Slashdot Mirror
Most Home Routers Vulnerable to Flash UPnP Attack
An Anonymous reader noted that some folks at GNU Citizen have been researching
UPNP Vulnerabilities in home routers, and have produced a flash swf file capable of opening open ports into your network simply by visiting an unfortunate URL. Looks like Firefox & Safari users are safe for now.
It all hinges on going to a malicious web site. Just like email trojans, if you resist temptaion and use some common sense, do you really have to worry about this?
GetOuttaMySpace - The Anti-Social Network
I thought the recommended steps for setting up a router were:
A. Unbox
B. Throw away the disk
C. Plug in your machine, Turn on the router and navigate to the webgui
D. Turn off UPNP
E. ??? (Change default name and password, set WPA, Turn off SSID etc....)
F. Profit...
The point is, I'd always been told to turn off UPNP 'cos sooner or later something is going to open ports that you don't know about.
This will take an old-new argument to "to free or not to free my wifi" questions.
as usual opera is resistant.
[...] a flash swf file capable of opening open ports into your network [...]
:D
Hold on, now I'm confused: does this attack open open ports, or does it open ports open? Or even worse, does it open open open ports?
Hello! I'm a disaster waiting to happen!
Turn off UPnP! Why on Earth do you want it on anyway? That's the problem here - an XSS is one matter, although being able to send SOAP-style requests across your local network is a major concern. But having a router that automatically opens ports based on virtually zero authentication? A nightmare waiting to happen.
Never used it. Never wanted it. Never turned it on. Always turned it off on EVERYTHING. UPnP is the problem here - a simple (unauthenticated) HTTP-style page requested in a browser suddenly starts opening ports to your network. It should not happen. Even my DSL router/wireless router/Linux router has SSL only, passworded access to do anything even approaching opening ports. And if a webpage pops up with an authentication dialog with the header "Wireless Router" and you type in your password, then you're a fool, unless you specifically requested the router's configuration page.
There's rarely even a log of what UPnP has done - which ports it's opened in the past etc. for whom.
Just turn the damn thing off. It's too dangerous.
If the firmware has UPnP IGD enabled, then your machine is vulnerable to this attack.
The vulnerability is really Flash not restricting what untrusted scripts can do. The router's UPnP IGD profile is working as designed - an application on a machine within the firewall requests that an incoming port be forwarded, so the router does that. This is useful for VoIP, IM, P2P and other applications that need to be contactable from the outside world. Malicious programs that are running on your machine can always initiate outgoing connections, so generally the UPnP IGD is not allowing anything that cannot already be done. In the case of Flash, it is probably blocking most outgoing connections, so UPnP does expand the possibilities for a malicious Flash app to initiate connections with your machine. But unless Flash also allows you to open server sockets, the attacker would also need to find an exploitable service running on your machine.
All this should be detectable by a decent firewall program running on your local machine.
I live in Cincinnati, Ohio. You come (wirelessly) break into my router, change the current settings by opening port 1337, and I'll refund the cost of your travel (as determined by hotwire or expedia's fare rates on the day of your travel), and pay you $100 additional, all in cash on the same day.
It's a SOHO router, but I won't tell you what make/model -- if your prowess is as you claim, you should have no trouble determining that. You may not enter the apartment or inspect any systems currently connected -- but you shouldn't need to. I have no other firewalls, proxy servers, or tricks on the front end of this router -- it's straight from modem to unit. You may have 48 consecutive hours to complete the task.
Still confident? Email me at radams theatsign tohuw.net and make arrangements.
Appended to the end of comments you post. 120 chars.
If a flash plugin can make outgoing XML requests it can persuade a upnp server to make your machine wide open, thus completely disabling your firewall. Making those kind of requests sounds like the kind of thing you want Flash to do, so I'd imagine all versions are vulnerable.
There are some ports.. 137,139,445,etc. that you really don't want on the open internet. If the plugin does something like a port forward of 0-65535 to your machine suddenly *every* service on there is wide open to any attack. It'll bypass protections from eg. the default XP firewall as the packets will appear to be coming from the local LAN (the router) rather than the original source.
It's not just flash (although a malicious advert on a page is the most obvious vector for this). Anything that runs on your machine can do it.. I reckon you could craft such an attack in javascript even (XMLHttpRequest with the right code).
Once the ports are open anything that manages to run on your machine can leave itself wide open without having to make telltale outgoing port connections (although it's often said that outgoing connections are the reason upnp is 'not worse' than existing protections, no working trojan would work in that manner, since the target of the outgoing connection would quickly be found and shut down.. OTOH leaving a trojan on your machine listening on your machine waiting for the command to send spam/infect others/distribute child porn/whatever is much more real a thread).