Bitcoin fee processor BTCPay Server has warned that bots are probing uncovered Lightning nodes for a possible path to administrative management.
The exercise follows a separate vital BTCPay vulnerability that attackers exploited a month in the past to acquire credentials defending LND nodes and drain service provider wallets.
BTCPay subsequently disabled exterior entry to LND, a broadly used implementation of Bitcoin’s Lightning Community, in its normal Docker deployment. The mission now says automated methods are concentrating on servers the place operators manually restored that entry, repeatedly calling an LND password-change endpoint.
The newest mechanism differs from the vulnerability exploited in August however may result in an analogous consequence: an attacker acquiring credentials that may management an LND node.
BTCPay mentioned the opening seems throughout a brief interval after LND restarts, whereas its pockets stays locked. Throughout that interval, the focused password-change technique doesn’t require a macaroon, the credential LND usually makes use of to authorize administrative actions.
Older BTCPay LND wallets compounded the chance by utilizing a shared default password. An attacker who may attain the interface earlier than BTCPay’s inner unlocker may probably submit that password first, change it, and request an administrator macaroon that provides management over the node.
BTCPay has not reported a profitable takeover by means of the newly noticed exercise or linked the bots to the attackers behind the August thefts.
BTCPay hardens nodes after August theft
The renewed probing extends a troublesome safety stretch for BTCPay, which acknowledged on Aug. 7 that attackers had exploited a vulnerability affecting all variations earlier than 2.4.2. That flaw allowed unauthenticated attackers to acquire LND macaroon recordsdata and use them to maneuver funds. BTCPay’s normal on-chain wallets had been unaffected.
Days later, the mission and its supporters supplied a bounty equal to 10% of recovered bitcoin, capped at 3 BTC, then price about $190,000. BTCPay additionally enlisted exchanges, blockchain analytics companies, and legislation enforcement in efforts to hint the stolen funds.
Model 2.4.4, launched Sept. 7, now addresses the situations behind the most recent assault path. New LND wallets obtain distinctive random passwords, whereas older installations utilizing the shared credential are migrated and have their passwords rotated.
BTCPay’s normal reverse proxy additionally blocks unauthenticated pockets setup and unlock strategies, closing the restart-time opening by means of its managed public community path.
These controls can not safe infrastructure operators configure independently. Directors who created their very own reverse proxy or in any other case uncovered LND publicly can nonetheless bypass BTCPay’s protections.
BTCPay has urged directors to put in model 2.4.4 and take away manually uncovered LND routes. A route-control change merged Sept. 11 offers a supported possibility for distant entry whereas conserving LND and Core Lightning interfaces disabled by default.
That leaves customized deployments because the rapid concern. Operators utilizing them should audit their proxy guidelines and migrate distant connections behind BTCPay’s managed controls whereas automated methods proceed trying to find reachable nodes.
