As if AI weren’t enough of a security concern, now researchers have discovered that open-source AI deployments may be an even bigger problem than those from commercial providers.
Threat researchers at SentinelLABS teamed up with internet mappers from Censys to take a look at the footprint of Ollama deployments exposed to the internet, and what they found was a global network of largely homogenous, open-source AI deployments just waiting for the right zero-day to come along.
175,108 unique Ollama hosts in 130 countries were found exposed to the public internet, with the vast majority of instances found to be running Llama, Qwen2, and Gemma2 models, most of those relying on the same compression choices and packaging regimes. That, says the pair, suggests open-source AI deployments have become a monoculture ripe for exploitation.
Ollama with standard Gemma2 model open to the Internet. What could go wrong?
I call out this one because the Chinese government has already examined it for exploits and flaws.
Letting it run outside a sandbox on the Internet is tantamount to sharing any information and capabilities it has with the CCP.
the Chinese government
the CCP
exposing something like Ollama to the public internet is a bad idea, full stop. there’s no need to bring “omg China scary” xenophobia into it.
Nothing xenophobic about it. That’s just the model we already have documented information about. Notice I mentioned CCP and government, not “the Chinese”.
That’s like calling someone an antisemite for being against the Israeli or Iranian government.
That’s just the model we already have documented information about.
OK. can you link to that “documented information”?
because I googled “gemma chinese government” and nothing obvious popped up. but maybe I’m just out of the loop when it comes to reasons we should be afraid of those nefarious Chinese people who work for the Chinese government and/or the (insert ominous music here) Chinese Communist Party.
Notice I mentioned CCP and government, not “the Chinese”.
uh-huh. so, a thought experiment:
a genie gives me the list of IP address ranges that the Chinese government is using when it scans the internet for potential exploits.
I’m going to run Ollama, and expose it to the public internet…except I’m going to deny all traffic to & from those specific IP ranges.
that’s still a bad idea, right? because there are many many many other possible threat actors?
this is like the difference between someone telling you “lock your doors at night because of burglars” vs “lock your doors at night because of black people”. you’re showing your whole ass when you talk about cybersecurity in general but then make the jump to “cybersecurity is important because those sneaky Asians will hack you”.
Or any number of malfeasants.
I like self hosting, but I won’t do AI.
It’s not an issue if you block it from accessing the Internet.
This applies to a lot of services. Only expose something publicly if the public need to access it, and make sure it’s properly secured. If it’s just for you or your family (or friends) to use, use a peer-to-peer / mesh VPN like Tailscale.
I mean, the article is talking about providing public inbound access, rather than having the software go outbound.
I suspect that in some cases, people just aren’t aware that they are providing access to the world, and it’s unintentional. Or maybe they just don’t know how to set up a VPN or SSH tunnel or some kind of authenticated reverse proxy or something like that, and want to provide public access for remote use from, say, a phone or laptop or something, which is a legit use case.
ollama targets being easy to set up. I do kinda think that there’s an argument that maybe it should try to facilitate configuration for that setup, even though it expands the scope of what they’re doing, since I figure that there are probably a lot of people without a lot of, say, networking familiarity who just want to play with local LLMs setting these up.
EDIT: I do kind of think that there’s a good argument that the consumer router situation plus personal firewall situation is kind of not good today. Like, “I want to have a computer at my house that I want to access remotely via some secure, authenticated mechanism without dicking it up via misconfiguration” is something that people understandably want to do and should be more straightforward.
I mean, we did it with Bluetooth, did a consumer-friendly way to establish secure communication over insecure airwaves. We don’t really have that for accessing hardware remotely via the Internet.
You generally have to intentionally make changes to your router’s firewall to allow inbound traffic through, though. I followed the ollama guides and I don’t remember any firewall changes.
Oh, yeah, it’s not that ollama itself is opening holes (other than adding something listening on a local port), or telling people to do that. I’m saying that the ollama team is explicitly promoting bad practices. I’m just saying that I’d guess that there are a number of people who are doing things like fully-exposing or port-forwarding to ollama or whatever because they want to be using the parallel compute hardware on their computer remotely. The easiest way to do that is to just expose ollama without setting up some kind of authentication mechanism, so…it’s gonna happen.
I remember someone on here who had their phone and desktop set up so that they couldn’t reach each other by default. They were fine with that, but they really wanted their phone to be able to access the LLM on their computer, and I was helping walk them through it. It was hard and confusing for them — they didn’t really have a background in the stuff, but badly wanted the functionality. In their case, they just wanted local access, while the phone was on their home WiFi network. But…I can say pretty confidently that there are people who want access all the time, to access the thing remotely.
Wait, wait! I saw this one. Terminator 3.
plot spoiler
A novel virus was breaking out all over the world and they had to release Skynet to kill it. Really it was just Skynet tricking the Defense Department into releasing itself into the wild by releasing the firewalls or somesuch.
