Slush's bitcoin mining pool hacked

It seems that hackers have decided to start to target bitcoin related services in earnest as the latest organisation to fall prey is the very popular Slush's bitcoin mining pool that usually resides at https://mining.bitcoin.cz/ .

Slush's pool is the oldest mining pool and it started with a forum post on November 28, 2010 when the pool operator (Slush) literally invented pool mining when he suggested that "Join poor CPU miners to one cluster and increase their chance to find a block!".    While the suggestion was quite controversial at the time Slush wrote the first mining pool software (Called a "Cooperative miner" at the time) and the rest is history.

According to Slush he first noticed something was up when someone reset the password to his OVH Manager account at his hosting provider OVH.CO.UK Web Hosting Solutions.

What ensued was a short battle between the perpetrator and Slush resetting passwords in attempts to gain control of the pool.  While Slush does not have any evidence yet he says "So far it looks like yet another inside job, like Linode two years ago. Or attackers found some shortcut how to gain access to Manager without confirming the request from the email.".  Slush later goes on to say "For now I fully blame OVH for this issue."

Slush says he has now successfully managed to isolate and move the Stratum servers ( stratum.bitcoin.cz, stratum2.bitcoin.cz and stratum3.bitcoin.cz) to Amazon EC2 instances so as not to waste any hash power but as there is no safe database server the shares are not currently being recorded and Slush says "Because database isn't running and shares are not stored, I'll spread blocks mined during database outage to miners who'll continue mining on the pool since the database will be up again."

Slush also says that the mining pool will be back to normal operation soon after he fully migrates from OVH to Amazon EC2.

The first post on BitcoinTalk is available here or quoted below.

The pool has been hacked. Fortunately I noticed it fast enough, so I made database snapshot seconds before attackers overtake the database machine. I lost some amount of bitcoins, but I'll be able to recover it from my pocket. For now I'm evaluating what's next to do, because all machines in OVH has been compromised and they cannot be trusted anymore.

Full story:
Today at 3pm UTC I noticed that somebody succesfully resetted the password to OVH manager, the place where servers can be managed, restarted to rescue mode etc. I promptly resetted the password at OVH to something different and I also changed password on my email account and checked that there're no other active connections to my mailbox. I have to say that my mailbox is secured by OTP passwords and I take physical security very seriously, so nobody other had an access to my mailbox. I known that password-reset feature is quite popular attack vector, so I made everything possible to prevent it to happen.

By changing the password at OVH, all other sessions using the old credentials are automatically kicked from the Manager. I also cross-checked that nothing wrong happen to the servers at this time. Unfortunately I didn't find a way how the attackers got access to Manager, so I asked OVH support to provide some additional information and restrict Manager access to my IP range.

That's no surprise that OVH didn't respond to this ticket for hours, but at 11pm UTC I realized that there's another succesful password reset at OVH. This is complete mystery to me, because I'm aboslutely sure that nobody else had access to my mailbox and the email with reset link has been untouched (unread, not deleted). I'd say that attacker won't bother by changing status of the email to "unread", but he'd delete the email instead.

This time I realized that the attacker resetted the machine with the wallet to rescue mode, which means that I lost the control to this machine. I was still succesful by logging into the database and I took the snapshot of database and transferred it to safe location. Few seconds since the migration finished, attackers restarted all remaining machines to rescue mode.

So far it looks like yet another inside job, like Linode two years ago. Or attackers found some shortcut how to gain access to Manager without confirming the request from the email. I don't know what's worse option. I'll investigate this issue in detail later and I hope OVH won't close eyes to this.

I can recover the pool to the normal operation tomorrow.

Edit 01:38 UTC: Stratum servers are running on safe servers at Amazon. Mining works for now. I'll setup new database and webserver on trusted machines in few hours, so the pool will be back in full operation.Slush - BitcoinTalk