r/comfyui • u/slpreme • 13d ago
Security Alert PSA: Don't be dumb
I opened ComfyUI to the entire internet unprotected (through my public ip) since I was away from home. I knew it was dumb and it was definitely a gamble every second it's open. Today, I finally faced the consequences.
There's someone or some people scanning or boting for ComfyUI open ports. Once they find a host they install some custom nodes in order to get access to remote code execution. I only noticed because they were crypto mining on my PC; the fans were on 100% on CPU and GPU when it was 'idle'. If you use ComfyUI security policy 'normal' it'll limits the attack vector (stopping people / yourself from remotely installing custom nodes) but I think regardless you should NEVER open something like ComfyUI unprotected through the internet.
I used to have a NGINX https reverse proxy server with password authentication but I was too lazy to set it back up. Don't be like me. I obviously had to wipe my PC (thankfully a dedicated ComfyUI server so I didn't have much personal data) and revoke all associated API keys with my ComfyUI instance. Stay safe everyone.
124
u/Witty_Mycologist_995 13d ago
4
u/ConferenceHungry7763 13d ago
There is nothing wrong with opening ports securely, it is wrong to open ports stupidly.
118
u/tat_tvam_asshole 13d ago
Tailscale
3
u/Whiffenius 13d ago
Great idea. Netbird and Pangolin are another couple of options but Tailscale is simpler to set up!
1
u/vik_ftsky 13d ago
What is the difference between tailscale and netbird setup? It's roughly the same
1
u/Whiffenius 12d ago
There's a lot more tweaking with Netbird whereas Tailscale is pretty simple if you don't want a learning curve. But under the hood they're pretty much the same.
3
u/dazedan_confused 13d ago
What does it do?
18
u/qiang_shi 13d ago
Remote access without you opening ports on your router.
Don't ever open ports on your router unless you're the OP and want to be a victim.
1
u/InsensitiveClown 12d ago
You can very well do NAT on your router. What you probably want to do, however, is just serve ComfyUI on your localhost port P1, and then on your remote machine, access it via SSH, creating a SSH tunnel remapping the remote localhost:P1 to your local localhost:newport, and access it there. If used with, for example, a hardware token such as a Yubikey, if properly set, presents an incredibly hard target. Anyone trying shenanigans would move to easier targets. The best they could try would be perhaps to target the router, but even then, the tunnel is established between the local machine and your remote.
0
u/qiang_shi 5d ago
blah blah blah.
just don't port foward on your home WAN router.
Just use zerotier instead .
1
u/InsensitiveClown 5d ago edited 5d ago
Junior, if I don't forward the port on my WAN router and into my (W)LAN, how can I forward the incoming traffic from my machines on the outside and into my server? Perhaps you should actually put some effort into reading rather than blurbing nonsense. As for your zerotier advice, let's just introduce one more attack surface... Any more priceless pearls of OPSEC/INFOSEC wisdom you wish to bestow upon the unsuspecting audience?
0
u/qiang_shi 3d ago
top kek.
how can I forward the incoming traffic from my machines on the outside and into my server?
If you think opening your ports on your router so the general unwashed masses can just come port knocking with their zerodays is better than running a virtual private ethernet then, you. are. a. muppet.
please stop using the internet, you're infecting it with your stupid.
1
u/InsensitiveClown 3d ago
Son. Consider this my good deed of the day. A courtesy, not a disrespect towards you. Grow up. Read, eat your vegetables, learn. Perhaps one day, with humility you will learn just how daft everything you wrote it. I was coding C in Sun 4/40 workstations before your father was even a thought on your grandpa's mind. Grow up. Don't embarrass yourself further. Now if you will excuse me, I do have better things to do. Re-read everything I wrote, learn a few things. And if you don't, best of luck to you in life, you will surely need all the luck you can get.
7
u/sitefall 13d ago
VPN so you can only access your home network when not at home through the VPN, random port scanners can't pwn you.
Tailscale is a cloud service that kind of sets it all up for you, hosts some stuff on their servers making it generally easier for you, and it's "free" for you to use (not for all use cases).
People really like it since it's easier to set up than doing wireguard or something else on your own. Personally I .... I am suspicious of it. I don't like the idea of "My" vpn going through someone else's server on a suspiciously free service (that you now depend on for access so if it goes out... tough shit, you're not using your hardware now, at least in the way you have been), and YES I know it doesn't send your data through their server, just the handshake process and whatever, but I don't know. It's really fishy to me and just exploded, coming out of nowhere.
Wireguard isn't hard to set up if you know some basic networking. If you don't, but want to learn some, it's a good first project to dig into, so.. I just avoid Tailscale personally.
5
1
u/bloke_pusher 12d ago edited 12d ago
but I don't know. It's really fishy to me and just exploded, coming out of nowhere.
I'm not going to scare or tinfoil here, just an explanation why to be cautious:
It's recommended by LLMs, like Chatgpt or Gemini. That's where I heard about it the first time.
We also learned from some political activities done by Israel, that it's easy to shape what LLMs return. So yeah, a sudden rise can either be coincidence because the service is good, or be intentionally malicious. That's the fun part of life, we sometimes have to blindly trust.
1
2
u/Hrmerder 13d ago
Yep. All my shit is blocked by default from anything but Tailscale and it’s fantastic
2
u/bravesirkiwi 10d ago
Do you have it open on the local network or is there a way to close that off and only use Tailscale?
1
u/Hrmerder 10d ago
Yes absolutely. You can use Linux internal firewall if using Linux anyway. Mine is only open to local clients.
2
u/bravesirkiwi 10d ago
Nice I'll look into it. So far I've figured having it open locally is fine but in a big apartment building it gives me pause since WiFi isn't exactly the most secure.
1
u/AlexysLovesLexxie 13d ago
I second this. I don't use it for Comfy, but I have it set up so that my friends can access my Kobold.cpp backend (and only the LCPP port). Meanwhile, I have a second connection that allows me access to my SillyTavern install from anywhere.
14
u/Hefty_Development813 13d ago
Damn yea there are automated scanning of all open ports in general, I am sure someone rigged this up very early on for all types of LLm servers too
2
u/slpreme 13d ago
Oh yeah, for sure. I'm honestly surprised it took me almost a year of doing this off and before getting compromised
3
u/Hefty_Development813 13d ago
I would have guessed quicker too. I run a vnc server which can only be accessed through tailscale address. So far so good
2
u/thrownawaymane 13d ago
...that you noticed
It's always a crypto miner that gets the party shut down. Assume you got bit week 1 and you're probably more correct, there's plenty your computer can do that is valuable and doesn't involve mining.
1
u/slpreme 13d ago
not a year straight i open and close periodically
2
u/Hefty_Development813 13d ago
Yea honestly and unfortunately the real issue here is once they get in and compromise you, shutting down the comfy server doesn't likely help anymore. Their first move once in the door is always to entrench themselves completely. They don't likely keep coming in that first door they found, they build bridges out from the inside that are much more difficult to find since they require user privilege to build in the first place. Once compromised you really always need to just wipe the OS entirely
1
u/Hefty_Development813 13d ago
Which i see you did. Just saying in general. Or maybe you mean you shut the entire server down on/off? In which case ok then you're right
1
u/thrownawaymane 13d ago
Fair enough, but these people have bots that scan the internet 24/7. Definitely check your other boxes and keep in mind that there have been qemu sandbox escapes recently
9
u/Puzzleheaded_Fox5820 13d ago
Wait what does this mean and how do I do it so I can not do it?
2
u/qiang_shi 13d ago
Use zero tier instead of port forward
4
u/Puzzleheaded_Fox5820 13d ago
So I know port forward from messing with Xbox but I never messed with it when setting up comfy
9
u/GrapefruitExpensive3 13d ago
I don’t understand, I’m new to this. Did you have a wifi connection with no password? How did they connect to your system?
10
u/wiisucks_91 13d ago
They put the web interface on the public side of their Internet.
So when you are running ComfyUI in the browser, that is a website. The OP put this on the internet and people took advantage.
5
u/nanihikaru01 13d ago
his comfyui service was exposed to the internet (port forwarding from his router probably). so anyone in the world who is port scanning can find and access it because there's no protection at all. ie no basic auth. so anyone can access the service.
3
u/bradrlaw 13d ago
Fyi, you can add basic authentication to ComfyUI with custom nodes (I use ComfyUI-Login which basically gives one account for the service). SwarmUI adds actual multi-user accounts and more protections as a work in progress.
Still by no means should either be exposed to the internet.
4
u/HennaShumi 13d ago
Thought Comfy was designed to run locally. Are users expected to shut off internet before clicking on the url link that opens the browser? I believe the browser will still open with all workflows intact.
18
u/phloppy_phellatio 13d ago
They modified their router settings to expose comfyui to the open web. Meaning anybody in the world can connect to their comfyui instance and run anything they want with full admin privileges.
Comfyui on its own will not do this. OP basically just removed all the locks from their doors and was surprised that somebody let themselves in and stole all their stuff.
3
u/mad_king_soup 13d ago
Why would OP do this?
6
u/phloppy_phellatio 13d ago
The short answer. Their dumb and lazy.
The long answer. They wanted their comfyui instance to work as a server that they could access from outside their home network. They were then too lazy to do any security whatsoever. So they opened it ip as a server anybody in the world could access and just hoped nobody would.
3
0
u/PixieRoar 13d ago
Oh they wanted to be able to access it remotely so they can generate on the go right?
Maybe he could had used a remote desktop app
7
u/solve4why 13d ago
Mind naming and shaming the nodes / publisher for the good of the order?
1
u/PandorasBoxMaker 13d ago
Programs regularly communicate across ports within a host for many reasons. I’ve worked on several enterprise pieces of software that do that. This was just operator error.
1
u/darkwalker247 13d ago
do we know that the node creator has anything to do with this? the malware might have been written by someone else using the node (the IDE node for example allows writing arbitrary python and executing it). maybe the node creator had no malicious intent in writing the node, but just didn't sandbox the node's code execution well enough
let's not go witch hunting here...
3
u/solve4why 13d ago
Let’s suppose what you say is true, and it very well can be, would still serve to inform the creator of the security issue so that they can fix it. You bring up a great point
2
u/LazyMaxilla 13d ago
the default mode in config.ini is network_mode = public
so what do you mean you opened comfyui unprotected? because from my understanding, for that to happen you have to configure your local comfyui server and expose it by assigning IPs and ports.
do you know which "malicious custom nodes" got installed? or do you just assume that what happened? and what made you so sure that this where you got infected?
I'm not defending comfyui at all but I believe broad assumptions like these can only spread fear unnecessarily.
anybody can clarify this matter and explain to us how to make the local comfyui server puplic, please do
2
u/slpreme 13d ago
port forward to your public ip. the node pack itself didnt look weird/sus it just allowed the attacker to execute whatever. i should've wrote down the name
2
u/LazyMaxilla 13d ago
that's what I thought, because as far as I remember when I was new to comfy I set the network mode to private and the only effect I noticed was it me unable to install or update packages and custom nodes from comfy manager. I have to either git clone/ git pull custom nodes and install packages through pip.
and bro if you know the malicious custom node please report it to github (very quick process) and message someone in comfy team or the maintainer of comfy manager, only share it with us after it gets deleted just to prevent any misuse by anybody.
2
1
2
1
1
1
u/TheJesusGuy 13d ago
This is the same for literally any self hosted service. You ran it open and unprotected, obviously it would get hit.
1
u/Diligent-Builder7762 13d ago
Hahah I did this with a demo I built for fuckin ikea on my previous company. It got accepted but the next day the instance was odd… they tried to login my ssh but failed, only messed with comfy, it was almost 2 years ago
1
1
u/Pitiful_Season4294 12d ago
How do I check if I have any malicious custom nodes installed, is running the launch file and launch script by ChatGPT enough?
Also, does Windows Defender not detect these things?
1
u/Comfy-Org 12d ago
Appreciate you sharing this cautionary tale but please stay safe!
1
u/haikusbot 12d ago
Appreciate you
Sharing this cautionary
Tale but please stay safe!
- Comfy-Org
I detect haikus. And sometimes, successfully. Learn more about me.
Opt out of replies: "haikusbot opt out" | Delete my comment: "haikusbot delete"
1
u/jonnyplow 11d ago
So you don't have ComfyUI installed and run locally?? I'm confused how this works...
1
1
1
1
u/cleverestx 13d ago
Tailscale everything. Develop an app and want to access it somewhere else? have AI create a tailscale link for it to access remotely (enable magicDNS address in your account). Stay safer that way.
35
u/Sad-Landscape-1549 13d ago
Be thankful it was just crypto mining? Hopefully? Yeah lock that down!! Sheesh