5 ms·

Someone noticed it in September, opened an issue, and got no response. https://github.com/bitmaintech/bmminer/issues/7 https://github.com/bitmaintech/bmminer/is

by haakon 9y ago

Someone noticed it in September, opened an issue, and got no response. https://github.com/bitmaintech/bmminer/issues/7 https://github.com/bitmaintech/bmminer/issues/7 It also looks like the backdoor may have a remote code execution vulnerability: https://twitter.com/petertoddbtc/status/857340167400587264 https://twitter.com/petertoddbtc/status/857340167400587264

clarkmoody 9y ago
Relevant source code: https://github.com/bitmaintech/bmminer/blob/b5de92908498590d96d333a1e2570eab0eb321d3/driver-btm-c5.c#L7776 https://github.com/bitmaintech/bmminer/blob/b5de92908498590d... Edit: Nobody cares about the vulnerability until it has a name and a logo :-)
- libria 9y ago
  An 8000+ line C file. I can understand how a single bug might be overlooked there.
  - Fzzr 9y ago
    Or a single malicious "feature"...
  - _coldfire 9y ago
    It wasn't overlooked though. Issue was raised in Sept 2016 https://github.com/bitmaintech/bmminer/issues/7 https://github.com/bitmaintech/bmminer/issues/7
axoltl 9y ago
It has a bug but it's only an out-of-bounds read, not a write. So you might be able to make it crash, but why would you want to? Crashing might make it reboot and continue mining. Instead, send "false\0" and it'll stop dead in its tracks.