Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Detecting Monero Miners with Bpftrace

blog.px.dev

Post reply on HN
Print view View original

71–80 of 87 posts

Re: Detecting Monero Miners with Bpftrace

#71

Post by mythrwy »

dannyw wrote: post #64
technofiend wrote: post #32

Earlier quoted context omitted.

>Monero is explicitly designed to remain CPU mineable You're not wrong, but it can be and is mined on GPUs. Not sure about the payback period though because it is very CPU sensitive and the top benchmarks are for AMD's EPYC processors which don't come cheap. An i9-12k handily mines several times more than an Nvidia GPU so GPU mining payback is also potentially slow. At least according to the online guides it's also a…

Monero has a pretty active development community. If GPUs ever get close, they'll change RandomX.

You can't mine Monero currently with GPUs?

I haven't mined in years and I know they changed away from the cryptonight algorithms but I used to mine on both CPU and GPU.

Re: Detecting Monero Miners with Bpftrace

#72

Post by selestify »

Scoundreller wrote: post #3

My employer does a pretty good job of giving us terrible hardware so the thought of mining on it is self-discouraging. They have no problems giving us space heaters though. As largely a joke, I sometimes fire up monero mining on my laptop at home because the average proceeds exceed electricity cost, even though it’ll take me about a decade to ever get a block. The heat is just cake icing.

> even though it’ll take me about a decade to ever get a block

Why don't you join a pool to get some of that average payout?

Re: Detecting Monero Miners with Bpftrace

#73

Post by selestify »

retrac wrote: post #67
dmitrygr wrote: post #63

Earlier quoted context omitted.

For many us embedded folk, implementing soft float is a fact of life and isn’t impractical or uncommon. Not everyone lives in nodeJS land.

One can mine Bitcoin on an IBM 1401 [1] from 63 years ago. Runs at 50 kHz and there are no binary operations so you have to simulate XOR using a subroutine operating on strings to represent bitstrings. Slow. As in seconds per hash not hashes per second. But it works! Still. I am inclined to call that "impractical". In the same way softfloat-in-JS miners are impractical. A vast botnet of such might buy a coffee after…

> At a certain point, slow enough turns into impractical, and then practically impossible.

That is, after all, the whole idea behind asymmetric cryptography. You could perhaps crack some things by brute forcing until the heat death of the universe, but that's so slow as to be impossible for all practical purposes.

Re: Detecting Monero Miners with Bpftrace

#74

Post by fer »

323 wrote: post #13
rosndo wrote: post #11

Earlier quoted context omitted.

You provide them accounting from your fake business which accepts only monero payments for digital goods and doesn’t keep access logs? This is really basic stuff. You will never be caught unless other evidence leads them from the original crime to you. Unless you fuck up it’s not possible to link incoming Moneroj to any specific source, this means that you can fairly easily hide your money laundering activities even…

You live in some fantasy land if you think you can just say "oh, I just received 100 dollars worth of Monero from 1 million unknown entities, my $100 million is totally legit, fuck off". Unlike criminal law where you are "innocent until proven guilty", in most AML/KYC situations you are "guilty until proven innocent".

> "oh, I just received 100 dollars worth of Monero from 1 million unknown entities, my $100 million is totally legit, fuck off"

That's pretty much the whole NFT craze, but without Monero which makes it even dumber.

Re: Detecting Monero Miners with Bpftrace

#76

Post by fer »

dannyw wrote: post #65
novok wrote: post #55

Earlier quoted context omitted.

If you watch the other economic activity and internet activity of that e-commerce business, you could deduce how much activity it might be generating. No real e-commerce biz doesn’t have ad spend or other marketing activities, no e-commerce biz doesn’t have a sell rate that is %100, etc. Much like how the irs audits laundromats via their water and power usage. Are they consuming enough water and electricity to justif…

nobody actually cares enough to bust money laundering if it's not causing publicly visible problems. White collar law enforcement is an illusion, backed by the occasional example. There are 13k FBI special agents and most have case loads focused on things like "murder" than some e-commerce website with traffic numbers that don't add up. A one hour cursory look on public clearnet hacking forums will surface hundreds o…

> nobody actually cares enough to bust money laundering if it's not causing publicly visible problems.

That's the harsh truth.

Where I live, THC is illegal, and its distribution usually ends with time served.

Interestingly, CBD (more accurately THC-less) stores are everywhere, taking prime locations in city centers, blaring thousands of positive reviews on Google Maps. Their top product is CBD oil (or rather, THC-less cannabis oil). Prices of their products are suspiciously similar to that of their illegal counterparts.

Yet when you pass in front of such stores, there's usually just a single person tending, sometimes with a friend because it gets boring as there's virtually no customer.

It's basically the caffeine pills + decaffeinated coffee product split, where caffeine is illegal.

Following the supply chain would not only find the laundering, but also the distribution and production of a substance considered illegal.

But cops stick to chasing dealers, and the fisc doesn't really chase businesses that seem to pay their taxes.

Re: Detecting Monero Miners with Bpftrace

#77

Post by rosndo »

novok wrote: post #55
rosndo wrote: post #22

Earlier quoted context omitted.

Legal businesses, receiving much larger individual payments from a limited number of clients. > It makes a difference because there's more than just you and the KYC exchanges reporting, and it's survivor bias to assume they appear the same. Exchanges are usually the least of your problems, it’s the banks. Even very high risk businesses don’t face scrutiny which isn’t easily overcome when all of your incoming payments…

If you watch the other economic activity and internet activity of that e-commerce business, you could deduce how much activity it might be generating. No real e-commerce biz doesn’t have ad spend or other marketing activities, no e-commerce biz doesn’t have a sell rate that is %100, etc. Much like how the irs audits laundromats via their water and power usage. Are they consuming enough water and electricity to justif…

First, nobody cares that much unless they know you’re guilty.

Second, just obviously spend a little money and time on those things? It’s a minor cost to run shitty ad campaigns.

The business doesn’t need to be good, it just has to look real. Do things a real business would do, except unlike a real business you will have a 100% chance of success.

Re: Detecting Monero Miners with Bpftrace

#78

Post by ElonMuskrat »

vmception wrote: post #14
devops000 wrote: post #5

Monero is not anonymous anymore as soon as you want to convert to fiat.

It's been over half a decade since that stopped mattering, for me. I've bought goods and services directly with Monero plenty of times. I've paid invoices that the merchant put in Bitcoin, while using a third party to pay in Monero, which the third party then paid in Bitcoin. Now in the 2020s I can swap Monero directly to SECRET network, a Tindermint/Cosmos blockchain where all smart contract executions are private (…

> It's been over half a decade since that stopped mattering, for me.

It's certainly going to matter come tax season to businesses which are/will be forced to convert Monero to local fiat.

> I've bought goods and services directly with Monero plenty of times. I've paid invoices that the merchant put in Bitcoin, while using a third party to pay in Monero, which the third party then paid in Bitcoin.

What exactly do you buy with Monero?

Re: Detecting Monero Miners with Bpftrace

#79

Post by nigma1337 »

alfonmga wrote: post #45

I feel bad about this because I wrote an article[0] about how to hide Monero miners on Linux systems. Sometimes I ask myself if I should unpublish it as probably some of the criminals doing this type of attacks found it helpful. [0] https://alfon.xyz/posts/hiding-cryptominers-linux

Great article, i'd keep it up, as another commenter says, this is mostly rootkits 101 stuff.

I'm wondering, how would one go about finding one of these rootkits? Looking through loaded kernel modules for anything "weird"?

EDIT: I should really start reading the articles before going to comments, how to find these is litterally what the article is about..

Re: Detecting Monero Miners with Bpftrace

#80

Post by Scoundreller »

selestify wrote: post #72
Scoundreller wrote: post #3

My employer does a pretty good job of giving us terrible hardware so the thought of mining on it is self-discouraging. They have no problems giving us space heaters though. As largely a joke, I sometimes fire up monero mining on my laptop at home because the average proceeds exceed electricity cost, even though it’ll take me about a decade to ever get a block. The heat is just cake icing.

> even though it’ll take me about a decade to ever get a block Why don't you join a pool to get some of that average payout?

Why pay a percentage?
Post reply on HN