Specialists in a pentesting course have revealed the finding of a critical vulnerability in Lightning Network, a scale solution that aims to reduce costs and increase the speed of Bitcoin transactions. A developer working in Square’s cryptocurrency department revealed a potential attack system that allows funds to be withdrawn from lightning network.
According to the report circulating on the mailing lists of Lightning Network and Bitcoin developers, Matt Corallo, who was recently hired by Blockstream’s co-founder and Square’s cryptography department, revealed a potential attack vector present on Lightning Network.
Lightning Network was developed as a solution to the scaling problem, and aims to improve privacy and speed, as well as reduce costs on Bitcoin transactions. The development of this network is a process that has not stopped, although various security issues have also been identified, mentioning specialists from a pentesting course.
During a routine job on the Lightning Network, Corallo discovered a flaw that would theoretically allow a threat actor to withdraw funds on secure contracts (Hash Locked-Time contracts), which are smart contracts that allow parties to a transaction to confirm or deny the transaction. If no confirmation is received, the party in charge of sending the money may request a refund.
According to the pentesting course expert, the attack would allow the recipient of a transaction to prevent the party sending the money from being able to recover it if desired. Although Corallo offers several workarounds for this problem, these appear to be ineffective and complex to implement. Even so, the developer says this is not an urgently solving problem, as deploying an attack would also be complex.
Finally, Corallo notes that other researchers have also found other security flaws on Lightning Network. After countless attacks on the network, researchers were able to detect transactions from transactions and senders and receivers.
A couple of months ago, a team of Blockstream developers collaborated on an investigation into lightning’s polling mechanisms to determine whether their processes could be exploited by threat actors to gain access to sensitive data about cryptocurrency transactions. After the investigation, the specialists determined that there are two possible attack variants:
- A malicious actor, through an active probe, tries to determine the maximum amount that can be transferred through a connected target channel
- A time attack that is triggered when a hacker tries to figure out how close the destination of a routed payment is really
For further reports on vulnerabilities, exploits, malware variants and computer security risks you can access the website of the International Institute of Cyber Security (IICS), as well as the official platforms of technology companies.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
