Ollama - CraftedSignal Threat Feed

Ollama Model Exfiltration Attempt Detection

hello@craftedsignal.io — Thu, 02 May 2024 14:22:00 +0000

This detection focuses on identifying potential data exfiltration attempts against Ollama, a framework for running large language models locally. The technique involves adversaries repeatedly querying specific API endpoints such as /api/show, /api/tags, and /api/v1/models. These queries are designed to extract sensitive model information including architecture details, fine-tuning parameters, system paths, Modelfile configurations, and any proprietary customizations. The detection logic flags instances where multiple inspection attempts occur within a short 15-minute window, suggesting automated exfiltration activity. Successful exfiltration could lead to competitive intelligence gathering, model replication, or preparation for further attacks against the AI infrastructure.

Attack Chain

The attacker gains initial access to a system capable of making requests to the Ollama server.
The attacker begins sending HTTP GET requests to the /api/tags endpoint to enumerate available models.
For each model identified, the attacker sends HTTP GET requests to the /api/show endpoint to retrieve detailed model metadata.
The attacker may also query /api/v1/models to gather additional model-related information.
The attacker parses the JSON responses to extract sensitive information such as model architecture, system prompts, and custom configurations.
The extracted data is aggregated and prepared for exfiltration.
The attacker initiates exfiltration, potentially using techniques like DNS tunneling, HTTP POST requests to external servers, or cloud storage uploads.
The attacker uses the exfiltrated information to replicate the model, gain competitive insights, or identify vulnerabilities in the AI infrastructure.

Impact

Successful exfiltration of Ollama model metadata can have significant consequences. Competitors could replicate proprietary models, undermining the victim's competitive advantage. Attackers could use the exfiltrated data to identify vulnerabilities in the AI infrastructure, paving the way for more sophisticated attacks. The unauthorized disclosure of sensitive model configurations, system prompts, and internal model specifications can lead to substantial financial and reputational damage.

Recommendation

Deploy the provided Sigma rule Ollama Model Metadata Exfiltration via API to your SIEM to detect suspicious API access patterns (logsource: webserver, product: linux).
Monitor Ollama server logs for unusually high request rates to /api/show, /api/tags, and /api/v1/models (logsource: webserver, product: linux).
Implement rate limiting on the Ollama API endpoints to prevent automated exfiltration attempts (firewall/WAF configuration).
Review and harden access controls to the Ollama server to prevent unauthorized access (Ollama configuration).

Ollama Abnormal Network Connectivity Detected

hello@craftedsignal.io — Tue, 09 Jan 2024 12:00:00 +0000

This threat brief addresses abnormal network activity and connectivity issues detected within Ollama servers. The detection focuses on warning-level network errors, such as DNS lookup failures, TCP connection issues, and host resolution problems, which may indicate unauthorized access attempts, infrastructure reconnaissance, or network-based attacks targeting Ollama deployments. This is particularly important as organizations increasingly rely on local LLMs and need to ensure the integrity and security of these systems. The detection specifically identifies attempts to access the Ollama API from non-localhost addresses, raising concerns about potential unauthorized access or exploitation attempts. It is critical to investigate these anomalies promptly to prevent further compromise.

Attack Chain

An attacker attempts to access the Ollama API from a non-localhost address, potentially bypassing authentication or authorization mechanisms.
The Ollama server logs a warning-level error related to network connectivity, such as "dial tcp," "lookup," or "no such host."
The attacker's attempts to resolve a hostname used by the Ollama server fails, indicating a DNS lookup issue.
A TCP connection to a critical service or component used by Ollama is refused or times out.
The attacker attempts to establish a connection to an unreachable network resource, potentially indicating reconnaissance activity.
The Ollama server logs multiple network-related warnings over a short period, suggesting a sustained attack or exploitation attempt.
The attacker exploits a vulnerability within the Ollama API or a related service to gain unauthorized access to sensitive data or functionality.
The attacker successfully compromises the Ollama server, potentially leading to data exfiltration, service disruption, or further lateral movement within the network.

Impact

Successful exploitation of abnormal network connectivity in Ollama can lead to unauthorized access to the LLM, potentially exposing sensitive data used in prompts or model configurations. It can also disrupt the availability of the Ollama service, impacting applications relying on it. The number of victims would depend on the scope of the Ollama deployment. Sectors heavily reliant on local LLMs, such as software development and data analysis, are particularly at risk.

Recommendation

Deploy the provided Sigma rules to your SIEM to detect abnormal network connectivity patterns in Ollama server logs (process_creation and network_connection log sources).
Investigate any alerts generated by the Sigma rules, focusing on identifying the source of the abnormal network activity and the potential impact on the Ollama server.
Review and harden the network configuration of the Ollama server to restrict access to authorized users and applications only.
Monitor Ollama server logs for warning-level network errors, such as DNS lookup failures, TCP connection issues, and host resolution problems, as indicated in the search query.
Implement network segmentation to isolate the Ollama server from other critical systems, limiting the potential impact of a successful compromise.

Ollama Server Possible RCE via Malicious Model Loading

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This brief addresses a critical vulnerability in Ollama servers that could lead to remote code execution (RCE). The threat involves attackers attempting to load malicious models onto the server to execute arbitrary code. This is achieved by exploiting vulnerabilities in the model loading process or by injecting specially crafted models designed to trigger server errors and allow code execution. The detection focuses on identifying unusual error patterns during model loading, such as crashes, failures related to "llama runner," and model-specific errors. This activity may originate from an external threat actor or a malicious insider attempting to compromise the Ollama server. Successful exploitation allows the attacker to gain full control of the server.

Attack Chain

The attacker identifies an Ollama server with accessible model loading functionality.
The attacker crafts a malicious model or exploits an existing model.
The attacker initiates a model loading request to the Ollama server.
The Ollama server attempts to load the model.
The malicious model triggers an error within the llama runner component or the model processing logic.
The error leads to a service crash or code execution due to vulnerabilities in the model loader.
The attacker gains remote code execution on the Ollama server.

Impact

A successful attack can lead to complete compromise of the Ollama server. The attacker gains the ability to execute arbitrary code, potentially leading to data exfiltration, denial of service, or further lateral movement within the network. The risk is heightened due to the potential for sensitive data stored or processed by the Ollama server to be exposed or manipulated. The number of victims and specific sectors targeted are unknown, but the impact is potentially widespread given the increasing adoption of Ollama servers.

Recommendation

Deploy the Ollama Possible RCE via Model Loading Sigma rule to your SIEM to detect suspicious model loading errors on Ollama servers.
Review and harden the Ollama server configuration to restrict model loading permissions and validate model integrity.
Implement network segmentation to limit the impact of a compromised Ollama server.
Investigate any detected instances of model loading errors and potential RCE attempts based on the Sigma rule output.

Ollama Resource Exhaustion via Memory Abuse

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This threat brief addresses potential resource exhaustion attacks targeting Ollama servers. Adversaries might attempt to degrade system performance or cause denial of service by overloading the server with excessive memory allocation requests and runner operations. This can be achieved by loading multiple large language models, repeatedly triggering model initialization, or exploiting memory allocation mechanisms. The attack aims to overwhelm CPU/GPU resources and exhaust available memory. Defenders should monitor Ollama server logs for unusual patterns in memory allocation, runner counts, and the frequency of operations. The Splunk search provided by the source content is designed to detect such anomalies.

Attack Chain

Attacker gains access to a system capable of interacting with the Ollama server. This could be a compromised host within the network or an external system with network access.
The attacker sends a series of requests to the Ollama server to load large language models. The attacker may automate these requests to rapidly increase the number of models being loaded.
The Ollama server attempts to allocate memory for each requested model. This process consumes system memory, including RAM and potentially swap space.
The attacker sends requests to repeatedly initialize or re-initialize models, forcing the Ollama server to perform redundant memory allocation operations.
The Ollama server's runner count increases as it attempts to manage the numerous model instances. This puts additional strain on CPU resources.
Memory usage on the Ollama server spikes, potentially exceeding available resources.
The server's performance degrades, leading to slow response times or complete unresponsiveness. Legitimate users may experience denial of service.
The attacker maintains the attack until the Ollama server becomes unusable or system administrators intervene.

Impact

A successful resource exhaustion attack on an Ollama server can lead to significant disruption. Victims may experience denial of service, preventing legitimate users from accessing the server's capabilities. Degraded performance can impact the usability of applications relying on the Ollama server. The attack can exhaust system resources, potentially affecting other services running on the same host. The severity depends on the size and configuration of the Ollama server and the scale of the attack.

Recommendation

Deploy the Sigma rule Ollama High Memory Allocation to detect abnormal memory usage by Ollama processes (logsource: process_creation).
Deploy the Sigma rule Ollama Excessive Runner Processes to detect a large number of Ollama runner processes being created (logsource: process_creation).
Monitor the ollama_server logs for spikes in memory allocation and runner counts as described in the Splunk search (data_source: Ollama Server).
Tune the thresholds in the Splunk search provided to suit your environment, focusing on operations, total_runners, max_memory, and total_memory (search).
Implement rate limiting and request validation on the Ollama API to prevent excessive model loading requests (references: https://github.com/rosplk/ta-ollama).

Ollama API Prompt Injection and Jailbreak Attempts

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This threat brief focuses on detecting prompt injection and jailbreak attempts targeting Ollama, an open-source framework for running large language models (LLMs) locally. Attackers are increasingly targeting LLMs with crafted prompts designed to bypass safety controls, extract sensitive information, or manipulate model behavior. This is achieved by injecting malicious instructions into user queries, leading to unintended or harmful outputs. The detection identifies suspicious activity against Ollama API endpoints (/api/generate and /v1/chat/completions) by monitoring response times. Requests exceeding 30 seconds, coupled with high request frequency, may indicate a sophisticated jailbreak attempt, multi-stage prompt injection, or extraction of sensitive data from the model. Defenders should be aware of this emerging threat to maintain the integrity and security of their LLM deployments. The provided Sigma rules and recommendations enable proactive monitoring and alerting for these types of attacks.

Attack Chain

Attacker identifies an Ollama instance exposed via API endpoints such as /api/generate or /v1/chat/completions.
The attacker crafts a malicious prompt designed to bypass safety filters or extract sensitive information (prompt injection).
The attacker sends the crafted prompt to the Ollama API endpoint via an HTTP POST request.
The Ollama server processes the complex prompt, leading to extended processing times.
The server logs the request details, including the URI path, source IP, HTTP method, response code, and response time.
A successful jailbreak or prompt injection may allow the attacker to extract internal data, manipulate model behavior, or bypass security controls.
The attacker repeats the process, refining the prompt based on previous responses.
The attacker potentially leverages the compromised Ollama instance for further malicious activities.

Impact

Successful prompt injection attacks against Ollama instances can lead to several critical impacts. Attackers may be able to extract sensitive data, manipulate the model to generate harmful or biased content, or bypass security controls designed to prevent misuse. While the specific number of victims is unknown, the increasing adoption of LLMs makes this a significant concern for organizations across various sectors. If successful, these attacks can compromise data confidentiality, integrity, and availability, leading to reputational damage and financial losses.

Recommendation

Deploy the Sigma rule Ollama Suspicious Long Request to detect abnormally long response times indicative of prompt injection attempts. Enable Ollama server logging to capture the required data (response times, URI paths, source IPs) and configure Splunk TA-ollama to ingest the logs (sourcetype: ollama:server).
Investigate alerts triggered by the Ollama Suspicious Long Request rule, focusing on the source IP address (src) and the requested URI (uri_path) to understand the nature of the interaction with the Ollama API.
Implement rate limiting and input validation on Ollama API endpoints to mitigate the risk of prompt injection attacks.
Regularly review and update Ollama's safety filters and security configurations to address emerging prompt injection techniques.
Monitor status_code values in the logs for unusual HTTP response codes that might indicate errors or vulnerabilities being exploited during prompt processing.

Ollama API Endpoint Scan Reconnaissance

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection focuses on identifying reconnaissance attempts against Ollama servers. The core objective is to pinpoint sources that aggressively probe multiple API endpoints within short time windows. This behavior often signifies a systematic effort to enumerate the API surface, uncover hidden endpoints, or pinpoint potential vulnerabilities before launching targeted attacks. The detection leverages Ollama server logs to track API access patterns. It is crucial for defenders to identify and mitigate such reconnaissance attempts proactively to prevent potential exploitation of Ollama servers. This detection is based on data from the Splunk ES-CU detections, specifically detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml.

Attack Chain

Attacker gains network access to an Ollama server.
Attacker initiates a series of HTTP requests targeting various API endpoints on the Ollama server.
The attacker uses a variety of HTTP methods (e.g., HEAD, GET) to probe the endpoints.
The attacker analyzes the HTTP response codes to map the API surface and identify active endpoints.
The attacker identifies potential vulnerabilities based on endpoint behavior and response patterns.
The attacker attempts to exploit identified vulnerabilities.
If successful, the attacker gains unauthorized access to Ollama server resources.
The attacker exfiltrates sensitive data or disrupts Ollama services.

Impact

Successful API reconnaissance can lead to the discovery of vulnerabilities in Ollama servers, enabling attackers to gain unauthorized access, exfiltrate sensitive data, or disrupt services. While the number of potential victims isn't explicitly stated, organizations using Ollama servers are at risk. The detection focuses on identifying the reconnaissance phase, allowing defenders to interrupt the attack chain before significant damage occurs.

Recommendation

Deploy the following Sigma rule to detect potential Ollama API reconnaissance activity based on excessive requests (total_requests > 120) within a 5-minute window.
Ingest Ollama logs via Splunk TA-ollama add-on by configuring file monitoring inputs pointed to your Ollama server log directories to enable effective detection.
Investigate any alerts triggered by the Sigma rule, focusing on the source IP address (src) and the accessed endpoints (dest) to determine the legitimacy of the activity.

Ollama Abnormal Service Crash Availability Attack

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

This detection focuses on identifying abnormal service crashes within Ollama, a tool used for running large language models. The goal is to detect potential exploitation attempts, resource exhaustion attacks, or denial-of-service attacks targeting the Ollama service. The detection analyzes Ollama server logs for error and fatal messages, as well as keywords indicating service termination. An unusually high frequency of crashes or terminations within a short timeframe can indicate malicious activity. The detection logic originates from Splunk ES and is designed to identify anomalies indicative of an attack against Ollama's availability and stability. Defenders should monitor for these patterns to ensure the continuous operation of their AI model deployments and identify potential security breaches. The logic was published on 2026-04-17.

Attack Chain

The attacker identifies a vulnerability in Ollama that can cause a service crash (e.g., through malicious input or resource exhaustion).
The attacker sends a crafted request or input to the Ollama server, exploiting the identified vulnerability.
The Ollama service encounters a fatal error or exception while processing the malicious input.
The Ollama service terminates unexpectedly, generating an ERROR or FATAL log message.
The monitoring system detects the abnormal service termination based on the log data.
The attacker repeats the process to further disrupt the availability of the Ollama service.
Legitimate users are unable to access the Ollama service, leading to a denial-of-service condition.

Impact

A successful attack can lead to a denial-of-service condition, rendering the Ollama service unavailable to legitimate users. This can disrupt AI model deployments, impact dependent applications, and degrade overall system stability. The detection logic assigns severity based on the frequency of crashes, with high termination counts classified as critical and indicative of resource exhaustion attacks. If successful, the attacker can effectively shut down the AI model serving capabilities of Ollama.

Recommendation

Ingest Ollama server logs and configure the appropriate sourcetype (ollama:server) in your SIEM to enable detection based on log data.
Deploy the Sigma rules provided in this brief to your SIEM and tune them for your specific environment to reduce false positives.
Investigate any alerts generated by these rules to determine the root cause of the service crashes and potential exploitation attempts.
Review and harden the Ollama server configuration based on the error messages (e.g., resource limits, input validation) to mitigate potential vulnerabilities.
Monitor the termination_count, error_messages, and exit_codes fields in the detection output for patterns indicative of specific attack types.

Ollama API DDoS/Rate Limit Abuse Detection

hello@craftedsignal.io — Tue, 02 Jan 2024 12:00:00 +0000

This brief focuses on detecting potential Distributed Denial of Service (DDoS) attacks or rate limit abuse against Ollama API endpoints. The attack involves flooding the Ollama server with excessive API requests from individual client IP addresses within a short time frame. These attacks aim to exhaust server resources, leading to service degradation or complete unavailability. This behavior is typically associated with automated attacks, botnet activity, or resource exhaustion attempts targeting local AI model infrastructure and can severely impact the availability of Ollama services. Detection relies on analyzing GIN-formatted Ollama server logs to identify clients generating abnormally high request rates. The specific detection logic thresholds need to be tuned based on the environment baselines.

Attack Chain

Attacker identifies publicly exposed Ollama API endpoint.
Attacker crafts automated scripts or utilizes botnet to send a high volume of API requests.
Attacker initiates the attack, flooding the Ollama server with requests from multiple source IPs or a single IP.
Ollama server logs record each API request, including source IP, timestamp, and endpoint.
The detection logic analyzes the logs, grouping requests by source IP address within a 5-minute window.
The detection identifies source IPs exceeding a predefined request threshold (e.g., 120 requests per 5 minutes).
Alert is triggered, indicating a potential DDoS attack or rate limit abuse from the identified source IP.
Service degradation or unavailability occurs due to resource exhaustion.

Impact

A successful DDoS or rate limit abuse attack against an Ollama server can lead to significant service disruption. This can result in legitimate users being unable to access AI models, impacting critical workflows reliant on Ollama. The specific impact depends on the scale of the attack and the server's resource capacity. In severe cases, the server may become completely unresponsive, leading to a total outage. The attack can also negatively impact the reputation of the organization hosting the Ollama service.

Recommendation

Deploy the Sigma rule Ollama Excessive API Requests to your SIEM and tune the threshold (request_count > 120) based on your environment's baseline traffic to reduce false positives.
Ingest Ollama logs into your SIEM using the recommended method (Splunk TA-ollama add-on, HTTP Event Collector) to populate the ollama_server macro referenced in the provided Sigma rule.
Investigate alerts generated by the Sigma rule Ollama Excessive API Requests to identify potentially compromised systems or malicious actors.
Implement rate limiting and request filtering at the network level to mitigate DDoS attacks and prevent abuse, and block malicious IP addresses identified from the SIEM alerts.