Backdoor in the firmware of Antminer Bitcoin mining hardware
Redirecting auth.minerlink.com to point at 127.0.0.1 is not a permanent way to bypass the issue.<p>If the next patch includes a localhost server that can proxy communication to auth.minerlink.com, the issue returns.<p>If the next patch updates the url to auth2.minerlink.com (or any other domain), the issue returns.<p>If the next patch flips from default-allow to default-deny, all customers will be out of luck until they patch and come back to the central control mechanism.<p>If the next patch implements some form of authentication such that you can&#x27;t easily spoof a &quot;True&quot;, all customers will be out of luck.<p>If the remote code execution is used to patch code without the administrator&#x27;s knowledge&#x2F;permission (haakon has a link saying remote code execution is possible) any&#x2F;all of the above are trivially easy to take advantage of.<p>Lastly - my understanding of bitcoin is a little fuzzy, but I believe with 50% of the computing power, you can rewrite transactions as you please, capturing as many bitcoin as you want. If you had a plan to not centralize those accounts, it would be extremely difficult to sort out.