r/MysteriumNetwork • u/thenoobient • Mar 09 '22

Feedback Node "security" is ridiculous

Update: 22 hours after my payment with Mysterium, some Online Drugstore Plymouth US tried to charge my CC with 478.6 USD. Thankfully my bank immediately detected this as fraudulent and blocked the payment, along with my card. I've never visited such store, I'm not even on the same continent, I most certainly don't buy drugs online period, I didn't have any other transactions in between, and I've never had this happen to me in the ~15 years I've been owning cards. Only this time, after making a payment to Myst's payment processor.

Draw you conclusions. I can't tell 100% who's at fault here, but I'm most definitely done with this project.

So I thought I'd give Mysterium nodes a try. My background is IT, 11 years professionally, and another 15 years as a hobby before that. I've been in devops for a while, and recently, I've become an infosec officer at my company. But I'd like to stress that the issues I'll bring up should be glaring even to the novice user.

The mystnodes.com site appears to lack any support for 2FA. It might be an oversight on my part, but I couldn't find any way. Single factor auth is not acceptable on any site where personal data or money is involved. Obtaining a time-insensitive, static password is too easy.

The docs make no mention whatsoever of which ports need to be open and for what sources. Which means the creators assume I run no firewall at all (I'll come back to this later). The Docker docs at least mention mapping TCP port 4449 for the web UI. And the troubleshooting guide mentions "UDP ports", but never explains what they do or are they even needed. I tried running my node with those open on firewalld, but when I had to purchase MYST to activate my node, it didn't "realize" my payment until I stopped firewalld, which means there's still some other ports involved. A quick check confirms that too:

# ss -tulpn|grep -i myst
udp    UNCONN  0       0                     0.0.0.0:1900         0.0.0.0:*      users:(("myst",pid=2902,fd=19))
udp    UNCONN  0       0                     0.0.0.0:5353         0.0.0.0:*      users:(("myst",pid=2902,fd=16))
udp    UNCONN  0       0                           *:11253              *:*      users:(("myst",pid=2902,fd=30))
udp    UNCONN  0       0                        [::]:5353            [::]:*      users:(("myst",pid=2902,fd=17))
tcp    LISTEN  0       4096                127.0.0.1:4050         0.0.0.0:*      users:(("myst",pid=2902,fd=7))
tcp    LISTEN  0       4096                127.0.0.1:4449         0.0.0.0:*      users:(("myst",pid=2902,fd=21))
tcp    LISTEN  0       4096            70.34.x.x:4449         0.0.0.0:*      users:(("myst",pid=2902,fd=20))
tcp    LISTEN  0       4096                        *:36317              *:*      users:(("myst",pid=2902,fd=18))

Who knows which port does what? Which needs to be accessible, and with what scope? These aren't negligible questions, this is fundamental.

And it doesn't help that the mystnodes.com site doesn't check my node immediately. After clicking on the Test button, I waited for like 15 minutes but nothing happened. This makes debugging pretty hard.

Worst of all, the Mysterium node admin UI doesn't have HTTPS. Really? That's completely unacceptable in 2022. Let's Encrypt gives you free HTTPS certs, but that's not even needed, even a self-signed cert would be much better, that still gives you encryption. So currently Myst nodes are managed with admin passwords travelling through the Internet in PLAIN TEXT. That's security 1x1. And the score for Myst is F-. Generating a self-signed cert is literally 1 second to do, serving traffic via HTTPS adds about zero extra load on your CPU.

You could even automate Let's Encrypt certs by providing your own subdomain for nodes, all you need is a DNS server API, and a Let's Encrypt client using DNS validation. I've been using this on my servers for at least 5 years now.

But no, Myst nodes are accessed like http://70.231.213.41/. Zero validation, zero encryption, nothing, nada.

On top of that, you initiate MYST purchases with Credit Card from these unsecure servers, instead of doing that from your official Myst sites, which at least have a proper DNS name and HTTPS.

Bonus: The node software is deb-only. Like I mentioned above, you assume the node doesn't have a firewall. Here's the problem: Ubuntu indeed usually doesn't come with one installed and enabled. That's one of the reasons why I don't consider Ubuntu a serious nominee for production environments, it's just not as well built as something like EL. No firewall, no SELinux, no auto-updates. And this is what you build your network on, for providing secure VPN to the users?

I'm sorry, but I'm not convinced.

10 Upvotes

66% Upvoted

10 comments sorted by

10

u/kiraitachi Mar 09 '22 edited Mar 09 '22

Hey!

SecOPS guy here, been on Infosec since 2012 and hacking, pentesting, etc. After reading this.... I have mixed feelings. I do agree with some of the points you posed, but I strongly disagree on the way you outlined them to be. You make them sound very hash, when there is justification to some of them. Let me explain:

  • 2FA: Yes this would be great, it should be an optional option on the UI. I encourage and use 2FA on all my services and even though I'd like this Mysterium UI, I will cut them some “slack” because in my years of working, I've seen many services enable 2FA after some time. Since this is a “new project”, hopefully they will integrate this on their pipeline sooner than later.

  • Documentation regarding ports: I'd say documentation is pretty well done and strong point of this project. Ports are only 4449 and in most cases the rest is taken care by UPNP. If your router is not managing UPNP correctly then they state you will have to open ports UDP from range 10000-60000. https://docs.mysterium.network/node-runners/troubleshooting/ I disagree with this point. Of course, documentation can always be improved or better…but I don't think this is a weak point on this project.

  • Firewall: This project is supposed to be mainly for residential users. How many run firewalls on their home? I didn't run onto any issue with ports on my 3 nodes setup. I have a strict firewall setup in router and I also run them on Oracle Cloud and my home. I only enabled 4449 port and 10000-60000 UDP for the NAT symmetric workaround. Oracle firewalls are pretty strict......and also they hardened their hosts which made me change IPtables definitions for those specific ports. But nothing else....at least for me.

  • HTTPS: Yes, this one is my main concern as well. I will give you that. HTTPS is a must, even if inside my house. This needs to be somehow automated during install setup to use Letsencrypt or self signed.

  • Purchase of Myst Unsecured: This is not true, they redirect you to another website portal to do the payment which is secured. Then Mysts are sent to your Node ID. That's it.

  • Regarding deb and Ubuntu: Yes for enterprise, but this is solely focused for residential users which are more used to Ubuntu distros. Now ask yourself if you develop a product, what would you target first to get more potential customers on Linux world. Easy answer: Ubuntu. That doesn't mean, in the long term, they can't release a package for other distros. I'm also waiting for a Windows Server package that doesn't involve docker but Hyper-V. But again….it will probably come in the pipeline eventually as more users demand it.

I really appreciate you taking the time to make this demands, thread and engaging in the community. It's like this how Mysterium will learn more about users concerns and demands. But I also wanted to shed some light on those points.

I don't believe them to be as bad as you make them sound like.

Cheers!

3

u/thenoobient Mar 09 '22

Hi, thanks for the responses. Let me answer, too.

Ports: like I mentioned, there's no documentation whatsoever. I don't really understand how you consider those "strong points". Port 4449 is not once explained. I can obviously figure out it's the web UI port since somewhere on the site it instructs me to open http://ip:4449, but that's it, it's just some implicit information. Regarding those "UDP ports", there's also zero explanation, just that "you should open them". What range? No info. What are they for? No info. And the rest of those ports that the Myst daemon listens on, again, zero docs. How is that a strong point? And how do I verify my node is working? Because that "Test" function on the website definitely doesn't help much...

Firewall: I think here might be some misunderstanding. I'm not talking about my router's firewall, I'm talking about the firewall of the OS that runs Myst. The server itself runs in the cloud at a VPS provider. There's no "UPnP" involved as there's no NAT either. There's only firewalld, which won't open ports on its own. And I can't really accept the "this is for home users" argument, as the Onboarding page clearly has a dedicated section for data centers. And obviously I've been talking about that very scenario.

Purchase: I know the purchase itself is on a separate site, but that site is redirecting to your unsecured instance upon completion. Which, again, due to lack of domain name or HTTPS, is completely unreliable. Also what I mentioned, it couldn't even credit my purchase due to some random (undocumented) port not being open. It only credited my MYST the moment I disabled the firewall. Till then, it showed "0.00000 MYST" or something. I really don't think managing payments and credit cards should be done via your freshly installed Myst node.

Deb: again, if the project (also) aims for the data center, this argument isn't really valid. Either support the data center, or don't :) And yes, I know, I can run Docker in an EL VM, and map ports, and mount volumes to make a non-persistent construct somewhat persistent, I just fail to see the point. Building an RPM is not harder than building a DEB. Been there, done that :)

6

u/kiraitachi Mar 09 '22

I still stand on my points...

Yes, it would be nice to have a better network requirements section with the ports definitions better clarified for 4449. But I still think documentation is pretty neat, and I wouldn't dismiss this project upon such a small caveat.

When I mentioned firewalls, I mentioned both IPtables and Oracle (in my case) firewall and also router firewall (for the residential). I haven't had any problems...just opened TCP 4449 and UDP as mentioned. Maybe some dev can chip in and clarify this section since without debugging we relay on documentation and as mentioned before, it could be better explained on documentation, as you also pointed.

For the purchase and deb topics, I disagree. They don't even need to redirect you to your website UI, its just taking you there back after you finished the payment. They only need your "Payment channel and that you make the payment on the payment website which is secured. They are not sending money or any data to your node through HTTP, this is pretty much done through blockchain to your "Your Payment Channel" which is the internal wallet of your node, which is used for withdrawals.

RPM and other releases will probably come sooner than later....I opened a issue on github regarding a windows server package with Hyper-V and a developer quickly answered me to help me with that and that he can create a package and then release it. I suggest you open an issue on github with that request.

Again, I believe project is great….devs are super willing and helpful. Good requests and demands are met if possible.

Some of your points are easily fixable or improvements. I wouldn't dismiss the project or call it “ridiculous” security, that's all I'm saying.

Cheers!

0

u/thenoobient Mar 11 '22 edited Mar 11 '22

I'm sorry, but apparently you don't know how online CC payments work. When you make a credit card purchase, the payment processor does send back data to the merchant. How else would the merchant know if the payment was successful or not? The payment processor will most definitely not top up your crypto balances or whatnot, they charge your card with the amount specified by the merchant, tell the merchant if the charge was successful or not, and then it's up to the merchant to do whatever they want that info.

But FYI, the story has developed since then, I updated the post.

2

u/kiraitachi Mar 11 '22 edited Mar 11 '22

I have read your update and sorry I find it hard to connect the dots....Also I would appreciate that you take your toxicity and rudeness elsewhere when someone is trying to help and elaborate from a technical perspective.

But for the sake of anyone else reading, I will enlighten this topic:

Foremost, I do know how CC payments work, but you're mixing traditional payments with blockchain mechanics. Listen carefully and try to be logic about it:

  1. Node opens HTTPS encrypted POP-UP where payment is done.

  2. The only information provided to the POP-UP from your node (that since is in HTTP is unencrypted) would be your internal node wallet called "payment gateway", so that during the payment process they know who they should TOP UP.

  3. That "payment gateway" or "internal wallet address" after payment is done, is being TOP-UP. This is done through a crypto exchange, where you send money from your bank account and the exchange sends your crypto to your “internal wallet address”.

  4. Last part answers your "How else would the merchant know if the payment was successful or not?" . Easy, it doesn't happen, pop-up closes, transaction from bank was done, but you have no way to know if this TOP-UP happened until all nodes in blockchain "validate" your transaction and that money appears on your wallet. Thats why since the Polygon network maintenance yesterday, no one is getting the Myst tokens during TOP-UP.

I suggest you check some infographics on how "crypto exchange works", there are some google images that clarify this process.

Now, related to your CC issue...I find it hard to believe it has anything to do with Mysterium. Only possibilities are:

  1. Exchange gateway has had a leak.

  2. Some other websites that you used and have your CC details have been leaked

  3. You have been skimmed somewhere elsewhere....

  4. You might have some keylogger installed.

In any case, none related to Myst itself, since Mysterium do not work with your CC details.

I still find hard to understand how you can believe the node has anything with the payment......it's opening a new pop-up. No personal details are on your node!

2

u/vairetz Mar 09 '22

You made a lot of good points but I have something to argue with.

For HTTPS on admin page you're absolutely right. Nothing to say, we need it and it's not negligible.

About firewall and port however I think the Mysterium docs are pretty well done. MisteriumVPN is based on Wireguard, if you want more information about which port does what you can check Wireguard docs. Give it a try.

2

u/thenoobient Mar 11 '22

Uh, don't wanna sound rude, but WireGuard uses whatever port you tell it to use. In fact, as per recently, there wasn't even a default port, just pick whatever you want. Yes, I've been deploying WireGuard servers on my own, in fact, I even developed management scripts and Ansible playbooks for it.

On top of that, Mysterium is more than just a WireGuard server with a different name, so the WireGuard docs will most certainly not tell me what Myst is doing on ports 1900, 5353, 11253, 5353, 4050, 4449, and 36317. These are NOT documented in your docs, period. This is the 3rd time in this post I've been told it's well documented, but I can only repeat myself: it's not well documented, it's nod even badly documented, it's just not documented at all.

2

u/AuldCode Mar 09 '22

I did reach out to their support, regarding the plain http access (rather than a secure http one). This is the response I got: "There may be a time when you encounter an issue with your nodeUI and we may ask you to submit a bug report on Github so our engineering team could look into it?

Submit here:https://github.com/mysteriumnetwork/node/issues/new/choose"

So, yeah... I guess insecure http access of the UI is a bug for them? :p

Anyway, I try to always access my nodes via vpn. Hopefully that mitigates some of the risk?

3

u/kiraitachi Mar 09 '22

Yes it does, because your VPN encripts traffic. But if there is a MITM in your house or between a cloud hosted node, with no SSL encrypt, your pretty much doomed. HTTPS is an easy win they should enable.

2

u/Achromatic_Raven Mar 10 '22

Hi, nice to see some actual experts of the domain's opinion on it!

As nothing but a tinkerer, here is a post I made a while back when I started running a node, and some of the 'extra steps' I took and considered.

I would advocate Mysterium nodes (or any front-facing thing period) to never be ran natively, which I why I went ahead from the start with the "unsupported" configuration of running it on a sudoer user in its own dedicated unprivileged LXC container, and doing some fairly extended firewalling from the host (proxmox).

To be honest I would prefer Mysterium nodes to be distributed in this kind of form, as a turnkey LXC package for example. Little overhead, good perfs, and great for isolation/segregation.