Deception: Is your mining machine really mining?

Recently, I received a consultation from a friend, which led me to discover a new type of scam.

A few days later, I found three friends cheated, and their experience of being cheated was similar to that of a liar. All the mining machines were bought on the second-hand trading platform. After a week of normal mining, the computing power suddenly disappeared, probably by the same group of swindlers.

I think I should do something.

Strange malfunction

On this day, an A consulted me, and all of a sudden, all the 20 video card mining machines he bought could not mine.

The specific fault performance is: the mine pool shows that the mining machine is off-line.

▼ Because the working hours are not long, when a company consulted me, the mining machine has been shown to be invalid.

I have helped many small white people, and I still have some experience. I asked him to feel the temperature of the mine socket with his hand.

▼ This is the power consumption of normal mining.

▼ This is the power consumption at no load.

It can be found that if the mining machine does not mine, the power consumption of the graphics card will be significantly reduced, and the air outlet should basically not feel the temperature.

An A gave me a quick reply, and the air outlet was very hot, which was no different from before.

Obviously, the mining machine is working.

Now that the machine is working, we can directly rule out the causes of the network and the mine pool.

Because if there is a problem with the connection to the mine pool, the mining software will stop mining and the power consumption of the graphics card will be reduced.

There seems to be only one possible explanation: the machine was hacked and the computing power was cut to someone else's address.

Since the system has been hacked, the best way to be on the safe side is to reinstall it.

Experience tells me that reinstalling the hacked system is the most time-saving and labor-saving way. Who knows what hackers will do, moths to a fire, and mining machines have no data to leave.

Under my guidance, a company successfully installed minerOS, a customized system for mining.

After that, something that made me look stupid came. I couldn't detect the graphics card! !

▼minerOS didn't recognize any graphics cards in the background.

A mining machine that can insert 8 cards, the motherboard will definitely use various tricks to increase PCIE slots.

Common methods include: PCIE switch, bandwidth reduction to 1x, and PCIE 2.0 protocol. Compatibility and stability are really average, and it is common to lose one or two cards occasionally.

However, it's the first time I've seen anyone lose all eight cards.

A favorable change

A and I have been tossing and turning for hours, and there is nothing we can do.

Just as I was about to give up remote debugging and let A send me the machine, A complained: It's so hot.

This sentence woke me up. I asked A to check the temperature of the air outlet, which was still hot.

It seems that the machine is still mining, but obviously even the graphics card can't be recognized.

Just let A directly turn on the mining machine, but still keep the power on. After a while, A checked the air outlet, and it was still hot.

This is a bit strange, isn't it?

Never stopped, regardless of the tamper-proof sticker on the machine, I directly found a screwdriver to disassemble the machine.

It doesn't matter if it's dismantled. It's a surprise.

There is only a small industrial control board, a few heating wires, a small power supply and a few bricks in the machine. There are violent fans on both sides of the chassis.

▼ Here A doesn't agree to use his mining machine picture. Please fill in the map yourself according to this schematic diagram.

Needless to say, A was cheated.

I have to say that the liar's imagination is still very rich.

The bricks in the case are reusable, and the heating wire is obviously used to heat up, making you think that the machine is working.

Brush a system in the industrial control board and work with a power supply.

not understand

A thought he was careful enough to take a second-hand trading platform and dig for a week to confirm the receipt.

A long time ago, there was a scam to trick you into buying cloud computing capabilities or so-called "mining machines." In fact, you can't mine at all, but you can only connect with the so-called "mining pool" provided by the liar, show you some computing power, and give you some coins every day, saying that it is mining income.

Computing power is just the number on the website built by the swindler, and the income is actually transferred to you by the swindler from the money you bought for cloud computing power or mining machine.

When enough people are cheated, the swindlers will run away with the money. The most famous scam of this kind is "Snail Star".

In fact, this scam is easy to see through, as long as you ask you to be able to mine in a third-party mine pool.

Third-party mining pools will show their computing power fairly. Obviously, this scam has no real computing power, so it can be seen through.

A is aware of this scam, so he emphasizes that the computing power must be displayed in F2Pool. If the proceeds are paid by F2Pool, at least the computing power can be guaranteed to be true.

After my inspection, the income received by A is indeed paid from the address of F2Pool, which can be found on the chain and related mining records can also be found on F2Pool.

So the calculation force is real, such as fake replacement.

However, it is impossible for these things in the chassis to generate computing power. Where does computing power come from?

A has repeatedly confirmed that these machines have not been touched by others after receiving them, and there is no possibility of being replaced.

I decided to study it carefully.

As this machine has been reinstalled, I asked A to find another one.

betray the pot to the roses

After some investigation, I really found something fishy. I can't help but admire the cleverness of the liar.

▼ Is this lolMiner, a mining tool commonly used in Ethereum? I thought so at first.

▼ Look at its size, only 48 bytes. You know, the normal lolMiner executable file should be around 8MB.

▼ Check the content, this lolMiner is actually a script.

How did everyone start mining? Use this line of command, right?

. /lolminer.exe-algoet hash-pool address-user wallet address. Mining machine name

Because the lolMiner on this machine is not a real mining program, but a script, all the above command line parameters will be completed in the script.

The last execution is actually this command:

Sshmos @ xxx.xxx.xxx.xxx "~/lolminer/lolminer"-algoet hash-pool address-user's wallet address. Mining machine name

What is the function of this command?

Remote login? http://xxx.xxx.xxx.xxx？ The machine executes the mining program lolMiner on the remote machine and transmits the output of the program to the local display. Mining is actually carried out on real mining machines in the hands of swindlers.

The scammer also intimately configured the ssh private key and logged in without a password, which is really no different from the real lolMiner operation.

It is estimated that friends without a certain technical foundation will be dizzy when they see this. It doesn't matter. Let's draw a picture and straighten it out.

▼ Normal mining

▼ A's "mining machine"

See the difference?

In fact, it is the real mining machine in the hands of the swindler. The fake mining machine in A's hand only sends an instruction to the real mining machine, which is why the real mining machine in the hands of the swindler knows A's mining account number.

The real miner in the liar's hand will send back the mining log and display it on the fake miner in A's hand. It seems that the fake miner is mining.

Because the real mining machine in the liar's hand is dug at the address of A, showing the mine pool, which will be profitable.

So A will think that this fake mining machine in his hand is mining.

Using heavy bricks as counterweights, fans blowing hot air, and constantly beating mining logs, such as the calculation of fake ore pools and the income of real money and silver, is simply a perfect scam!

can't bear/stand

In a word, little white miner, it's really hard to get out of the wolf's den.

If the "fake mine pool" can be avoided, it will be difficult for Xiaobai to avoid being deceived by this "fake mine machine" scam.

Judging from a screenshot of a chat sent to me by A, the liar is so sincere and patient, and the news comes back every second.

The liar's credit score on a second-hand platform is also very high, and the price of the mining machine is so favorable, which is more than 2,000 lower than the market price.

The machine arrived, covered with tamper-proof stickers. When you opened it, people confidently said that you had switched the bag and would not return it or change it.

Today is a brick, maybe you can still see it when you tear it down. What should I do if I switch to a scrapped graphics card tomorrow? I really can't tell from the outside.

Today, this script is only a few tens of KB. What should I do next time someone compiles a binary file of similar size?

Apart from reverse engineering, you really can't know whether this program is really using your mining machine to mine, which is obviously beyond Xiaobai's ability.

Even if you brush the system yourself, people are only compatible with the system provided, and you have nothing to say.

After all, it is normal that the configuration of the mining machine is strange, the system is incompatible and extra debugging is needed.

You only have 10 days. Just lie to you 10 days, and all the money is given to the liar. People can turn off real mining machines and run away.

The swindler who sold the A mining machine has now disappeared, and the news is not returned, the phone is not answered, and even the address is fake.

arouse

In this impetuous environment, everyone dreams of getting rich overnight, which is exactly what scammers take advantage of.

When you feel profitable, please be sure to ask yourself three questions:

Where did you make the money?

What advantages do you have over others? Why make other people's money instead of other people's money?

Do you really know what you are investing in?

If A is not overconfident, but knows more about the mine circle, or tries one or two before taking a lot of goods, or finds a third-party mine inspector, won't he be cheated?

Many friends added the first sentence of my WeChat: Is there a group that Miss Li Can wants me to learn?

This reminds me of a lot of exercises I bought when I was a child. It seems that I can get high marks if I buy it.

Is it really useful to add a lot of messy groups?

We live in an era of information overload. What you need to do is to find real and useful information from the massive junk information, instead of soaking in more junk information and imagining that you are also a cow.

Will information of great value appear in the group of hundreds of strangers?

Even valuable information, after appearing in this group, is it still valuable?

The essence of business is the information gap. As we all know, where is the information gap? Where is the value?

Not to mention all kinds of scams in the group, A is a liar who met in the group and was cheated.

I was cheated by an A, I felt it, and unconsciously wrote thousands of words.

The scam continues. If you are also a victim of a scam, please share your experience to avoid more victims.