Umbrel: [Security] Clickjacking Attack

[Rubinoussoren]

Issue:
While testing Umbrel for security vulnerability's we have discovered that Umbrel does not have any security headers in place. One of the security headers is "X-frame-options" With this header you keep the webpage from being run in an iframe. If an attacker would create a webpage that has the same button positions as those of Umbrel they would be able to execute a "Click-jacking Attack".
This will redirect the click a user executes to their Umbrel. In the attachements we have added a small html code that exploits the Iframe function to get users to click on buttons form Umbrel without them knowing they are interacting with their Umbrel webpage.
Clickjacking Example.txt
If the user would be at home and already logged in to their Umbrel it would enable the Attacker to try and get the user to click on position that correspond to buttons in Umbrel. This way they can send for example Bitcoins to their own wallet.

Fix:
Enable the security header X-Frame-Options: DENY to stop the Umbrel webpage from being used in an Iframe.

[lukechilds]

Thanks for the report, great spot!

Generally speaking Umbrel is still in beta and has not gone through much security hardening yet. See SECURITY.md for details.

That said, this is low hanging fruit and easy to fix so we should definitely get this resolved for the next update!

In future if you find any more security related issues it would be great if you could contact us privately first. That way we can push out a fix to users before the details are made public. Our fault, we should mention this in the README.md/SECURITY.md with contact details. I'll get that updated.

We don't really have much in the way of a bug bounty program yet since Umbrel is all still in beta, but if you send me a Bitcoin address I'll happily send you a $50 tip as a token of appreciation.

Thanks again!

[Rubinoussoren]

Sure thing, we are doing this as a school project so happy to help!
When and if we find some more Issue's i will send it privately, sorry should have thought of that before posting it.
As mentioned before we are happy to help make Umbrel more secure and are not looking for any financial compensation, use the money to further improve Umbrel and we will be further testing Umbrel in the coming 6 weeks and let you know if we find anything else!

[lukechilds]

Great, thanks!

Also re this:

This way they can send for example Bitcoins to their own wallet.

I'm not sure how feasible this attack would be. The attacker can only really trick the user into clicking stuff. So they would still need to somehow convince the user into manually entering the attackers address in the receive input and drag the fee slider without them realising what's happening. Not impossible, but I don't think it's that plausible.

I'm interested to hear if you think that's not the case?

This is definitely a valid issue though. I think a more plausible attack would be clickjacking to make the user shutdown their Umbrel, close Lightning channels, or any other functionality that can be done purely via clicks.

[Rubinoussoren]

Yea you are right the attacks you mentioned are definitely more valid and seem easier to get a victim to execute. There is a way to get a predetermined string in a user's clipboard if some would take the time to make a very convincing webpage. when a user would copy something to an input field the string that the user would copy could be changed to the predetermined string that is programmed in the attack.
To be honest myself and my team member do not have the skillset to test this theory.
Here are some other links that seem to show how to execute this:
https://blog.securelayer7.net/exploiting-browsers-using-pastejacking-and-xssjacking-vulnerability/
https://github.com/dxa4481/XSSJacking
https://github.com/dxa4481/Pastejacking

[lukechilds]

Thanks for the links @Rubinoussoren, fixed in https://github.com/getumbrel/umbrel-dashboard/pull/333!