Bitcoins

[Yoda]

Hello Techy Nerds.....

 

Got a bit of a problem at work where some f****r has put some mining software on a couple of our servers. Noticed we were losing a bit of CPU power etc and found that someone was mining for Bitcoins on them.

 

I work for a small company and the emloyess generally display a level of retardedness that woulld preclude it being one of them. Which makes me think it is someone from two IT companies who work for us. I got a consultant in to see if they could prove when it was installed - and if remotely by what IP - no proof as whoever had done it had hidden their tracks pretty well.

 

I see from Wikipedia / the net that Bitcoins have a bit of value to crooks and are used by people for trading dodgy images etc. I guess my questions are:

 

(1) Anyone got any ideas to catch the bastard/s red handed going forward?

(2) Are Bitcoins as dodgy as they sound?

(3) Should I just consign it to history and experience and do some more reguar checks?

 

Love me x

[bri]

done a bit of reading on BitCoins but I thought there was only so many out there and you couldn't generate anymore.

 

So are they using a botnet on your serves to try and generate more Bitcoins??

 

Bitcoins: What are they, and how do they work? | Technology | The Guardian

 

Bitcoin - Wikipedia, the free encyclopedia

 

I'd just send a circular round work saying what you've found and the co is looking into it further and just leave it at that.

[mlwilliams]

I didn't know anything about bitcoins until now but is there a way of checking if this certain person is transferring the bitcoins to another account/computer?

[Dan]

so how do you get these coins and what can you buy with them?

[DJLJ]

Hello Techy Nerds.....

 

Got a bit of a problem at work where some f****r has put some mining software on a couple of our servers. Noticed we were losing a bit of CPU power etc and found that someone was mining for Bitcoins on them.

 

I work for a small company and the emloyess generally display a level of retardedness that woulld preclude it being one of them. Which makes me think it is someone from two IT companies who work for us. I got a consultant in to see if they could prove when it was installed - and if remotely by what IP - no proof as whoever had done it had hidden their tracks pretty well.

 

I see from Wikipedia / the net that Bitcoins have a bit of value to crooks and are used by people for trading dodgy images etc. I guess my questions are:

 

(1) Anyone got any ideas to catch the bastard/s red handed going forward?

(2) Are Bitcoins as dodgy as they sound?

(3) Should I just consign it to history and experience and do some more reguar checks?

 

Love me x

 

1) Depends how good you are and how good he is. Start limiting different people's access to certain places, start reading logs, make sure people start changing passwords on a regular basis, pull down post-it notes of said passwords from their monitors, remove admin access for outside vendors etc. I know it can be a pain, but for all you know, they can be serving kiddie pr0n from your servers, not a good thing.

 

2) yes.

 

3) No.

 

hth.

DJLJ

[Lee909]

so how do you get these coins and what can you buy with them?

 

ill post th link to the podcast later on but kevin smith covered it in his podcast,jay and silient bob get jobs.Appartly the if a website tech nerds can find were they are buying anything from lsd to heroin online with bit coins as the are pretty much untracable,some sort of black market ebay.

[Yoda]

Cheers everyone.

 

The servers are password protected. Only one other person in the company knows the password and he barely knows how to turn his pc on. So I know it isn't him.

 

Which is why I think it is one of the two IT companies who need access to the servers. The one company who developed some software for us have only accessed the severs remotely and their access is limited to one ip address. I cannot get rid of them as we have spent a fair wedge on the system and they need to support it, make further developments as and when.

 

Could they gain access through a different ip if they were smart about it anyway?

 

I could get rid of the IT support company who look after all of our computers but largely they do a pretty good job. I'd also hate to get rid without any proof really. I'm not good enough to get into looking at it in any depth, I just manage the area as a part time activity so am in a bit of a pickle with it.

 

I've read quite a lot on the net about them and bitcoins value has lessened after a hack that took place somewhere or other recently. Still they appear to be all about trading dodgy images and drugs so don't feel it is ignorable.

 

I don't really want to limit access rights because I don't really have the hours in the day to manage it.

[Dan]

Cheers everyone.

 

The servers are password protected. Only one other person in the company knows the password and he barely knows how to turn his pc on. So I know it isn't him.

 

Which is why I think it is one of the two IT companies who need access to the servers. The one company who developed some software for us have only accessed the severs remotely and their access is limited to one ip address. I cannot get rid of them as we have spent a fair wedge on the system and they need to support it, make further developments as and when.

 

Could they gain access through a different ip if they were smart about it anyway?

 

I could get rid of the IT support company who look after all of our computers but largely they do a pretty good job. I'd also hate to get rid without any proof really. I'm not good enough to get into looking at it in any depth, I just manage the area as a part time activity so am in a bit of a pickle with it.

 

I've read quite a lot on the net about them and bitcoins value has lessened after a hack that took place somewhere or other recently. Still they appear to be all about trading dodgy images and drugs so don't feel it is ignorable.

 

I don't really want to limit access rights because I don't really have the hours in the day to manage it.

 

does your company actually have any of these paedo-coins yoda?? if not then why are you worried?

[Yoda]

 

does your company actually have any of these paedo-coins yoda?? if not then why are you worried?

 

Whoever installed the mining software gets them presumably. It uses the processor in the servers to generate them. The mining slows down the server so the software which is effectively a web service runs much more slowly than it should.

 

Even if you ignore the fact someone is using my server to do something dodgy / illegal the speed issue is something I need to avoid.