{"id":10310,"date":"2022-03-31T15:31:45","date_gmt":"2022-03-31T15:31:45","guid":{"rendered":"http:\/\/ci029d8720f00027cb"},"modified":"2022-03-31T15:31:45","modified_gmt":"2022-03-31T15:31:45","slug":"basic-threat-modeling-for-bitcoin-mining-at-home","status":"publish","type":"post","link":"https:\/\/bitcoinmagazine.com\/business\/basic-threat-modeling-for-bitcoin-mining-at-home","title":{"rendered":"Basic Threat Modeling For Bitcoin Mining At Home"},"content":{"rendered":"
<\/div>

Home mining is one of the best expressions of individual sovereignty available, but every retail mining operation carries a variety of risks that need to be accounted for and mitigated as much as possible.<\/p>\n

Broadening awareness of the benefits of converting electricity into KYC-free units of censorship-resistant internet money in a basement, garage or backyard shed has been a key catalyst<\/a> for the ongoing surge<\/a> in at-home mining. But just like storing private keys can involve tedious operations security (OPSEC) measures and careful planning, every serious miner must also consider the risks and vulnerabilities of their home mining operations. Unlike secure storage planning, however, mining faces a significantly wider array of heightened risks.<\/p>\n

Understanding these risks and modeling responses to prevent or react to attack scenarios is essential for long-term, at-home mining success.<\/p>\n

Home Bitcoin Mining Vulnerabilities<\/h2>\n

Theft is the most basic and obvious vulnerability to at-home bitcoin miners. For starters, every mining operation regardless of scale involves at least one rather valuable piece of computing equipment<\/a> \u2014 a bitcoin ASIC miner \u2014 built with precious metals and specialized microchips that sells for anywhere from a few hundred dollars to over $10,000 at current prices, depending on the model<\/a>.<\/p>\n

Visibility is also a concern. How conspicuous is a mining setup? Just like publicly advertising large amounts of bitcoin-denominated wealth is always ill advised, distinctly noticeable mining setups aren\u2019t always the safest. Noise levels, heat signatures, spiking electricity bills and other signals are easy giveaways (with relatively simple mitigations) to close neighbors or utility companies that someone is probably mining bitcoin<\/a>. Consider a permanent bare spot on an otherwise snowy roof or an ongoing 80-decibel fan noise as examples, and the point is made.<\/p>\n

Custody is also a key consideration since miners are responsible for managing the security of each step in the flow of mining rewards from their pool accounts to cold storage.<\/p>\n

The list of potential vulnerabilities goes on, and not every mining operation faces the same types or degrees of risks. But every setup has risks. Beyond just acquiring hardware, transmitting power and building efficient airflows, modeling these risks is an essential part of every miner\u2019s planning.<\/p>\n

Threat Model Basics For Home Bitcoin Mining<\/h2>\n

So, what is a threat model?<\/p>\n

The term \u201cthreat model\u201d is just a fancy way of expressing what someone is defending and who they\u2019re defending it from. And unlike a financial model, threat models are minimally mathematical and highly intuitive and deductive in assessing what risks exist and how to mitigate them.<\/p>\n

Consider the example of cannabis farmers who doubled as bitcoin miners<\/a> outside of the U.K. city of Birmingham. Police inadvertently discovered their illegal bitcoin mine while raiding their illegal cannabis farm. It\u2019s safe to say that the threats facing this cannabis-bitcoin venture were poorly modeled and mitigated, if at all.<\/p>\n

For most technology companies, threat modeling usually involves code review and software changes. For most humans, day-to-day threat modeling is intuitive, which is why most people prefer well-lit walkways to dark alleys. For miners, the same sort of threat assessments affect a variety of software, firmware and hardware products.<\/p>\n

Building A Home Bitcoin Mining Threat Model<\/h2>\n

Threat models can be as complex or simplistic as the creator wants. But a home miner can\u2019t adequately prepare against potential threats if they don\u2019t understand what risks they face.<\/p>\n

Setting the scope of a threat model is the first and possibly most important step. Think carefully about what needs protecting (e.g., mining hardware, site access, electrical and cooling infrastructure, internet access, payout deposits and wallet storage) and who it needs protection from (e.g., friends and family, neighbors or unexpected visitors, targeted attacks). Of course, not every miner faces the same potential risks. Someone with two S9s in a suburban neighborhood deals with different risks than a landowner in the Midwest with a dozen S19s on 80 acres. But listing any possible attack scenario is key to setting the scope of the model. <\/p>\n

The key to making this list is simply asking, \u201cWhat could go wrong?\u201d Any answer gets added to the list.<\/p>\n

Focusing on pool accounts and payout withdrawals, for example, this aspect of a mining threat model would include pool account security and planning strategies and tools to account for vulnerabilities in password protection, two-factor authentication, payout address reuse, etc.<\/p>\n

Likelihood and effort are two additional considerations. Take the \u201cbad scenario\u201d list and use basic probabilistic attack analysis to evaluate how likely each risk in the list is to happen. After ranking these scenarios, decide how much effort and preparation each item deserves. This involves two steps phrased as questions. First, what mitigatory steps are required for a particular risk? Second, based on the perceived likelihood of a given threat, how much effort is a miner willing to give to prevent it? There is no rulebook or answer key for this process. Each of these steps are up to the discretion of the miner.<\/p>\n

\u201cLet\u2019s build a threat model\u201d isn\u2019t usually the first thought a home miner has when planning their operation, but this extra OPSEC work can avoid serious problems in the future. And threat modeling really isn\u2019t that complex. But, like any other aspect of OPSEC, threat analysis is best thought of as an ongoing process that can always be adapted and refined, not a finished task.<\/p>\n

Additional Resources<\/h2>\n

Nothing in this article is meant to be an exhaustive explanation of how to safeguard a home mining setup. Instead, the goal of this article is to provide a simple breakdown of what threat models are, how miners can use them and encourage home miners to begin building one of their own.<\/p>\n

Continue reading about threat modeling and how to develop one for a mining operation with these resources:<\/p>\n