Antivirus and access control in ASIC firmware

Built-in protection in AsicBoost firmware

Built-in protection: antivirus, firewall, access control

Mining viruses are real, they steal hashrate quietly and live on used hardware for months. The firmware can find them.

Antivirus module

A scanner and firewall against known malware for miners, among it AntBuild and Night Switcher. Software like that can swap the pool address, send part of the work elsewhere and hide from a quick look.

Useful above all on used hardware. An ASIC with a history is a pig in a poke: you do not know what was on it before you. The first thing to do after buying is to reinstall the firmware from scratch and check the system.

Access control

Changing the web interface and SSH passwords.
Changing the SSH port or turning it off completely, protection against brute force.
Managing API keys with the option to revoke any of them.
Logs that show attempts to interfere.

The firmware source matters more than any antivirus

Unofficial builds Modified firmware regularly turns out to carry hidden or inflated fees, backdoors and malware. A separate category is "builds with no fee": there the fee is usually still there, it just goes to somebody other than the developer.

Even built-in protection will not save you if malicious code is baked into the firmware itself. So the rule is simple: download only from a source you trust, and on used ASICs reinstall the firmware from scratch.

Honestly about the limits of this protection

Custom firmware does not go through the same certification as factory software, and there are no independent security audits of it. Known vulnerabilities in components can stay unpatched for a while. This is a risk of the whole class, and it applies to all custom firmware, not to one in particular.

Practical takeaway: keep your ASICs in an isolated network segment, do not expose their interfaces to the outside and keep the firmware updated. That closes the vast majority of real scenarios.

Quick answers

How do you tell that an ASIC has a virus?

Indirect signs: the hashrate on the pool is noticeably lower than in the interface, unknown addresses in the pool settings, restarts with no explanation.

Do I need an antivirus if the ASIC sits on a local network?

Infection more often arrives with used hardware and with unofficial firmware than from the internet. A scan does no harm.

Does the firmware protect against access by the hosting provider?

Partly: you control the passwords and keys yourself. Physical access is not closed by any firmware.

Written by Denys Klimchuk, ASIC repair and tuning engineer at asic.es.