CVE-2022-24657
📋 TL;DR
Goldshell ASIC Miners v2.1.x contain hardcoded SSH credentials that allow attackers to remotely connect to the devices. This affects all Goldshell ASIC miners running vulnerable firmware versions, potentially giving attackers full control over mining operations.
💻 Affected Systems
- Goldshell ASIC Miners
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative control over mining devices, steal cryptocurrency, install malware, use devices for botnets, or destroy hardware through malicious firmware.
Likely Case
Attackers hijack mining operations to redirect cryptocurrency earnings, install cryptojacking malware, or use devices for DDoS attacks.
If Mitigated
With proper network segmentation and access controls, impact is limited to isolated mining operations with no access to other systems.
🎯 Exploit Status
Attackers can use standard SSH clients with known hardcoded credentials. No special tools or skills required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: No official vendor advisory found
Restart Required: No
Instructions:
No official patch available. Check Goldshell website or firmware repository for updates.
🔧 Temporary Workarounds
Change SSH Credentials
linuxImmediately change SSH passwords and disable default accounts
passwd root
passwd admin
userdel default_user
Disable SSH or Restrict Access
linuxDisable SSH service or restrict to internal network only
systemctl stop sshd
iptables -A INPUT -p tcp --dport 22 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
🧯 If You Can't Patch
- Isolate mining devices on separate VLAN with no internet access
- Implement network firewall rules to block SSH access from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Attempt SSH login with known default credentials (specific credentials not listed for security)Check Version:
cat /etc/version or check device web interfaceVerify Fix Applied:
Verify SSH login fails with old credentials and new credentials work📡 Detection & Monitoring
Log Indicators:
- Failed SSH login attempts from multiple IPs
- Successful SSH logins from unusual locations
- SSH brute force patterns
Network Indicators:
- SSH connections to mining devices from external IPs
- Unusual outbound traffic from mining devices
SIEM Query:
source="auth.log" "sshd" ("Accepted" OR "Failed") dest_ip="MINER_IP"