Hello! Over the past month, a few friends and I have built a terminal UI-based tool that has the intention of exploiting and testing the lightning network. This project is called LNsploit. We have built this off of LDK which allows for more advanced features that typical node implementations do not offer out of the box.
The plan was to demo this at TAB Conf on Thursday with a few cool features built in. One that I am excited to share is that we have reproduced and added the ability to broadcast a large script transaction similar to the one that had affected almost all LND nodes earlier this week. This is all done with a single key press while connected to a bitcoind node backed with funds. You can test this today by hooking up to your local network like with Polar on regtest. I suspect this could also be useful in allowing people to explore what had happened and how this had affected those LND nodes. All props to Ben Carman for building that portion in a few dozen lines of code.
While most of the screens and general node logic are still TBD, a few things do work like spinning up many LDK nodes instantly and connecting to channel peers. I had hoped to have more done before the workshop at TAB conf but hey there are still a few days left to polish this up - most of the logic is there, just untested while we are still hooking in screens. The workshop is at 11:30 am on Thursday in case you were interested in joining.
Anyways, I hope to have a lot of useful tools in this that may assist testers and developers. Things like channel jamming, balance probing, broadcasting old revocation transactions, etc. We need to be operating in an adversarial mindset if we're going to fix anything that might need to be fixed and one of the only ways to do that is with efforts like these. Please use this ethically, responsibly, and only on nodes that you have permission to attack.
Huge shout outs to Paul Miller, w3irdrobot, and ben carman for helping with this. Let me know what you think and any questions you may have.
If something is broken I suppose it's best to find out during a bear market when there is less news about bitcoin going about.
*makes sure has node backup
reply
22,000 sats in 30 mins for this post, very much deserved. I love seeing stuff like this.
reply
Totally not a self-payment to bump the post up.
reply
You can hover over the thing and see that 34 users upvoted it. There are also plenty of comments...
Are you projecting? ;)
reply
20 sats \ 1 reply \ @ek 11 Oct 2022
Wow, didn't know you can see how many users upvoted it. Thanks! Makes me wonder what else I don't know about SN ...
reply
TIL too! Great feature
reply
Now that’s the kind of adversarial thinking we need!
There should be a workshop at TABConf where builders make a STACKERNEWsploit bot that you can pay to generate fake upvotes for stacker news posts. If we don’t do it first, someone else will.
reply
I see they had a 5000 sat boost and due to the seemingly genuine effort put into the post and the content itself it hadn’t even occurred to me they would use an alt account to self promote. You’ve made a good point though, something to be aware of.
reply
~ smiles nervously ~
reply
May be not a bad thing. I was thinking more about building with workflow library and a set of various scripts. Multisig bug may be a good illustration however in most cases services loose money on something like fee siphoning attack.
reply
Is it normal that I cannot do much? Pressing the exploit button doesn't do anything.
reply
Oh yeah that's totally my bad, I did not wire in any success/failure notifications yet. There's a logs.txt that I have been using so far to see if things work lol. If you go into that log file do you see anything along the lines of "broadcasted tx"? There's a bug I need to figure out where it might have a 50% chance of failing because I guess the output index of the tx, but pressing it a few times should work and you should see some stuff happen in the logs.
Also, one interesting thing about the LND nodes that had this affected to, they seem to work just fine for awhile. But in polar you will see something like "not synced to chain" and then if you restart the node, you will no longer be able to access its APIs.
Edit: does the exploit button at least switch you over to the exploit screen with the LND transaction action? Like in the screenshot on the github page?
reply
This makes me want to learn to develop and contribute, thanks!
reply
Thank you for this work.
Any developer worth their salt will recognize how critical it is to have and use stress-testing tools.
It would be amazing if all LN node developers could integrate this as part of their automated tests.
reply
Sounds like a cool project.
So more details to follow after the demo @TAB Conference?
reply
Thanks! And yup, I should hopefully have more in it by the conference but will also keep iterating on it over time and personally use it for various lightning testing and development. So I'll be adding things as I want to use them.
reply
and on that day, the first node boxing playbook was born
reply
Good. Thank you for your hard work. We need to make sure that LN is stable and sound. It's the god damn future of payments and invoices and needs to be constantly vetted.
reply
Soooo... the cat and mouse game has begun? 😂😂
reply
I get
www.nakamoto.codes refused to connect.
reply
The domain operator has shut it down so I'm hosting it on github now: https://github.com/TonyGiorgio/LNsploit
reply
Interesting stuff! I hope you guys can find and fix lot's of attack vectors.
reply