A serious bug was found in the Linux kernel, the core of the operating system under both StartOS and Umbrel. A working attack has been shown against Lightning nodes that accept connections directly from the internet. A fixed kernel has to come from Start9 and Umbrel in an OS update. Until then, this is what to do.
Am I affected?
Only if your Lightning node accepts connections from the internet without Tor. Nodes that use Tor only, which is the default on both StartOS and Umbrel, can’t be reached by this attack.
To check, look at your node’s connection address, also called the node URI, in your Lightning app. If every address ends in .onion, you’re Tor-only and not exposed. If one of them is an IP address or domain name, such as 03abc...@203.0.113.5:9735, your node is reachable over the internet.
If you’re reachable over the internet
- Remove the port forward for your Lightning port, usually 9735, from your router.
- If you set up a public address in your Lightning app’s network settings, or use StartTunnel or a VPS for Lightning, remove that address and keep only Tor.
- Leave it that way until you’ve installed a StartOS or Umbrel update that includes the kernel fix. I’ll post here when those are out.
Your channels stay open while you do this. Peers that have your onion address can still reach you, and your node can still connect out to anyone.
Updates from me
I’m releasing an update to Lightning Fork that turns off the network feature the known attack relies on (MPTCP). Please install it, but it doesn’t replace the steps above. The underlying bug is in the kernel, and only the OS update fully fixes it.