Information shared via email with the editorial team of SecNews states that servers & terminals belonging to Greek public services have been identified and are being used to mine Bitcoins, the well-known electronic currency of the digital age!!
Bitcoins are an online transaction network that uses an alternative, digital currency, which is bought and sold directly by its owners, without the intervention of a bank or other traditional organization. In other words, it is a payment system that allows the exchange of goods and services (with payment in bitcoins) anonymously and securely. One of the ways to acquire bitcoins is mining, by installing the special program and participating in the transaction network. The mining process , however, is extremely slow and requires very powerful computers that must operate for months to produce new coins. It is worth noting that although bitcoin is an extremely rising currency due to its anonymous disposition, it is particularly widespread on the “dark web” and users use it to buy drugs, cocaine(Silk road), fake identities/passports, weapons and even money laundering and child pornography!
The information that the reader sent to SecNews (ed. his details are at the disposal of the editorial team) states very clearly and beyond any doubt that IP addresses belonging to SYZEFXIS (the well-known network of Greek Public Sector entities) appear on Bitcoin mining lists! In practice, this means that computers (or even devices) with high processing power (i.e. resources of the Greek State) located within these specific networks are used for the mining of digital currencies by unknown persons, we assume without the knowledge of the competent authorities or executives of the competent services!!!
As we found out after the information reached the editorial team, on a well-known foreign website where the IP addresses/users connected to the bitcoin mining network with the highest number/speed of digital currency creation are presented, a number of IP addresses belonging to the Greek Public Services network. See below:
– 84.205.227.45 (host-84-205-227-45.cpe.syzefxis.ote.gr)
– 84.205.231.41 (proxy07.syzefxis-hosting.gr)
– 84.205.236.7 (host-84-205-236-7.cpe.syzefxis.ote.gr)
Furthermore, among others, IP addresses belonging to the Greek National Research and Technology Network (GRNET) appear as Bitcoin miners.
– 83.212.110.224 (snf-157003.vm.okeanos.grnet.gr)
– 83.212.111.114 (snf-475231.vm.okeanos.grnet.gr)
– 83.212.123.135 (snf-44321.vm.okeanos.grnet.gr)
[Note from Reddit: We were informed by Reddit (we warmly thank the moderators of /r/greece) that these machines are machines from the Greek National Economic Network service called OKEANOS, where anyone can create Virtual Machines and do with them (almost) whatever they want. For academics/students, it is free.]
The total number of IPs published on the website https://bitinfocharts.com/bitcoin/nodes/greece/athens.html is listed below (you can check if any of the IPs below belong to you since other IP addresses are also displayed)
[box_dark] 2.84.12.57
2.84.22.144
37.6.116.255
46.12.21.129
46.103.82.138
46.103.205.182
46.176.21.105
46.176.85.67
46.177.31.148
46.177.111.221
46.177.250.29
46.190.2.8
46.190.8.189
46.190.91.58
46.246.132.99
46.246.154.195
46,246,228,174
46.246.232.99
46.246.241.188
62.1.64.190
62.1.105.130
62.1.195.134
62.38.100.60
62.38.133.109
62.38.221.170
62.38.242.67
62.103.21.25
62.169.237.195
77.49.58.192
77.49.61.156
77.49.64.189
77.49.70.72
77.49.138.161
77.49.166.59
77.49.166.250
77.49.198.210
77.49.215.145
77.49.244.179
79.107.53.111
79.107.62.61
79.107.83.59
79.107.171.54
79.107.184.97
79.107.190.237
79.129.12.54
79.130.119.4
79.131.81.169
79.131.83.175
79.131.103.93
79.131.241.105
79.166.31.249
79.166.32.227
79.166.52.246
79.166.76.190
79.166.79.170
79.166.88.9
79.166.92.184
79.166.118.87
79.166.128.219
79.166.131.71
79.166.141.183
83.212.110.224
83.212.111.114
83.212.123.135
83.235.235.234
83.235.253.216
84.205.227.45
84.205.231.41
84.205.236.7
85.72.38.204
85.72.43.57
85.72.56.72
85.72.63.24
85.72.87.61
85.72.204.159
85.72.210.243
85.72.233.220
85.73.118.212
85.74.117.79
85.74.133.247
85.75.249.235
85.75.252.213
87.202.71.250
87.202.76.249
88.197.53.228
88.218.57.160
88.218.58.247
89.210.6.162
89.210.82.30
89.210.87.36
89.210.132.88
89.210.156.6
89.210.163.244
91.132.178.106
91.138.132.165
91.138.138.89
91.140.49.61
91.140.71.11
91.140.72.120
91.140.74.8
91.140.76.56
91.140.80.12
91.140.123.168
92.118.120.185
92.118.152.101
92.118.167.214
92.119.192.174
94.64.116.18
94.65.61.164
94.65.241.76
94.65.242.83
94.66.28.236
94.66.34.51
94.68.239.82
94.68.243.78
94.68.250.210
94.71.1.105
94.71.7.115
94.71.56.32
94.71.158.121
94.71.189.97
94.71.215.190
94.71.217.131
94.71.217.157
109.242.33.38
109.242.39.240
109.242.53.15
109.242.60.55
109.242.189.213
130.43.7.53
130.43.44.235
130.43.51.57
130.43.55.60
141.237.97.111
141.237.206.150
147.102.3.35
147.102.224.227
176.58.237.29
176.92.74.198
176.92.179.133
178.59.182.181
178.128.5.223
178.128.24.57
178.128.27.192
178.128.54.214
178.128.54.230
178.128.62.252
178.128.64.124
178.128.139.91
178.128.163.226
178.128.171.46
178.128.224.42
178.146.39.66
178.146.53.163
188.4.32.14
188.4.171.238
188.4.238.244
193.92.58.244
193.92.77.112
193.92.143.100
194.219.117.186
194.219.127.86
195.74.224.130
195.167.30.249
195.251.248.181
212.70.210.59
212.251.106.13
213.16.164.251
213.16.165.233
213.16.182.61 [/box_dark]
SecNews Technical Team Note
It has not been clarified whether the Bitcoin mining is done by devices, servers or terminals. The only thing that is certain is that the devices that perform the mining are within the networks in question and of course have enough processing power to make sense to use them. In addition, as experts we contacted about the incident emphasize, it is possible that malware has been installed remotely without the knowledge of the administrators that allows Bitcoin mining to be carried out. See the relevant graph that suggestshow this may have happened:
We should also mention that bitcoin mining can also be carried out using Android devices and even through cameras!
Questions – Actions of involved organizations/companies
First of all, the companies/organizations and public services that appear on the above list must IMMEDIATELY conduct an internal investigation in order to check for the existence of bitcoin mining software in their infrastructures but also for the existence of malware installed that carries out mining without their knowledge! There is a possibility that either the mining is carried out by an internal employee of the services (with the aim of financial gain) or even without the knowledge of the executives if malware has been installed! The IT departments should IMMEDIATELY determine if there are remote connections to terminals or servers.
The sender of the extremely interesting information emphasizes that the equipment needed to mine on such a large scale requires thousands of euros, while the electricity consumption is very high. He therefore reasonably wonders if this is being done with the knowledge of the authorities:
- Where did the money for the purchase of the equipment come from?
- Who pays the electricity bill for mining bitcoins?
- and of course where do the bitcoins from mining go since it is money created by public infrastructure at the expense of taxpayers
Social contribution of SecNews
The SecNews team proceeded to share the above important information for reasons of protection of society as a whole and the public services mentioned in the list.
We request the contribution of individual security researchers or any citizen, if they wish, to notify us via the contact e-mail (info@secnews.gr), via Social media or on the anonymous complaints phone number (+302111984444) of corresponding cases that have come to their attention or are the product of an investigation.
The goal of SecNews is, through the above action, to contribute to knowledge and provide immediate mass information on the issues of IT security, hacking and data protection from weaknesses or omissions that expose the infrastructure of companies, organizations, public services and bodies.
SecNews thanks the aforementioned reader for the timely and accurate information
[Reader's note/25.4.2014/16:24] After the publication of the article, a reader/friend of the website specifically states "Are you saying that Mr. Stournaras found other resources to cover the budget deficit?"
[Editorial team note/27.4.2014/00:31] Because there were questions regarding the technical references in the article, we clarify the following:
- IPs appearing in the list of bitcoin nodes does not NECESSARILY mean that they are mining.
- Full Bitcoin Nodes provide a complete copy of the block chain stored on disk(which is constantly growing) and are responsible for synchronizing new nodes but also validating blocks and transactions and relaying them (hence network load). In practice, they share the blockchain using the bandwidth of each machine that has the software installed.
- Some "open" ports are required for each bitcoin full node to operate within an internal network or DMZ (e.g. port forwarding of port 8333).
- The additional open doors pose security issues in the event of exploitation of the Armory or Bitcoin-QT software mostly used in bitcoin full nodes.
- Regarding the issue of resource consumption, of course there is an additional burden. Both in disk and network load when sharing the blockchain on the decentralized network.
- The editorial team CLEARLY SUPPORTS the electronic decentralized currency bitcoin and any similar digital currency.
- In any case, however, it is our firm position that no one can participate in this (either as a full bitcoin node or as a miner) without knowledge of the services ILLEGALLY with resources provided by the Greek government and by extension every Greek taxpayer, due to the ignorance of those responsible.
- Mining is now carried out to a small extent using CPU/GPU, with specialized hardware devices (ASIC) as friends of the website reported, but now mainly via Cloud
- Research institutions (such as the Hellenic Scientific and Technological Fund) must, of course, within the framework of their research activity, support & promote the research and development of decentralized cryptocurrency.
