Dimwit hackers use security camera DVRs as SUPER-SLOW Bitcoin-mining rig Miscreants are using hacked digital video recorders in a somewhat misguided attempt to mine cryptocurrency BitCoins. Hackers have created custom code to infect devices normally used for recording footage from security cameras. After getting in, likely to taking advantage of weak default passwords, a common security mistake …
Let's see, there is no 'leccy cost (to the attacker), there is no hardware cost (to the attacker).
Even if the trickle is infinitesimal, it's not like it cost them anything. It's like saying "I'll offer you 1 quid every 100 years if you look at me funny." Who isn't going to make a funny face?
If there's enough slow devices submitting shares (proof of work) to a mining pool*, then they will be earning tiny fractions of a Bitcoin, infect enough machines and it goes from being a pittance to a few dollars or even more per day/week/month.
*Mining pools (for those not into the mining scene) basically let a load of people collaborate their mining power and share out the rewards of mining a block amongst themselves, this allows those taking part to have smaller but much more regular payouts, rather than solo-mining for one big payout which may come every month or even further apart (if you're unlucky, you could go quite a while even with significant hashing power).
Quoting from Slashdot [http://it.slashdot.org/story/14/04/01/029249/dvrs-used-to-attack-synology-disk-stations-and-mine-bitcoin]:
"If memory serves, most of Synology's non-intel NASes are Marvell based. Marvell's fastest device, in terms of general compute, is the MV78460. 4 cores, ARMv7, up to 1.6GHz. As documented here [http://forum.synology.com/wiki/index.php/What_kind_of_CPU_does_my_NAS_have] most Synology NASes ship with something slower than that."
For reference, a 1.6GHz 'Kirkwood' Marvell core is good for slightly under .2 meghashes/s. About half as fast as an Atom CPU, less than 1/4000th as fast as an AMD7970, and just plain embarassing compared to the ASICs that do most of the work these days. With devices that run on USB power alone pulling north of 1gighash/s, you could probably own every Synology ARM NAS in the first world and barely pay yourself for your time."
So every 10000 compromised DVR's gives you equivalent performance (at best) to a BitFury Red Fury (http://www.amazon.co.uk/BitFury-Red-Fury-Bitcoin-Miner/dp/B00HNR1HW8). Given that the compromise doesn't affect all devices in Synology range, I wouldn't expect more than 1 million devices were usable.
It is "free" once your compromise is in the wild, but I'm not sure you'll be retiring to your favourite tropical island any time soon. If you're prepared to settle for the occasional pint or two in Swindon then you maybe happy....
I'm going to be generous and assume that one of these devices can manage a mining rate of 0.5MH/s (500 thousand hashes per second).
To put this into context, the current genreation of ASIC mining rigs hash at 1 TH/s, or 2 million times this speed. To match the hashing power of one of these devices, you would therefore need to infect 2 million of these specific devices - a number which may well not exist.
To put this further into context, lets look at the hashing power and mining rate of pooled mining. For my example, I'm going to pick Slush's pool which has a combined hashing rate of around 1PH/s and finds around 5 blocks of 25 BTC per day.
So, with 2 million infected devices, you could expect to make around 0.125 BTC per day, worth around £35.
Pretty much every embedded DVR I've ever worked with runs on Linux of one kind or another. There were some early Honeywell models that ran something that looked like Windows CE, but I only ever saw a couple of these units.
Most of the higher end server based DVR systems do use Windows Server. If they're running Milestone Corporate or Genetec software they'll be dual CPU units with quad or 8-core Xeons and upwards of 16gb RAM. Hijacking one of these beasts would be useful...
God damnit. I hate it, just really, really hate it when people don't realize most words have multiple definitions. Even worse, it's often only the negative definitions they know. I blame that on emotionally driven news media, but that's another matter.
There are some really great words that are often the most accurate word to use, but have been turned into emotional buzz words that lose their best attributes as a result.
Words like 'exploit, retard, moot, dumb, conserve, oscillate, ignorant, anti, negative, positive, compromise, occult, take advantage of, theory, indefinite, niggardly,
are a few examples right off the top of my head. There are shitloads more.
It's a real problem because using a word appropriately may just upset the ignorant and occult your message because they are too nicgardly to buy and use a dictionary. Hell, dictionaries are free online these days. So we all get our vocabulary censored via ignorance and the no dictionaries crowd is also where the next generation of leaders and important people are going to come from. It's just so fucking silly.
Bitcoin, not BitCoin. It's very clearly defined and constantly misused...
Also: DVRs mining Bitcoin is incredibly stupid as it will not make any money at all. 600GH/s worth of power (10x the ASIC power of a BFL Single) brings 0.05btc per day, without subtracting electricity costs. This is already almost nothing. You'd need millions upon millions of infected smartmobes and DVRs to make even the tiniest amounts of money with this. I doubt the hackers are doing it for money, more for disrupting either the DVRs or to enforce the reputation Bitcoin has as the "evil man's tool"
Edit:
Just made the calculation: If you had 1,000,000 Raspberry Pis mining 24/7 you would make a whopping 144usd per month!
Edit2: If you want to calculate for yourself: A Raspberry Pi (example for an average ARM processor) can hash with ~100kh/s when overclocked
"Mining BitCoins these days requires a specialist rig featuring graphic cards so using low-powered embedded systems is not terribly practical."
Mining BitCoins requires CPU cycles. End of story. Where you obtain those CPU cycles from is your problem, and yes if you want to do it in one "CPU" then a GPU is one place.
It's like the old urban legend of the guy who collected up all the fractional payments the company rounded down on its payroll. A lot of tiny amounts soon adds up.
There's something to this... Look at it this way:
They experimenting with mining using non-conventional hardware. Not a PC. Not a smart phone. Not an ASIC designed to mine BTC.
How about an ARM processor? Get some code figured out. Get it distributed. Show that the engine works, but have no plans to win a race with it (very slow mining). As the NON-PC platform evolves, the software might need some tweaking, but they know it works. They don't need to gain a coin, if their goal is only to show a working engine for, say, a recording device that uses the same instruction set.
Then sell it.
I think you are on the money.
Want to test your code but would prefer someone else distributed and checked it? Give it some arcane use like, I don't know "bitcoin mining" (how we laughed) surely your mark is motivated by the "something for nuthin' " vibe no?
It gets out there the script kiddies moan it doesn't work on brand x and they only managed y performance and you go OK thanks guys.
--
Someone I knew used to share video via P2P with a friend, nothing dodgy just large ish files, before fast connections he got them moved quickly by compressing and uploading 95% as (for example) "Big bouncy boobs" video part 1,2,3 knowing that they would be pounced on, he then sent the small last 5% to his friend direct, without the last bit the files were useless but strangely readily available locally to his friend at sunrise. I bet there are people out there now still hunting for big bouncy boobs part 4.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
