Bitmain Introduces DDoS Mitigation to AntMiner S4 & S5

AntPool maintains numerous distributed proxy nodes, and changes IP address at regular intervals, rather than binding to a URL. The best measure one can take to protect against a DDoS attack is to not reveal IP addresses. If AntPool is under attack, an AntMiner machine with the new firmware installed will be able to detect the attack within 20 seconds and switch to a representative IP address, avoiding lost connections and financial damages.

In order to expose these hidden representative IP addresses, an attacker would have to own a physical AntMiner machine. This gives us the chance to target and discover the attacker’s real location and IP address, because which representative IP the miner connects to is dependent on the user’s physical location. We can continually change IP addresses for that region to narrow down the attacker’s real location, and eventually discover the miner’s MAC address and other unique identifying information.

An advantage to the aforementioned regional IP switching, is that only users located in the same region as the attacker will experience the effects of the attack, and even then only temporarily. Users mining in the affected region will have their machines then pointed to a new subset of representative IPs, further narrowing down the attacker’s location, until we can finally uncover the unique MAC address of the attacker’s miner, effectively identifying him.

It is important to note that this anti­DDoS firmware is an independent update, and has nothing to do with cgminer or the device driver. Due to the sensitive security nature of this software, the source code will not be open, in order to prevent attackers from discovering the exact logic used. Additionally, because this update requires the miner to communicate with its pool, for the time being this anti­DDoS update will only work on AntPool.

This firmware update has already been published in versions compatible with the S4 and S5 models of AntMiner.