Slashdot Mirror
Most Home Routers Vulnerable to Flash UPnP Attack
An Anonymous reader noted that some folks at GNU Citizen have been researching
UPNP Vulnerabilities in home routers, and have produced a flash swf file capable of opening open ports into your network simply by visiting an unfortunate URL. Looks like Firefox & Safari users are safe for now.
It all hinges on going to a malicious web site. Just like email trojans, if you resist temptaion and use some common sense, do you really have to worry about this?
GetOuttaMySpace - The Anti-Social Network
I believe there is a paper covering this on arxiv.
I thought the recommended steps for setting up a router were:
A. Unbox
B. Throw away the disk
C. Plug in your machine, Turn on the router and navigate to the webgui
D. Turn off UPNP
E. ??? (Change default name and password, set WPA, Turn off SSID etc....)
F. Profit...
The point is, I'd always been told to turn off UPNP 'cos sooner or later something is going to open ports that you don't know about.
If you don't need UPnP, that should prevent you from being vulnerable. I'd imagine that most people don't really need it.
This will take an old-new argument to "to free or not to free my wifi" questions.
Is it only the factory firmware that's vulnerable or are you safe if you flash to one of the open-source hacks?
There was a thread on the Mozillazine forums about malicious JavaScript changing router settings about two years ago. Unfortunately, in October Mozillazine had a big foulup and many threads (and users, me included) were lost. I cannot find the thread now, but if I do I'll post back with a[n] URL. The thread's conclusion was that one should never leave the default password on the router.
It is dangerous to be right when the government is wrong.
My home router is a Linux NAT Server. (I sorta have a pissant about the fact that those things to be called "Routers" I have a DI-704, and I couldn't get it to route between two actual subnets. It only would NAT.
Anyway, my point. What about things like the Linksys WRT54GL?
The thing is, it would be awesome if there was a flash drive driven Linux device with a Cisco Style com port that ran off flash, could be OpenLDAP Server, Samba DC, Kerberos KDC, NAT Server, or actual router WITH a Cisco style Console port that are cheap. Why does this not exist??
...in this thread anyway, to recommend the flashblock plugin.
I installed it a couple of weeks ago, and really enjoy it. Banner ads have all but disappeared, and I don't even really notice (except for faster page loads and cleaner page layouts). If I want to see a YouTube video, that's easily accomplished--just click on the "F" icon in the blocked section of the page.
As an added bonus, I'm protected from all of these recent security breaches we've seen for Flash...aren't I?
"Beware of bugs in the above code; I have only proved it correct, not tried it." -- Donald Knuth
Like all "automagic" bullshit for lusers, whatcouldpossiblygowrong
I was about to say 13256278887989457651018865901401704640, but it appears this number is private property.
as usual opera is resistant.
Opera users are safe too.
[...] a flash swf file capable of opening open ports into your network [...]
:D
Hold on, now I'm confused: does this attack open open ports, or does it open ports open? Or even worse, does it open open open ports?
Hello! I'm a disaster waiting to happen!
I've always wondered about using StumbleUpon as a distribution method. I wonder if it is possible in such an exploit somehow force your profile to Thumbs Up the infected page, making it spread at a maximum exponential rate, since the rating system would only have to be vulnerable on the client side, I imagine.
My larger point though is that in a web where the actual URL of content is becoming more and more meaningless as meta sites start to coagulate content around them, what do users on the client side have to be able to combat such tactics? Is it reasonable to expect some sort of server side content awareness for such content sharing sites. A pruning mechanism of sorts seems like a necessity if you wouldn't want to contribute to the threat.
It's Opera browser that Runs an OLD version of flash on a Wireless network. I mean, do we need to worry about this when we go to the wrong site from our Nintendo? I hear they update it from the connect24 but not that often...
Ask not what you can do for your country. Ask what your country did to you
Turn off UPnP! Why on Earth do you want it on anyway? That's the problem here - an XSS is one matter, although being able to send SOAP-style requests across your local network is a major concern. But having a router that automatically opens ports based on virtually zero authentication? A nightmare waiting to happen.
Never used it. Never wanted it. Never turned it on. Always turned it off on EVERYTHING. UPnP is the problem here - a simple (unauthenticated) HTTP-style page requested in a browser suddenly starts opening ports to your network. It should not happen. Even my DSL router/wireless router/Linux router has SSL only, passworded access to do anything even approaching opening ports. And if a webpage pops up with an authentication dialog with the header "Wireless Router" and you type in your password, then you're a fool, unless you specifically requested the router's configuration page.
There's rarely even a log of what UPnP has done - which ports it's opened in the past etc. for whom.
Just turn the damn thing off. It's too dangerous.
i know it would be a dangerous precedent, but could it be possible to block all comments which contain the word 'nigger'? it's really been getting out of hand in the last few weeks and is costing a lot of mod points.
Your point seems to be a question.
Anyhoo, there's nothing uber special about Flash, you can just put a CF/SD card in an IDE/SATA adapter and attach it to a suitable computer, such as one of the fanless EPIAs, that one even has dual gige.
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
> The thread's conclusion was that one should never leave the default password on the router.
well, duh! Surely you didn't need the backup losers of Mozillazine to work that out!?
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
My cheapie Belkin access point has an option to turn off UPNP in the configuration. In fact, it is the default. That should kill that exploit rather quickly, shouldn't it?
Anyone realised that it can only open ports? (Especially since uPnP appears to be only a HTTP based request system, doing it should not be too difficult) But whether it can be made useful is questionable. You need a open client running on that specific port (which most likely cannot be done in any browsers) to be any where near exploitable).
and was pleasantly surprised to see UPnP disabled out of the box.
Are router manufacturers finally learning?
80 CC D8 AF AE D3 AB 54 B7 2E CE 67 C7
Only way it works. I can't for the life of me understand what I would need it for anyway.
Because very few people are using IPv6 and IPv4+NAT breaks a lot of protocols that depend on the computer being available to the outside world. No, static port forwarding doesn't solve the issue as it's pain to setup/maintain if you have multiple computers.
I live in Cincinnati, Ohio. You come (wirelessly) break into my router, change the current settings by opening port 1337, and I'll refund the cost of your travel (as determined by hotwire or expedia's fare rates on the day of your travel), and pay you $100 additional, all in cash on the same day.
It's a SOHO router, but I won't tell you what make/model -- if your prowess is as you claim, you should have no trouble determining that. You may not enter the apartment or inspect any systems currently connected -- but you shouldn't need to. I have no other firewalls, proxy servers, or tricks on the front end of this router -- it's straight from modem to unit. You may have 48 consecutive hours to complete the task.
Still confident? Email me at radams theatsign tohuw.net and make arrangements.
Appended to the end of comments you post. 120 chars.
Excuse my ignorance/confusion, but... I'm not up on the details of either Flash or UPnP, and yet I still need to understand this better and so I have a few questions.
Is the Flash being discussed the Flash player for a browser, right? (Not some sort of Flash related to flash memory and the BIOS and/or USB Flash drives? And the Flash issue is not in the router?)
Why is there a difference between the Flash vulnerability in different browsers? What's the basis of the protection? Is it because the player binaries differ between browsers, or because the security model of the browsers differ, or what?
If a Flash player is running malware already, why does it care any longer about the router? Isn't it already in my machine, and hence inside my network? And can't it generally get out quite easily with whatever data it finds without further problem? Or is there some security model limiting the actions of the Flash player to only certain operations?
Is it forbidden from writing files, particularly executable files? I assume a virus utility would notice this, but maybe since it's a trusted plug-in, it wouldn't?
If it can access web pages, isn't there also a potential vulnerability that many routers are configurable from inside the firewall over the network? In that case, couldn't it reenable UPnP itself? (Even if it was forbidden to read files from the disk and access the net, couldn't it just do the web page modification and then wait for a later copy of itself to arrive on a separate occasion to exploit the previously and silently opened hole?) If that can happen at all, will having a decent password for one's firewall reduce this risk? (Even though I have WPA-PSK enabled and a pretty long password, internal connections to a router over a secure connection seem like they're going to succeed because of the PSK, leaving the router's admin password the only thing in the way... or is there some other fortunate barrier?) Do routers tend to protect themselves from internal exhaustive or dictionary attacks? Would a virus protection tool notice this, or would it just think it normal that a browser was opening lots of web pages? In other words, do I need to switch my router to be configurable only over a serial link? (Even if I did, would I be vulnerable while the serial line was connected?)
If there's just a FAQ with answers to questions like these, please point me to it. I read the article, but it was pretty thick with device and protocol and program-specific jargon that even a technical person might not understand, depending on their areas of expertise.
Kent M Pitman
Philosopher, Technologist, Writer
For those of us with a large network, it's easier to keep it on when someone wants to use Transmission client on Linux randomly for bittorrent.
now there is a heretical thought.
$trojan opens port. Talks to upnp server. Your machine gets pwned.
script/flash/exe/whatever opens port 445. Your network gets pwned.
Because there's no authentication upnp shouldn't be allowed anywhere near a network. At the very least a verified password should be needed to activate the port forwarding each time.
Really, developers shouldn't write shitty protocols that require it. Luckily it's becoming rarer.. few games need it (if any, these days.. certainly nothing recent), even bittorrent clients are getting better (the early ones needed something like 10 ports.. newer ones need 1). There's absolutely no need for a non-server to be requiring open incoming ports - on a client they should all be outgoing and handled naturally by the NAT logic.
Way OT:
There seems to be a lot more racist AC posts lately. Wondering if the ulterior motive is to suck up mod points and basically dilute the moderation system?
Also, isn't this one word, along with a regexp of it, that should trigger a longer than usual time-out before AC submission? It would avoid censorship since the post would still submit, just severely speedbumped. It's used so infrequently that if someone decides to use it in a "valid" post, the delay would be a minor inconvenience. For trolls creating throwaway accounts, the IP/username association slows them down anyway.
Of course the slippery slope is doing the same for myminicity, goatse links...
Ok, for this to succeed the site would have to know your router's internal IP address. 192.168.1.1 is very common in early routers, but this has changed recently.
Now, to actually get to the computer, it would also have to bypass your software firewall as well.
Of course, all this does is open ports, it doesn't actually attack or exploit anything.
This is a potential exploit, but not a working one yet.
Shouldn't this read "IE has yet another vulnerability!" "Looks like Firefox & Safari users are safe for now." seems a bit underplayed to me. I say this only because if I were to use IE I would want to know.
MSIE only? Gee, I'm shocked. Utterly amazed.
I understand and agree that UPnP should be off anyway, but (as was noted in an earlier reply) this isn't any different than surfing to any other IE-exploiting page and the same precautions apply. For starters, using something other than IE.
I have a couple of Netgear routers and both shipped with UPnP off by default.
UPnP can be enabled or disabled for automatic device configuration. The default setting for UPnP is disabled. If disabled, the router will not allow any device to automatically control the resources, such as port forwarding (mapping), of the router.
Never shake hands with a man you meet in a fertility clinic.
The offender is called NAT Traversal
"UPnP comes with a solution for NAT (Network Address Translation) traversal, called the Internet Gateway Device (IGD) protocol. NAT traversal for UPnP enables UPnP packages to pass through a router or firewall without problems and without user interaction, (that is if that router or firewall supports NAT). It essentially allows any local UPnP device to punch arbitrary holes in the firewall, by letting the firewalled router create port forwardings automatically."
it comes & goes, all it takes is a perl bot and some boredom, perhaps this guy got laid off from his job / finished his degree and discovered that he could spend his time doing nigger posts to /.
:)
it's not me btw
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter
Well said, -thimk!-. I have no mod points today so I will give you kudos instead. Very informative post.
"Security vulnerabilities aside, open access points are a legal nightmare waiting to happen " Don't assume this is true, it may be the opposite of true, depending on your jurisdiction. Some places, like Germany I believe, can hold you responsible for actions that occur on your network if not "properly secured." However, there have been several US lawyers and networking experts who have argued that if you secure your network to the best of your ability and it is infiltrated, you may be responsible in that you knew security was needed and failed in your implementation. It may also implicate yourself in any illegal activities if there is no way to identify the infiltration, as is the case in the poor and ethereal logging of almost all consumer grade wireless routers. An open router may provide more protection in most of the US than a secured router, as it gives you cover of plausible deniability (an useful tool for the innocent, as well as the guilty).
Couldn't flash be updated to solve this?
You're not going to get people to turn off UPnP...
What about google "polite flash ads"?
1) They are polite
2) They are interesting for you
3) People need cash to blog. Google "polite flash ads" do that
4) Thanks to google polite flash ads, you can have bloggers who do everything to catch your attention. Without google polite flash ads, there wouldn't be any content on the internet, like 1993!
5) It excuses google's extreme profits which seemed to come from nowhere and this way google search can keep being free.
6) Google is something like open source.
7) Google needs money to fund mozilla corporation.
Don't be a thief.
Think about it and view google ads honestly.
One of the top professionals in the security industry, Bruce Schneider, runs and open wi-fi network. As he puts it, you computer should be secured weather on your network, or on a public network. I also have a open network, no-one abuses it and I'm quite happy for someone to come along and use it for free, as long as they don't download torrents or something. So I do have UPnP disabled as it will probably stop a novice downloading torrents. However, I keep my computer secured, and would be happy on an insecure network, or if someone forwarded a port on my router.
Opera is proprietary software, therefore it is untrustworthy by default. The only people who can inspect, modify, and distribute improved versions are the very people you can't trust to work on your behalf—the proprietors. There's nothing they can say to make up for this lack of security because you can't verify their improvements (the source code is not only unavailable to you, the proprietor disallows decompiling the binary and seeing what it's doing, or making changes to suit your needs). To be sure Opera isn't problematic you need Opera to respect your software freedom.
Digital Citizen
Most home users are vulnerable to social engineering attacks. Until this vulnerability is fixed somehow, it doesn't really matter much whether they run secure routers or not. All crackers need to do is to pick up a phone and ask for the password. The most secure router in the world isn't going to protect users from their own stupidity, so perhaps we should educate users to be security-conscious rather than just download the latest patches without understanding what security is.
big whoop if upnp has a problem. what about the case when no router exists at all? it seems like routers have been a big fat excuse to leave a bunch of insecure services running. we may as well tighten security on those services; i.e. nobody should be able to do ssdp unless they are on the same subnet, at least. maybe upnp is insecure, but it should (in theory) not be a big deal if someone can get access to your file sharing service from an external ip.
This concept affects ALL browsers, don't let the Firefox,Safari,Opera groupies leave you with a false set of security. It is also OS agnostic using the methods listed in the article or other undocumented browser callback script techniques.
The example given is using Flash, this is a problem with Flash operating at a level it should not allow plugins to do so.
Additionally, there are methods outside of Flash that can utilize this as an exploit, and the other methods work in EVERY browser except IE7 running on Vista, as Vista's protected mode blocks the exploit ironically making it the most secure browsing option.
There are valid and secure ways of using UPnP. UPnP is more than just opening ports on a router and serves greater functionality on networks.
UPnP and router security should probably be revisited, but throwing away the functionality because of this risk would be disasterous.
ALL browers need to re-look at exploitable script callbacks that could be used to touch UPnP. There are exploits in all browsers, that are NOT documented in this article. Additionally, Adobe needs to get a freaking handle on the crap involved with Flash and security.
Flash has always had lots of vulnerbilities and risks. To the point that Microsoft diabled user created Flash use of Winks in Messenger because of Flash vulnerbilities. Flash's inherent insecurity is also another reason Micorosft has moved forward with Silverlight.
Does this exploit depend also on a weird UPnP implementation from the router's manufacturer part? Would someone running DD-WRT on his home router be at risk?
G.
I agree - the problem is in the underlying Flash plugin, and uses the documented functionality of the 'navigateToURL' function and the 'URLRequest' object. This isn't as much a problem with browsers or Flash, though, as much as it is a weakness in UPnP.
Whatever browser you use, if you have one of those home Internet Gateway routers, then make sure UPnP is disabled and you're not using the default password!
Also, keep an eye on your other networked devices (phones, cameras, etc.) - they may also support UPnP and would be vulnerable.
Here's an update from GNUCITIZENS with further clarifications: http://www.gnucitizen.org/blog/flash-upnp-attack-faq
How dare you make racist comments against Asians, you insensitive clod!
1) TURN OFF UPnP! Anyone who has been listening to Security Now has known about this issue for the past two years. UPnP is by design insecure. If it is turned off it can't be used to attack your router. The only reason to have it is so that you don't have to configure anything when a program decides it needs to be open to anyone contacting it. Personally, I would rather have control over when someone else can talk to my computer.
2) Browse with No-Script (or similar settings in the other browsers). If JavaScript and Flash are blocked as you are browsing sites and only turned on when you need them, you can't be hit by drive by attacks like this one. Heck, I've seen maybe 2-3 banners in the past couple months with a combination of No-script, Adblock, and Flashblock.
3) Change the default settings of your router. This won't prevent the attack described necessarily, at least without the above steps, but it will make sure those steps aren't for nothing. The most important thing this prevents is a CSRF attack to turn UPnP back on, even if you have it off. This also would require not staying logged into your router when you don't need to be (and routers without gaping CSRF holes built in that don't need passwords)
Clones are people two.
Or if you don't need to keep them dynamic, just use static IP addresses?
Have you tried doing the xbox network diagnostic? I suspect you will get something other than NAT: Open for the last test, and I've always had a lot more trouble connecting to games when the NAT wasn't open. Same thing goes for pretty much any P2P communication, you won't be able to communicate without one side having a traversable NAT.
You'd probably have much less trouble on live (assuming you play P2P), and with bittorrent, etc. if you had the ports forwarded properly.
P.S. I have a UPnP NAT device, but I still had to forward the ports manually in order to get NAT: Open on live, though UPnP seems to work ok with uTorrent, MSN, etc.