Add EPMD Exposure Blog

Author: maennchen

assets/css/blogs.scss

@@ -24,6 +24,10 @@ div.blog-post > table {
    border-collapse: collapse;
 }
 
+div.blog-post .responsive-image {
+  width: 100%;
+}
+
 div.blog-post > td, th {
   border: 0.0625rem solid #ddd;
   padding: 0.5rem;

assets/static/images/posts/epmd-public-exposure/world-map.png

@@ -0,0 +1,114 @@
+{
+  "title": "Exposed EPMD: A Hidden Security Risk for RabbitMQ and the BEAM Ecosystem",
+  "authors": ["The Security Working Group"],
+  "slug": "epmd-public-exposure",
+  "category": "security",
+  "tags": ["security", "epmd", "cybersecurity", "rabbitmq"],
+  "datetime": "2024-12-12T21:01:48.619713Z"
+}
+---
+EPMD, essential for Erlang and RabbitMQ clustering, is often exposed online—posing hidden security risks and requiring quick mitigation steps.
+---
+
+The Erlang Port Mapper Daemon (EPMD) is a built-in component that facilitates clustering across Erlang-based applications (including RabbitMQ). While EPMD is essential in trusted network environments, it was never intended for exposure on the public internet. Recent scans have revealed over 85,000 instances of publicly exposed EPMD, with roughly half associated with RabbitMQ servers.
+
+If left unsecured, an exposed EPMD endpoint can potentially grant attackers a foothold, enabling them to join your cluster, run arbitrary code, and compromise your systems. Fortunately, mitigation steps are straightforward: disable EPMD if you’re not clustering, or restrict it behind a firewall and proper network configuration.
+
+## TL;DR
+
+**Check if you’re exposed:**
+- Run a port scan:  
+  ```bash
+  nmap -p 4369 -sV [Your Public IP]
+  ```  
+  If the output shows:  
+  ```
+  PORT     STATE SERVICE
+  4369/tcp open  epmd
+  ```
+  Your EPMD port is exposed.
+
+**For Erlang/Elixir users:**
+- Remove or avoid using `-name` or `-sname` if you don’t need clustering.
+- Bind distribution to a non-public interface with `vm.args`:
+  ```bash
+  -kernel inet_dist_use_interface '{127, 0, 0, 1}'
+  ```
+- Use a firewall or security group rules to restrict external access.
+
+**For RabbitMQ users:**
+- RabbitMQ runs on Erlang and uses EPMD behind the scenes. Even if you never interact directly with Erlang, you may still be affected.
+- Check the RabbitMQ networking documentation to learn how to identify exposed ports and close them:  
+  [https://www.rabbitmq.com/docs/networking#epmd](https://www.rabbitmq.com/docs/networking#epmd)  
+- The Erlang Ecosystem Foundation’s security hardening guide explains what EPMD is, which ports it uses, and how to close them down:  
+  [https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/distribution](https://erlef.github.io/security-wg/secure_coding_and_deployment_hardening/distribution)
+
+## What is EPMD and How Does it Work?
+
+Erlang was designed from the ground up for concurrency, distribution, and fault tolerance. To support clustering (distributed Erlang nodes connecting and communicating seamlessly), Erlang relies on EPMD. EPMD runs as a small daemon that keeps track of Erlang nodes and their associated ports. When a node starts with `-name` or `-sname`, it registers with EPMD on the host machine’s port 4369.
+
+In a controlled environment—such as an internal network—this works well. EPMD makes it easy for nodes to discover each other, connect, and form distributed clusters.
+
+**Key points:**
+- EPMD listens on port 4369 by default.
+- It’s assumed that EPMD is only reachable from within a trusted network.
+- Many Erlang/Elixir build tools and release pipelines (like Rebar3, Mix, and Distillery releases) enable EPMD by default.
+
+## Why is Exposing EPMD a Bad Idea?
+
+### Risk of Unauthorized Cluster Access
+
+EPMD itself does not enforce strong authentication. Erlang clustering uses a “cookie” as a shared secret, but this cookie is not intended as a robust security mechanism—it’s more of a sanity check to prevent accidental cross-node connections. If an attacker can guess or brute-force the cookie, they could join your cluster.
+
+Once inside the cluster, the attacker could potentially run arbitrary Erlang Remote Procedure Calls (RPCs), giving them full control of the application and underlying system. While no widespread internet-based attacks on EPMD have been documented publicly, the theoretical risk is real. A known timing-based brute-force approach is described here:  
+[https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/](https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/)
+
+### Scope of the Problem
+
+Shodan (a search engine for internet-connected devices) reveals over 85,000 publicly accessible EPMD instances. Among them, around 40,000 are associated with RabbitMQ.  
+Top countries hosting exposed EPMD endpoints include China (18,444), the United States (15,771), and Germany (10,263). Major cloud hosting platforms (DigitalOcean, Hetzner, Aliyun, Tencent, OVH, Amazon, and others) also host significant numbers of exposed instances, typically due to default configurations and lack of firewall restrictions.
+
+[![World Map showing number of exposed EPMD instances](/images/posts/epmd-public-exposure/world-map.png) {: .responsive-image}](https://www.shodan.io/search/report?query=product%3A%22Erlang+Port+Mapper+Daemon%22)
+
+### Not Just Erlang Developers at Risk
+
+RabbitMQ, a popular message broker built on Erlang, runs EPMD under the hood. Many RabbitMQ users may not be aware that EPMD exists or that it’s exposed. This lack of awareness can lead to overlooked vulnerabilities, as users trust defaults without applying basic network hygiene.
+
+## How to Secure Your EPMD
+
+**1. Use a Firewall or Restricted Network Interfaces**
+
+If you don’t need external clustering, ensure EPMD isn’t exposed:
+
+- Bind EPMD to localhost or a private network interface. In `vm.args`, specify:
+  ```bash
+  -kernel inet_dist_use_interface '{127, 0, 0, 1}'
+  ```
+- Deploy firewalls, security groups, or network access control lists (ACLs) to ensure port 4369 is not reachable from untrusted networks.
+
+**2. Remove Clustering Options if Not Needed**
+
+If you’re not clustering multiple Erlang/RabbitMQ nodes, don’t start the node with `-name` or `-sname`. Without these options, your application won’t register with EPMD at all. If you only run a single RabbitMQ node and do not need distribution, consider disabling or limiting it according to the official networking and clustering documentation.
+
+**3. Mitigation is Simple**
+
+A small configuration change or a single firewall rule can often resolve the issue. Once you’ve made changes to close or secure EPMD, scan again to confirm:
+
+```bash
+nmap -p 4369 -sV [Public IP]
+```
+
+If you’ve successfully closed the port, the output should look like this:
+```
+PORT     STATE  SERVICE
+4369/tcp closed epmd
+```
+
+**4. Follow Best Practices from the Community**
+
+- **RabbitMQ**: The official networking guide shows how to identify EPMD ports and close them down.  
+- **Erlang Ecosystem Foundation**: The security hardening guide explains what EPMD is, which ports are used, and how to secure them.
+
+## Conclusion
+
+EPMD is a powerful mechanism for distributed Erlang applications and RabbitMQ clusters, but it was never meant to be exposed to the internet. Fortunately, securing EPMD is straightforward, often just a matter of adding a firewall rule, adjusting a configuration setting, or using loopback interfaces. By taking these simple steps, you prevent unauthorized access, reduce risk, and keep your applications safe.