Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detecting Monero Miners with Bpftrace

blog.px.dev

Post reply on HN
Print view View original

61–70 of 87 posts

Re: Detecting Monero Miners with Bpftrace

#61

Post by brobinson »

alfonmga wrote: post #45

I feel bad about this because I wrote an article[0] about how to hide Monero miners on Linux systems. Sometimes I ask myself if I should unpublish it as probably some of the criminals doing this type of attacks found it helpful. [0] https://alfon.xyz/posts/hiding-cryptominers-linux

Skimmed the article. Looks nice. Good colors and formatting throughout.

Don't delete it.

Hiding processes and tidying up the CPU time (adding it to System Idle Process on Windows, etc.) is Rootkits 101. This technique has been documented in books for 15+ years. If they don't get the info from you, they'll get it somewhere else just as easily.

Re: Detecting Monero Miners with Bpftrace

#62

Post by sb057 »

djhn wrote: post #35
vmception wrote: post #27

Earlier quoted context omitted.

> what are legit things you bought with Monero its been 8 years now, I guess off the top of my head: groceries, domain names, registered agent services, compute instances, graphic design, press releases

Any reading you could recommend on Monero? Beyond wiki, subreddit, etc. Looking for more of an economics angle than cryptography angle, without generic crypto hype.

These lectures by Daniel Kim should be up your alley:

https://www.youtube.com/watch?v=wq6w03E2DS4

https://www.youtube.com/watch?v=REC5V7d3pqM

Re: Detecting Monero Miners with Bpftrace

#63

Post by dmitrygr »

xiphias2 wrote: post #52
dmitrygr wrote: post #40

Earlier quoted context omitted.

So? implement soft float and round any way you please. Slow? Sure. But don’t say “infeasible”.

infeasible - not possible to do easily or conveniently; impracticable.

For many us embedded folk, implementing soft float is a fact of life and isn’t impractical or uncommon. Not everyone lives in nodeJS land.

Re: Detecting Monero Miners with Bpftrace

#64

Post by dannyw »

technofiend wrote: post #32
anonporridge wrote: post #9

Earlier quoted context omitted.

Yep. Monero is explicitly designed to remain CPU mineable, so that theoretically it remains more decentralized and mined by individuals rather than an industrial complex like bitcoin and ethereum have become. Counterintuitively, I think this also makes it more susceptible to nation state attacks, since you can easily deputize fleets of existing CPUs to 51% attack the network, whereas no nation state on the planet can…

>Monero is explicitly designed to remain CPU mineable You're not wrong, but it can be and is mined on GPUs. Not sure about the payback period though because it is very CPU sensitive and the top benchmarks are for AMD's EPYC processors which don't come cheap. An i9-12k handily mines several times more than an Nvidia GPU so GPU mining payback is also potentially slow. At least according to the online guides it's also a…

Monero has a pretty active development community. If GPUs ever get close, they'll change RandomX.

Re: Detecting Monero Miners with Bpftrace

#65

Post by dannyw »

novok wrote: post #55
rosndo wrote: post #22

Earlier quoted context omitted.

Legal businesses, receiving much larger individual payments from a limited number of clients. > It makes a difference because there's more than just you and the KYC exchanges reporting, and it's survivor bias to assume they appear the same. Exchanges are usually the least of your problems, it’s the banks. Even very high risk businesses don’t face scrutiny which isn’t easily overcome when all of your incoming payments…

If you watch the other economic activity and internet activity of that e-commerce business, you could deduce how much activity it might be generating. No real e-commerce biz doesn’t have ad spend or other marketing activities, no e-commerce biz doesn’t have a sell rate that is %100, etc. Much like how the irs audits laundromats via their water and power usage. Are they consuming enough water and electricity to justif…

nobody actually cares enough to bust money laundering if it's not causing publicly visible problems.

White collar law enforcement is an illusion, backed by the occasional example.

There are 13k FBI special agents and most have case loads focused on things like "murder" than some e-commerce website with traffic numbers that don't add up.

A one hour cursory look on public clearnet hacking forums will surface hundreds of felonies by people with poor opsec, Feds scroll past them on a daily basis. It's not what they're after.

And no, the IRS has been trimmed to bones for decades, they probably audit <10 laundromats via water and power analysis a year, the same way Apple built literally two iPhone recycling robots (that do a thousand devices a year) but spend millions on marketing.

Re: Detecting Monero Miners with Bpftrace

#66

Post by allisdust »

Hjfrf wrote: post #47
anonporridge wrote: post #9

Earlier quoted context omitted.

Yep. Monero is explicitly designed to remain CPU mineable, so that theoretically it remains more decentralized and mined by individuals rather than an industrial complex like bitcoin and ethereum have become. Counterintuitively, I think this also makes it more susceptible to nation state attacks, since you can easily deputize fleets of existing CPUs to 51% attack the network, whereas no nation state on the planet can…

51% just doesn't feel like a meaningful threat model when governments can instead prevent exchanges offering monero pairs from accessing banking services in their country/currency.

That's already the case with most countries and exchanges. A lot of monero trading happens on p2p exchanges which don't tie themselves to any country.

Re: Detecting Monero Miners with Bpftrace

#67

Post by retrac »

dmitrygr wrote: post #63
xiphias2 wrote: post #52

Earlier quoted context omitted.

infeasible - not possible to do easily or conveniently; impracticable.

For many us embedded folk, implementing soft float is a fact of life and isn’t impractical or uncommon. Not everyone lives in nodeJS land.

One can mine Bitcoin on an IBM 1401 [1] from 63 years ago. Runs at 50 kHz and there are no binary operations so you have to simulate XOR using a subroutine operating on strings to represent bitstrings. Slow. As in seconds per hash not hashes per second. But it works!

Still. I am inclined to call that "impractical". In the same way softfloat-in-JS miners are impractical. A vast botnet of such might buy a coffee after a year or two.

At a certain point, slow enough turns into impractical, and then practically impossible.

[1] http://www.righto.com/2015/05/bitcoin-mining-on-55-year-old-...

Re: Detecting Monero Miners with Bpftrace

#68

Post by trompetenaccoun »

latchkey wrote: post #56
anonporridge wrote: post #54

Earlier quoted context omitted.

Yeah, this is one of the big advantages of bitcoin's ASIC race that has long ago obsoleted CPUs and GPUs for mining. It means that bitcoin doesn't economically incentivize botnets stealing valuable generic computation cycles that could actually be put towards better use. Although you could still argue that it's crowding out chip foundries that could otherwise be producing different chips. But you could also argue it'…

ASICs have a hardware hash/watt race issue that GPUs (with memory hard algos) don't have (older GPUs are actually more ROI efficient). GPUs are also easier for a wider range of people to get with a much lower cost of entry. I'd argue that GPUs are still a better solution than ASICs, but this is an age old battle full of opinions. Bitcoin hardware isn't worthless for any other application, any other sha256 based netwo…

What's that attack cost supposed to represent? Just the electricity?

Seems like a misleading comparison, to get into a position to be able to do this you'd need significant investments in specialized hardware for the likes of Bitcoin and Ethereum. I've seen estimates of multiple billions of USD. And keep in mind that should the attack be discovered, which with coins running on open ledgers seems likely sooner rather than later, the price is going to tank, trust in Bitcoin will be broken and your special-purpose hardware will likely massively lose value. You'd have successfully destroyed billions of your own money.

On the other hand, the real cost of attacking some smaller coins may be even lower than that, because botnets are free or the electricity may simply be stolen, which happens a lot and can easily be done in less developed countries where the utility companies don't have sophisticated meters keeping track of where it all goes in the neighborhoods.

Re: Detecting Monero Miners with Bpftrace

#69

Post by djhn »

BbzzbB wrote: post #41
djhn wrote: post #35

Earlier quoted context omitted.

Any reading you could recommend on Monero? Beyond wiki, subreddit, etc. Looking for more of an economics angle than cryptography angle, without generic crypto hype.

I have no insightful information to give you with regards to Monero, but to me what you're looking for is a good fit for Marginalia's text-centric search engine [0]. I get interesting results when I'm looking for authentic and elaborate opinions on given subjects outside the beaten path, which seems to be your goal. And especially useful when trying to flee the cesspool of results Google gives you when looking for to…

Thanks, this surfaced several interesting looking results. I'll try using it more often.

Re: Detecting Monero Miners with Bpftrace

#70

Post by djhn »

sb057 wrote: post #62
djhn wrote: post #35

Earlier quoted context omitted.

Any reading you could recommend on Monero? Beyond wiki, subreddit, etc. Looking for more of an economics angle than cryptography angle, without generic crypto hype.

These lectures by Daniel Kim should be up your alley: https://www.youtube.com/watch?v=wq6w03E2DS4 https://www.youtube.com/watch?v=REC5V7d3pqM

Thanks, saved both of those.
Post reply on HN