Error log homeassistant.log someone is trying to do mining ?!

SaintTDI · February 25, 2024, 9:06am

Hi all,

I’ve just seen these error logs in my homeassistant.log:

2024-02-25 00:32:21.331 ERROR (MainThread) [aiohttp.server] Error handling request
Traceback (most recent call last):
  File "/usr/local/lib/python3.12/site-packages/aiohttp/web_protocol.py", line 350, in data_received
    messages, upgraded, tail = self._request_parser.feed_data(data)
                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "aiohttp/_http_parser.pyx", line 557, in aiohttp._http_parser.HttpParser.feed_data
aiohttp.http_exceptions.BadStatusLine: 400, message:
  Invalid method encountered:

    b'{"method":"login","params":{"login":"45JymPWP1DeQxxMZNJv9w2bTQ2WJDAmw18wUSryDQa3RPrympJPoUSVcFEDv3bhiMJGWaCD4a3KrFCorJHCMqXJUKApSKDV","pass":"xxoo","agent":"xmr-stak-cpu/1.3.0-1.5.0"},"id":1}\n'
      ^
2024-02-25 00:32:23.359 ERROR (MainThread) [aiohttp.server] Error handling request
Traceback (most recent call last):
  File "/usr/local/lib/python3.12/site-packages/aiohttp/web_protocol.py", line 350, in data_received
    messages, upgraded, tail = self._request_parser.feed_data(data)
                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "aiohttp/_http_parser.pyx", line 557, in aiohttp._http_parser.HttpParser.feed_data
aiohttp.http_exceptions.BadStatusLine: 400, message:
  Invalid method encountered:

    b'{"id":1,"method":"mining.subscribe","params":[]}\n'
      ^
2024-02-25 00:32:24.498 ERROR (MainThread) [aiohttp.server] Error handling request
Traceback (most recent call last):
  File "/usr/local/lib/python3.12/site-packages/aiohttp/web_protocol.py", line 350, in data_received
    messages, upgraded, tail = self._request_parser.feed_data(data)
                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "aiohttp/_http_parser.pyx", line 557, in aiohttp._http_parser.HttpParser.feed_data
aiohttp.http_exceptions.BadStatusLine: 400, message:
  Invalid method encountered:

    b'{"params": ["miner1", "password"], "id": 2, "method": "mining.authorize"}\n'
      ^
2024-02-25 00:32:25.661 ERROR (MainThread) [aiohttp.server] Error handling request
Traceback (most recent call last):
  File "/usr/local/lib/python3.12/site-packages/aiohttp/web_protocol.py", line 350, in data_received
    messages, upgraded, tail = self._request_parser.feed_data(data)
                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "aiohttp/_http_parser.pyx", line 557, in aiohttp._http_parser.HttpParser.feed_data
aiohttp.http_exceptions.BadStatusLine: 400, message:
  Invalid method encountered:

    b'{"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"blue1","pass":"x","agent":"Windows NT 6.1; Win64; x64"}}\n'
      ^
2024-02-25 00:32:28.769 ERROR (MainThread) [aiohttp.server] Error handling request
Traceback (most recent call last):
  File "/usr/local/lib/python3.12/site-packages/aiohttp/web_protocol.py", line 350, in data_received
    messages, upgraded, tail = self._request_parser.feed_data(data)
                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "aiohttp/_http_parser.pyx", line 557, in aiohttp._http_parser.HttpParser.feed_data
aiohttp.http_exceptions.BadStatusLine: 400, message:
  Invalid method encountered:

    b'{"params": ["miner1", "bf", "00000001", "504e86ed", "b2957c02"], "id": 4, "method": "mining.submit"}\n'
      ^
2024-02-25 00:32:32.616 ERROR (MainThread) [aiohttp.server] Error handling request
Traceback (most recent call last):
  File "/usr/local/lib/python3.12/site-packages/aiohttp/web_protocol.py", line 350, in data_received
    messages, upgraded, tail = self._request_parser.feed_data(data)
                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "aiohttp/_http_parser.pyx", line 557, in aiohttp._http_parser.HttpParser.feed_data
aiohttp.http_exceptions.BadStatusLine: 400, message:
  Invalid method encountered:

    b'{"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"x","pass":"null","agent":"XMRig/5.13.1","algo":["cn/1","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","rx/0","rx/wow","rx/loki","rx/arq","rx/sfx","rx/keva"]}}\n'
      ^
2024-02-25 01:25:33.407 ERROR (MainThread) [aiohttp.server] Error handling request
Traceback (most recent call last):
  File "/usr/local/lib/python3.12/site-packages/aiohttp/web_protocol.py", line 350, in data_received
    messages, upgraded, tail = self._request_parser.feed_data(data)
                               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "aiohttp/_http_parser.pyx", line 557, in aiohttp._http_parser.HttpParser.feed_data
aiohttp.http_exceptions.BadHttpMessage: 400, message:
  Pause on PRI/Upgrade:

    b''
      ^

And I’m seeing these method called:
mining.subscribe
mining.authorize
mining.submit

Obviously I don’t have any integrations or what so ever on my Home Assistant configuration for mining, or anything for cryptocurrency.

Could be some integration, addon or HACS addon that wants to do some mining on my minipc? How can I find something about this stuff?

Thanks to all!

koying · February 25, 2024, 10:43am

Not one to fall for FUD, but it seems you are infected, indeed.

As it’s in the HA log, I’d say it’s not coming from an addon but an integration.
I’d first suspect integrations you would have installed manually. Do you have some and what are they?
Lastly, I’d check whatever you installed from HACS. Once an integration has been “accepted” in HACS, there is no further control on what the developper could push in an upgrade.

To check what custom integration you have installed, look at the /config/custom_components directory.

SaintTDI · February 25, 2024, 11:12am

Thanks for the kind reply!

So you think that I can search for “mining” in all files under /config/custom_components ? These are the directories under that path:

alarmo
alexa_media
browser_mod
custom_templates
hacs
midea_ac_lan
skyq
spotcast
ui_lovelace_minimalist
webrtc

Can I see all the code for this stuff on my HA installation or is not possible? I think they are quite basic components.

koying · February 25, 2024, 11:18am

Yes

Yes. In the terminal addon:

cd /config/custom_components
grep -r "mining" * > ../mining.find

and post the resulting /config/mining.find file to, e.g., pastebin for analysis

elchininet · February 25, 2024, 11:39am

Be aware that even if you cannot find the mining text in your custom integrations it doesn’t mean that a certain integration could expose a vulnerability that allows an attacker to explot it.

elchininet · February 25, 2024, 11:45am

To help with the search, looking at some of your logs, the attack is using the stratum-protocol.

gist.github.com

https://gist.github.com/itoonx/edb24f2edb8fd4fed09d7f02a5f4f6d6

Mining Software Developers

For mining software developers

Stratum protocol is based on JSON-RPC 2.0. In this chapter I expect that you're familiar with this protocol and you understand terms like "request", "response" and "notification". Please read JSON-RPC specification for more details.

For high level image of the Stratum protocol concept, please read Stratum protocol specification on Google docs. This document needs some care, but give you the basic examples how to connect to Stratum server.
Exception handling

Stratum defines simple exception handling. Example of rejected share looks like:

{"id": 10, "result": null, "error": (21, "Job not found", null)}

This file has been truncated. show original

LiQuid_cOOled · February 25, 2024, 11:56am

Are you on Docker or Container?

I remembered seeing this on Reddit a bit back.

https://www.reddit.com/r/homeassistant/comments/160um27/i_found_a_cryptocurrency_miner_in_my/

SaintTDI · February 25, 2024, 12:14pm

Sorry which other logs? First time that I have to look at logs so I don’t know other logs other than homeassistant.log

Thanks

balloob · February 25, 2024, 12:14pm

You are fine.

Someone is having a mining application and pointed it at your Home Assistant instance to login. As Home Assistant doesn’t speak the mining protocol, it logs an error and doesn’t process it.

We should make sure the error gets logged with some extra context.

SaintTDI · February 25, 2024, 12:14pm

I have Home Assistant OS.

LiQuid_cOOled · February 25, 2024, 12:17pm

Thats a bit scarier. Port forwarding enabled?

koying · February 25, 2024, 12:24pm

Ah cool. Not obvious it’s the server side throwing errors, indeed.

@SaintTDI Please mark balloob’s answer as the correct one for anyone stumbling on this thread in the future.

SaintTDI · February 25, 2024, 1:30pm

Ah ok! Thank you so much!

Can I do anything to block it?

elchininet · February 25, 2024, 1:54pm

It seems that is what is happening already, the call is being blocked/rejected, but it is being logged to make you aware of it

elchininet · February 25, 2024, 1:59pm

I was refering to the homeassistant log