4 ms·

I would really like to try NiceHash, but the fact that I have to add it as an exception to Windows Defender antivirus, and that one of the founders has previous

I would really like to try NiceHash, but the fact that I have to add it as an exception to Windows Defender antivirus, and that one of the founders has previously been convicted [0] and served time for writing botnet malware, really gives me pause. [0]: https://en.m.wikipedia.org/wiki/NiceHash https://en.m.wikipedia.org/wiki/NiceHash

kiddico 6y ago
I'd bet that writing botnet software was pretty good training for writing distributed processing software like NiceHash, though I think your concern is still valid.
- gkfasdfasdf 6y ago
  Yes absolutely, I'm sure writing a botnet is not trivial so I respect the technical ability!
xienze 6y ago
NiceHash is on GitHub and you could always build it yourself if you’re worried. I think the reason it flags as malware is because virus scanners flag anything crypto mining-related as malware by default.
Sohcahtoa82 6y ago
Windows Defender flags all crypto miners. It is not unique to NiceHash. You don't have to add an exception for the whole NiceHash directory for it to work, but it makes it easier. NiceHash updates the miners occasionally, and if you don't add an exception for the whole directory, then every time a miner gets an update, it's disabled by Windows Defender until you manually allow it.
- gkfasdfasdf 6y ago
  Seems like there should be a way to have NiceHash sign their binaries or otherwise vet with Microsoft so Defender can automatically allow it. Setting an exception seems like it makes it a target for other malware to hijack or piggyback on.
  - Sohcahtoa82 6y ago
    A signed binary won't help. Cryptominers fall into the "Potentially Unwanted Program" category, along with remote access software like a VNC server. They're not malware, but can be installed maliciously. If Windows Defender finds a cryptominer, it has no way to determine if it was deliberately installed, so it flags. Manually excepting the directory NiceHash installs the miners is the only way around it.
    - bigiain 6y ago
      I wonder if other actual malware now actively looks for that directory to opportunistically install itself into if available?
      - gkfasdfasdf 6y ago
        Yes this would be my concern!
mtone 6y ago
Nicehash (the app) is a convenience tool to manage miner executables -- it's mostly those that are flagged by AVs. You can connect most miner executables to Nicehash (the service) or other pools directly, and some are open-source. For instance I GPU mine with https://github.com/ethereum-mining/ethminer https://github.com/ethereum-mining/ethminer and CPU mine with https://github.com/xmrig/xmrig https://github.com/xmrig/xmrig, both built from source and I don't use Nicehash (the app). But I haven't looked at the source, so at some point I'm still trusting someone.
- gkfasdfasdf 6y ago
  This is interesting, so I could run the NiceHash app (which doesn't require an AV exception) and have it mine using open source miners which I have built myself?
  - Sohcahtoa82 6y ago
    Possibly. Depends on whether or not the heuristics scanning in Windows Defender would still flag the miners if you compiled it yourself.
  - mtone 6y ago
    Not really - each miner (and versions of them) may have different command line arguments or monitoring APIs Nicehash wouldn't know about, so it's going to be more trouble than it's worth. I meant just starting them from the command line: ethminer.exe -P stratum2+tcp://<your nicehash wallet address>@daggerhashimoto.usa.nicehash.com:3353
lostmsu 6y ago
Self-ad: check mine (which is also conveniently called Mine). https://losttech.software/Downloads/Mine/ https://losttech.software/Downloads/Mine/ I am considering to add a feature, that would pause when external sensor reports high temperature. But you can already hack around that by creating a background window titled "DON'T MINE" and setting the tool to stop when it sees it.
lunatuna 6y ago
I'll take a bit of your NiceHash and add some water [0] to that and make you something tasty. A bit more turnkey and a middleman if you don't mind. [0]: https://www.753.plus/ https://www.753.plus/

kiddico 6y ago

I'd bet that writing botnet software was pretty good training for writing distributed processing software like NiceHash, though I think your concern is still valid.

gkfasdfasdf 6y ago
Yes absolutely, I'm sure writing a botnet is not trivial so I respect the technical ability!

xienze 6y ago

NiceHash is on GitHub and you could always build it yourself if you’re worried. I think the reason it flags as malware is because virus scanners flag anything crypto mining-related as malware by default.

Sohcahtoa82 6y ago

Windows Defender flags all crypto miners. It is not unique to NiceHash. You don't have to add an exception for the whole NiceHash directory for it to work, but it makes it easier. NiceHash updates the miners occasionally, and if you don't add an exception for the whole directory, then every time a miner gets an update, it's disabled by Windows Defender until you manually allow it.

gkfasdfasdf 6y ago
Seems like there should be a way to have NiceHash sign their binaries or otherwise vet with Microsoft so Defender can automatically allow it. Setting an exception seems like it makes it a target for other malware to hijack or piggyback on.
- Sohcahtoa82 6y ago
  A signed binary won't help. Cryptominers fall into the "Potentially Unwanted Program" category, along with remote access software like a VNC server. They're not malware, but can be installed maliciously. If Windows Defender finds a cryptominer, it has no way to determine if it was deliberately installed, so it flags. Manually excepting the directory NiceHash installs the miners is the only way around it.
  - bigiain 6y ago
    I wonder if other actual malware now actively looks for that directory to opportunistically install itself into if available?
    - gkfasdfasdf 6y ago
      Yes this would be my concern!

mtone 6y ago

Nicehash (the app) is a convenience tool to manage miner executables -- it's mostly those that are flagged by AVs. You can connect most miner executables to Nicehash (the service) or other pools directly, and some are open-source. For instance I GPU mine with https://github.com/ethereum-mining/ethminer https://github.com/ethereum-mining/ethminer and CPU mine with https://github.com/xmrig/xmrig https://github.com/xmrig/xmrig, both built from source and I don't use Nicehash (the app). But I haven't looked at the source, so at some point I'm still trusting someone.

gkfasdfasdf 6y ago
This is interesting, so I could run the NiceHash app (which doesn't require an AV exception) and have it mine using open source miners which I have built myself?
- Sohcahtoa82 6y ago
  Possibly. Depends on whether or not the heuristics scanning in Windows Defender would still flag the miners if you compiled it yourself.
- mtone 6y ago
  Not really - each miner (and versions of them) may have different command line arguments or monitoring APIs Nicehash wouldn't know about, so it's going to be more trouble than it's worth. I meant just starting them from the command line: ethminer.exe -P stratum2+tcp://<your nicehash wallet address>@daggerhashimoto.usa.nicehash.com:3353

lostmsu 6y ago

Self-ad: check mine (which is also conveniently called Mine). https://losttech.software/Downloads/Mine/ https://losttech.software/Downloads/Mine/ I am considering to add a feature, that would pause when external sensor reports high temperature. But you can already hack around that by creating a background window titled "DON'T MINE" and setting the tool to stop when it sees it.

lunatuna 6y ago

I'll take a bit of your NiceHash and add some water [0] to that and make you something tasty. A bit more turnkey and a middleman if you don't mind. [0]: https://www.753.plus/ https://www.753.plus/