Malicious bots are actively probing exposed Bitcoin payment servers to steal master administrative keys
Bitcoin payment processor BTCPay Server has warned that bots are probing exposed Lightning nodes for a possible route to administrative management.
The exercise follows a separate crucial BTCPay vulnerability that attackers exploited a month in the past to receive credentials defending LND nodes and drain service provider wallets.
BTCPay subsequently disabled exterior entry to LND, a widely used implementation of Bitcoin’s Lightning Network, in its commonplace Docker deployment. The venture now says automated techniques are focusing on servers the place operators manually restored that entry, repeatedly calling an LND password-change endpoint.
The newest mechanism differs from the vulnerability exploited in August however may lead to an identical final result: an attacker acquiring credentials that may management an LND node.
BTCPay stated the opening seems throughout a brief interval after LND restarts, whereas its pockets stays locked. During that interval, the focused password-change technique doesn’t require a macaroon, the credential LND usually makes use of to authorize administrative actions.
Older BTCPay LND wallets compounded the chance by utilizing a shared default password. An attacker who may attain the interface earlier than BTCPay’s inside unlocker may probably submit that password first, exchange it, and request an administrator macaroon that provides management over the node.
BTCPay has not reported a profitable takeover by means of the newly noticed exercise or linked the bots to the attackers behind the August thefts.
BTCPay hardens nodes after August theft
The renewed probing extends a tough safety stretch for BTCPay, which acknowledged on Aug. 7 that attackers had exploited a vulnerability affecting all variations earlier than 2.4.2. That flaw allowed unauthenticated attackers to receive LND macaroon recordsdata and use them to transfer funds. BTCPay’s commonplace on-chain wallets had been unaffected.
Days later, the venture and its supporters offered a bounty equal to 10% of recovered bitcoin, capped at 3 BTC, then price about $190,000. BTCPay additionally enlisted exchanges, blockchain analytics companies, and legislation enforcement in efforts to hint the stolen funds.
Version 2.4.4, released Sept. 7, now addresses the situations behind the most recent assault path. New LND wallets obtain distinctive random passwords, whereas older installations utilizing the shared credential are migrated and have their passwords rotated.
BTCPay’s commonplace reverse proxy additionally blocks unauthenticated pockets setup and unlock strategies, closing the restart-time opening by means of its managed public community path.
Those controls can not safe infrastructure operators configure independently. Administrators who created their very own reverse proxy or in any other case exposed LND publicly can nonetheless bypass BTCPay’s protections.
BTCPay has urged directors to set up model 2.4.4 and take away manually exposed LND routes. A route-control change merged Sept. 11 offers a supported choice for distant entry whereas retaining LND and Core Lightning interfaces disabled by default.
That leaves customized deployments because the rapid concern. Operators utilizing them should audit their proxy guidelines and migrate distant connections behind BTCPay’s managed controls whereas automated techniques proceed looking for reachable nodes.
The submit Malicious bots are actively probing exposed Bitcoin payment servers to steal master administrative keys appeared first on CryptoSlate.
