Eclair patches browser attack that could hit Lightning nodes
An Oct. 15 Eclair release closes a route that let a web page abuse cached authentication to reach the node's API.
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
Key takeaways
- Eclair shipped a fix on Oct. 15 for a browser-based attack route to its API.
- The hole involved cached authentication being reused to reach the node's API.
- Browser interfaces that talk to Eclair directly must now add a backend.
- Node operators running Eclair should check they're on the latest release.
Eclair, a Lightning Network node implementation, has patched a flaw that could let a browser-based attack push commands to a node's API. The fix shipped in a release on Oct. 15.
What changed
The release blocks a route that depended on cached authentication. Here's the mechanism: a browser holding saved credentials could serve as the path into the node's API. The patch closes it.
A second change matters if you build on Eclair. Interfaces that run in the browser and talk straight to Eclair's API now need a backend in between. The direct connection is gone.
What we don't know
The source material doesn't say whether anyone exploited the issue, or how many nodes ran exposed setups. I won't guess. Eclair's release notes are the place to look for specifics.
Why it matters
Lightning nodes hold live funds in channels, so an API that accepts commands is a serious target. Running Eclair? Update. Built a dashboard or wallet front end that calls the node directly from the browser? Expect it to break until you add a backend, and read that as a feature, not a nuisance. The open question is how many other node tools still lean on the same shortcut.
Source: CryptoSlate
Top Crypto Casinos Right Now
🇬🇧 Showing sites that accept players from United Kingdom Change country
Advertising disclosure: we may earn a commission when you join an operator via links on this page, at no cost to you. This never dictates our ratings. How we make money
More info Less info
Why we chose it: A US-oriented casino that turns away only New Jersey. The cashier takes crypto, but the site publishes fewer specifics than any operator we list.
- KYC
- Required
Restricted countries: New Jersey (US).
More info Less info
Why we chose it: The LatAm door of the BetNow platform: Spanish-first, a 200% welcome at 20x rollover, and a weekly 2% rebate. Crypto rails unconfirmed — check before depositing.
- KYC
- Required
Restricted countries: Australia, Costa Rica, Central African Republic, Congo - Brazzaville, Eritrea, France, Guinea-Bissau, Iraq and 15 more.
Mia Chen
Mia digs into DeFi and on-chain data, translating protocol mechanics into plain English for everyday readers.
