Eclair patches browser attack that could hit Lightning nodes
An Oct. 15 Eclair release closes a route that let a web page abuse cached authentication to reach the node's API.
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
Key takeaways
- Eclair shipped a fix on Oct. 15 for a browser-based attack route to its API.
- The hole involved cached authentication being reused to reach the node's API.
- Browser interfaces that talk to Eclair directly must now add a backend.
- Node operators running Eclair should check they're on the latest release.
Eclair, a Lightning Network node implementation, has patched a flaw that could let a browser-based attack push commands to a node's API. The fix shipped in a release on Oct. 15.
What changed
The release blocks a route that depended on cached authentication. Here's the mechanism: a browser holding saved credentials could serve as the path into the node's API. The patch closes it.
A second change matters if you build on Eclair. Interfaces that run in the browser and talk straight to Eclair's API now need a backend in between. The direct connection is gone.
What we don't know
The source material doesn't say whether anyone exploited the issue, or how many nodes ran exposed setups. I won't guess. Eclair's release notes are the place to look for specifics.
Why it matters
Lightning nodes hold live funds in channels, so an API that accepts commands is a serious target. Running Eclair? Update. Built a dashboard or wallet front end that calls the node directly from the browser? Expect it to break until you add a backend, and read that as a feature, not a nuisance. The open question is how many other node tools still lean on the same shortcut.
Source: CryptoSlate
Top Crypto Casinos Right Now
🇦🇺 Showing sites that accept players from Australia Change country
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
More info Less info
Why we chose it: A US-oriented casino that turns away only New Jersey. The cashier takes crypto, but the site publishes fewer specifics than any operator we list.
- KYC
- Required
Restricted countries: New Jersey (US).
More info Less info
Why we chose it: One of the widest crypto line-ups of any book we list - seven coins with fast payouts - aimed squarely at Asia and Latin America rather than the US or Western Europe.
- Licence
- Curacao
Restricted countries: Austria, Belgium, Bulgaria, Cyprus, Czechia, Germany, Denmark, Estonia and 21 more.
More info Less info
Why we chose it: Built for American bettors, priced accordingly. Biggest welcome bonus of the five, attached to the heaviest rollover of the five.
- Online since
- 1994
- Licence
- Curaçao
- Payout time
- 24–48 hours (crypto)
- Wagering
- 18x sportsbook / 30x casino
- KYC
- Required
Restricted countries: Belgium, Costa Rica, Croatia, Curaçao, Aruba, Sint Maarten, Caribbean Netherlands, France and 11 more.
Mia Chen
Mia digs into DeFi and on-chain data, translating protocol mechanics into plain English for everyday readers.
