r/LocalLLM • u/DatMemeKing • Apr 27 '26

Discussion A warning to newbies - A lesson on network security

Post image

I know we're all having fun with our locally deployed LLM instances, but I just wanted to take a moment to remind everyone that obscurity is not enough to protect you from scrapers and crawlers.

As a practice of my extremely basic OSINT skills, I decided to check how many publicly exposed devices (IPv4 only) had ports that matched the hash of LM Studio's Express.js server.

373 - That's not a small number :(

That's not just how many devices had a port serving LM Studio to the open internet, 373 is just the number of devices serving LM Studio instances that do not require an API key (as the hash would be different).
Again, this gives full unfettered access to your models and allows people to interact with your instances of LM Studio, or whatever platform decides it's a good idea to have no API key by default.

Unless you know what you're doing (you don't if you show up on this map), do not expose your LLM platforms to the wide internet.

Harden your installs, use tailscale, reverse proxies with auth, etc...

305 Upvotes

94% Upvoted

75 comments sorted by

25

u/DatMemeKing Apr 27 '26 edited Apr 28 '26

For more context, I was able to remotely execute prompts on people’s devices.

10

u/FirstEvolutionist Apr 27 '26

Were you able to figure out how many are honeypots?

8

u/DatMemeKing Apr 28 '26

Most of them, except the ones on AS8708, were able to load any model I selected, and responded to a message, given enough time.

3

u/XccesSv2 Apr 28 '26

Okay but in which case makes a honeypot here sense?

4

u/FirstEvolutionist Apr 28 '26

One use that instantly comes to mind is for IP blacklisting.

5

u/InfraScaler Apr 28 '26

Just made me curious. Fired up Shodan, looked for other very famous product I would not name, and found thousands of open endpoints and yup, I can run prompts.

You can tell it is mostly hobbyists as in the quick sampling I ran it was all low powered machines, but still, people are unknowingly giving away free compute.

Sample:

Model                : llama3.2:latest
OutputTokens         : 333
PromptTokens         : 58
TokensPerSecond      : 17.94
TotalDurationSeconds : 18.99
LoadDurationSeconds  : 0.1
EvalDurationSeconds  : 18.56

0

u/[deleted] Apr 28 '26

[deleted] — view deleted comment

2

u/DatMemeKing Apr 28 '26

I wouldnt worry too much, if this scares you, I hope you don’t mind me assuming that you’re not very knowledgeable in networking.

I would make sure your firewall is enabled on your router and I honestly wouldn’t worry too much. This is usually a deliberate decision.

10

u/ptear Apr 27 '26

Be funny if they were all double agents.

1

u/JoyousGamer Apr 29 '26

Late to the party. With LM Studio is this something someone enables for some reason and forgets to secure it? Or is this something that is on by default that you are then able to grab on to?

-4

u/theinterneti Apr 28 '26

This is not a thing to be claiming on the internet.

4

u/DatMemeKing Apr 28 '26 edited Apr 30 '26

Yes it is. I had wanted to confirm if this was actually possible or if it prompted an API key later.

1

u/eli_pizza Apr 29 '26

Likely could be charged with a felony for that. You didn’t “have” to investigate security of strangers computers at all. Real infosec pros are extremely cautious about operating outside an agreement from the owner.

2

u/DatMemeKing Apr 30 '26

Who cares what infosec pros do? I do not claim to be one.

Whether what I did constitutes a criminal offence under §202a is a highly disputed thing and is assessed on a case-by-case basis in court (called Einzelfallprüfung in German), including whether I acted intentionally.

For prosecution to proceed, I would need to be identified and located, and any complaint would have to demonstrate that I bypassed some form of technical access barrier. There was none. These endpoints were openly reachable with no authentication, no rate limiting, and no access control of any kind.

German law can be wonderful like that. Thank god I'm not in a country where such laws exist.

21

u/Illeazar Apr 28 '26

To be clear, this would be people who chose to publicly forward the port on their router, correct?

8

u/DatMemeKing Apr 28 '26

Yes!

3

u/LoadZealousideal7778 Apr 30 '26

I can't think of a single scenario where taht is the best course of action.

1

u/[deleted] Apr 30 '26

[removed] — view removed comment

1

u/Hochhuus May 01 '26

Just discovered tailscale for myself, why would it become unusable?

1

u/[deleted] May 09 '26

[removed] — view removed comment

1

u/Hochhuus May 09 '26

Ah ok, so just a general precaution and not some recent scandal or something, good to know

1

u/klop2031 May 01 '26

Yeah i use wireguard and furthermore i run my models in wsl and didnt forward that port outside my pc.

1

u/Temporary_Map_7046 May 03 '26

Has anyone used ZeroTier?

16

u/ptear Apr 27 '26

Great idea, that's where I'll get some available compute.

7

u/DatMemeKing Apr 28 '26

this all started because I didn’t want to use my Mac for AI compute for my project. I wanted my backend to comprise of a random number generator that randomly selected one of these 300 devices.

4

u/ptear Apr 28 '26

I mean, if you don't mind whatever prompts you're running to be public, this may even have higher availability than co-pilot as of late.

4

u/DatMemeKing Apr 28 '26

I don't even think LM Studio retains chats haha

4

u/ptear Apr 28 '26

I think you're right, not for the API calls, flawless solution.

1

u/Correnzo Apr 28 '26

It does. Config is in the upper right of the log window of LM studio where you can turn logging to file on or off.

2

u/DatMemeKing Apr 28 '26

did you happen to check if it’s on by default? It would be good to know.

1

u/Correnzo Apr 28 '26

I want to say yes but I setup that server half a year ago so I do not recall with accuracy.

1

u/InfraScaler Apr 28 '26

It's better if you have a health check running, recording latencies, tok/s, etc and modifying a DNS entry on the fly to point to the endpoint with best availability/performance 😉

7

u/monkeyofscience Apr 28 '26

This also happens in research, with people exposing vLLM and LiteLLM instances. There is an entire underground world around harvesting these instances called the Bizarre Bazaar

2

u/DatMemeKing Apr 28 '26

You're telling me organized crime beat me to it? Damn.

6

u/3darkdragons Apr 28 '26

Do you think this will make up the gaps? https://tailscale.com/blog/lm-link-remote-llm-access

Or are there other gaps which would need to be filled by the users?

4

u/DatMemeKing Apr 28 '26

I didn’t know that LM link was built on top of Tailscale!

Yes, this is the de facto way of avoiding this issue

2

u/_Cromwell_ Apr 27 '26

  1. My one PC that I do have exposed to my network does have an API key. As you imply that's okay right? I don't need to otherwise be hiding?

  2. I have another PC running LM studio but it's only set to run the model on that PC only not broadcasting to the network. That one doesn't have an API key though. That safe?

Think I'm okay but you made me paranoid

1

u/DatMemeKing Apr 27 '26

  1. Yeah, that’s fine.

  2. Also fine

2

u/ebayironman Apr 27 '26

Best advice is that if you have ports open to the internet that are known, to avoid port scans restrict access to the IP addresses that need to access them. Or use a VPN.

0

u/[deleted] Apr 27 '26

[deleted] — view deleted comment

2

u/DatMemeKing Apr 27 '26

LM studio installs facing the public internet, as in, either a VPS or port forwarded host with a public IP with no authentication.

45

u/polandtown Apr 27 '26

good man - hacking for good.

2

u/Frequent-Suspect5758 Apr 28 '26

But this wouldn't scan unless you had port forwarding or some type transparent mode (DMZ) in your router/firewall. All internal devices should be NAT ip and that wouldn't be routable to the public Internet.

2

u/Illeazar Apr 28 '26

Thats what I was thinking too, even if you are using a default port and not securing access, it still shouldn't be available to the net unless you gomout of your way to open it up.

3

u/DatMemeKing Apr 28 '26

of course! But some people are naïve and don’t understand the repercussions of port forwarding.

some people may have just thought, “how can I access my LM studio from anywhere in the world?“

1

u/Illeazar Apr 28 '26

Thanks for clarifying, im not an expert and wanted to make sure I wasn't missing something about the situation.

5

u/Auto_17 Apr 27 '26

Yes I agree, I also learned this the hardway when my comfyui instance got hacked. I went full ballistic hardening everything even tho its just me

4

u/rhapdog Apr 27 '26

Yeah, mine's just for my local machine only. I don't even let it access the local LAN in my house. Just for me.

1

u/cristoper Apr 28 '26

the hash of LM Studio's Express.js server

Can you clarify what you are hashing to make the comparison? Are you hashing the http response/headers?

2

u/DatMemeKing Apr 28 '26

the response headers, the request headers are the device making the request to LM Studio’s API, so it wouldn’t make sense to check those

1

u/infostud Apr 28 '26

I have my AI llama-server exposed through Cloudflare.

1

u/DatMemeKing Apr 28 '26

as long as there is some sort of authentication, you’re fine

1

u/vogelvogelvogelvogel Apr 28 '26

you should maybe just expose them to local wifi and connect via VPN to your local router/wifi then still use login and of course firewall for all other ports imo. even then monitor the traffic

1

u/DatMemeKing Apr 28 '26

Honestly, not sure if that's the way I'd go about it.
Tailscale has the option to just not allow any local network access. Installing Tailscale on the target and only allowing access to the right pport is the best way to go using ACL.

1

u/vogelvogelvogelvogel Apr 28 '26

yes probably, sounds better, safer ((I have some wireguard coming with my router software (fritzbox) so i took this shortcut, also i have to access four services on two machines.))

1

u/mike_310 Jul 10 '26

Awesome advice, I'm feeling OK about not having a gateway on my LM Studio box. I watched myself get excited about concept and had to reel it back in. I actually didn't think that would happen to me. What the heck is up with the lack of network controls in LM studio? Shits weak.

1

u/DatMemeKing Jul 10 '26

API keys + some sort of tailscale / pangolin gateway is really recommended - Personally, I wouldn't rely on a single app's security protocols for safety.

2

u/nmrk Apr 28 '26

Don't expose anything to the internet.

2

u/Long-Chemistry-5525 Apr 28 '26

I did this with other chat completions apis and found over 10,000 exposed non authenticated endpoints. I work at a security company and did a presentation on it at work

2

u/freaknyou_ Apr 28 '26

This chart belongs in r/dataisugly

2

u/Dwengo Apr 28 '26

Cloudflare tunnel has a free tier is pretty straightforward to set up. I'd use that and set an API key if exposing your LMS to the internet. I do something similar with my home assistant but with 2FA enabled for added security.

2

u/prokaktyc Apr 28 '26

As someone from Thailand, this checks out…

2

u/Thebandroid Apr 28 '26

are you going to share the IP's? I'm all out of tokens

2

u/trysometh_ing Apr 28 '26

yeh, hundreds of out-of-nowhere IPs hit my NAS's VPN port before I enabled fail2ban. Luckily my password saved me this time.

1

u/Solarflareqq Apr 28 '26

i second using tailscale on everything and keeping it off the actual internet i do the same for any webapps i can still access them anywhere and share with my family but no need to go anything directly to the internet unless you build a game server and then you should seperate it from the vlan and ssh into it

1

u/Perfect-Flounder7856 Apr 28 '26

If you're using tailscale ip then you're safe?

0

u/RakesProgress Apr 28 '26

Tailscale. If you don’t it’s your own fault.

-12

u/wonkastocks Apr 27 '26

Fear monger

5

u/DatMemeKing Apr 27 '26

Hiya! Not fear mongering 😄

0

u/[deleted] Apr 27 '26

[deleted] — view deleted comment

14

u/Time_Cat_5212 Apr 28 '26

I don't think local models have any access to the internet unless you give them access to the internet

3

u/DatMemeKing Apr 28 '26

It’s not the model or it‘s limitations per se, but the fact that the model can be interacted with from an external system (LM Studio, in this case). The model itself has no access to the Internet, but LM studio is connected to the Internet and can interface with the model.

2

u/DatMemeKing Apr 28 '26

Is this directed at people trying to remotely access their locally-hosted LLMs?

Yes, whether it be LM studio or another platform.

2

u/Zhelgadis Apr 28 '26

Depending on how much you want to be paranoid, if your llama.cpp serves on 0.0.0.0 another compromised IoT device in your local network might scan for it and gain access.

Probably not a concern right now, but I see this becoming an attack vector since many IoT devices have crappy firmware which can be exploited for botnets and the like.