction likely any change is simply variance.  

[silverbox]

Slush has been having spurts of very good luck the last few days.

Its at:

120%, 109%, 103%  (1 day, 7 day, 30 day)

2:33 pm 2012/3/16 UTC

[P4man]

Yes.  I thought I made that clear.  A 5% reduction in found blocks relative to expected is rare over a 10 day period but not impossible. 

There are a lot of rare but not impossible things going on right now. Thats the point. But the fact the network block rate is not showing the increase you would expect from an extra 1+TH, either because of bad luck or because that 1TH is not new, is not the same thing as deepbit having calculated bad luck on their published stats. They are related to some extend given deepbits size, but its not the same thing.

[DeathAndTaxes]

I don't know what charts you are looking at.  I honestly don't.

7 day avg is higher today than 15 & 30 days ago.
14 day avg is higher today than 15 & 30 days ago.



More specifically you keep saying 10 days so today the 7 day avg is ~ 11.2 TH/s, 10 days ago it was 10.1 TH/s. 

Are you looking at some other charts?

[P4man]

This is what Im looking at:
http://bitcoin.sipa.be/speed-lin-2k.png

And obviously not the 8 hour avg green line, but the 3 day estimate. Though variability is high enough to  make firm conclusions impossible,  its not quite what youd expect if 1.3 TH joined the network out of the blue. There is no spike up, its flat or down best I can tell.

DrHaribo did have another hypothesis; rather than stealing blocks he suggested it might be possible for an attacker with a botnet to intercept a % of winning blocks of other pools to keep difficulty down. That would show up in stats eventually, but made me wonder why we arent using HTTPS on our miners to prevent such sabotage in the first place.

[DeathAndTaxes]

3 day trend is not confirmed by the 7 day or 14 day trend.  Given "mystery" has been around a lot longer than 3 days why would use want to look at the more volatile number.  Less info & more noise?

By intercept blocks I guess you mean act as a man in the middle and prevent miners from submitting valid blocks to the pool?  Well I guess that is a good reason to use p2pool.  Every block is submitted to every other node who submits it to every bitcoind peer.