Hijacking the connection between a powerful mining cluster and its mining pool, then impersonating the pool and claiming the mining results seems to be a likely attack.

How are mining pools authenticated to clients to avoid such attacks?


There is nothing to prevent such an attack.

A hacker that gains control of your computer could put entries in the hosts file on your computer to make it connect to the hacker's server instead of the servers you usually use. It would always accept whatever name and password you send and feed you work to generate coins for the hacker. A man-in-the-middle could also hijack your connection and make you mine for him.

Since getblocktemplate and getwork use HTTP they could use SSL to require the pool server to authenticate itself with a valid certificate but I'm not aware of any pools doing this. The Stratum protocol has no support for authentication. But I suppose it could also be run over SSL if server and client authors agreed to do this.


The mining pools do not authenticate themselves to the miners in any special way beyond what is used in their communication protocol. If the pool takes calls on a non-encrypted socket, the communication can be intercepted and changed - a normal man-in-the-middle attack. If a pool uses a SSH certificate, that is something that can't be mimicked by an attacker and would make such an attack impossible. The mining protocol itself does not add any extra security.

The person running the mining operation can always tell that something is fishy if they pay close attention to their miners' productivity and downtime, but that is not part of the protocol.

  • So usually there's not even SSL encryption going on in the connection?
    – Shnatsel
    Jun 5 '13 at 11:56

EDIT: I interpreted the question as considering a man-in-the-middle attack between the pool operator and the Bitcoin network (the other connected nodes/"clients"). So this is not an answer to the exact question asked, but also considers man-in-the-middle attacks involving mining pools.

Besides the correct answer that ThePiachu gave, it is important to note that a man-in-the-middle attack in your situation cannot make you any gain.

What the pool communicates are their newly fund blocks. These blocks contain the address that will receive the mined coins and the transaction fees. However, when you would change this address, the block will no longer be valid and will not be accepted. So, since the mining pool has the private key for that address, either they or no one will receive any coins.

Besides, unless you have a very advanced man-in-the-middle setup, the mining pool will notice that it's block was not accepted and will try to send it again. If it keeps failing, it knows something is wrong. You could also send the pool false messages in return but again, that would be difficult to do and would not gain you any profit at all.

  • 1
    not gain you any profit at all. Not true. If I can man-in-the-middle communication between you and the pool (eg, DNS hijacking), I can get you to mine blocks that I provide. That can be used to attack the network, or to mine for Bitcoins. As for it being detected, the mining pool would see you stop connecting, but that wouldn't be terribly suspicious.
    – Nick ODell
    Jun 5 '13 at 18:46
  • Ow, I interpreted the question as man-in-the-middle between the pool operator and the Bitcoin network. "Clients" is a little ambigues. Jun 5 '13 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.