Slashdot Mirror

← Back to Stories (view on slashdot.org)

50 Million Potentially Vulnerable To UPnP Flaws

Posted by Soulskill on from the much-lower-than-expected dept.

Gunkerty Jeb writes "In a project that found more than 80 million unique IP addresses responding to Universal Plug and Play (UPnP) discovery requests, researchers at Rapid7 were shocked to find that somewhere between 40 and 50 million of those are vulnerable to at least one of three known attacks. A Rapid7 white paper enumerated UPnP-exposed systems connected to the Internet and identified the number of vulnerabilities present in common configurations. Researchers found that more than 6,900 product models produced by 1,500 different vendors contained at least one known vulnerability, with 23 million systems housing the same remote code execution flaw. 'This research was primarily focused on vulnerabilities in the SSDP processor across embedded devices,' Rapid7's CSO HD Moore said. 'The general process was to identify what was out there, make a list of the most commonly used software stacks, and then audit those stacks for vulnerabilities. The results were much worse than we anticipated, with the most commonly used software stack (libupnp) also being the most vulnerable.'"

138 comments

  1. Everything's In HD by Anonymous Coward · · Score: 0, Funny

    Even HD Moore's Law now.

  2. Because of the BSD license by Anonymous Coward · · Score: 1, Insightful

    Little incentive to contribute code as it will be snatched by Micro$oft and App£e.

    1. Re:Because of the BSD license by Anonymous Coward · · Score: 0

      Idiotic troll bait at its best.

    2. Re:Because of the BSD license by NotBorg · · Score: 2

      Upstreaming your work can save you time (money) regardless of license. You can maintain your patch set independently indefinitely, but pushing your patch upstream makes it more likely that someone else will do it for you and perhaps do it better than you. Even if your patch is trivial, sometimes a small change can inspire more work.

      I once submitted a patch fixing an obscure overflow. It was a simple off-by-one flaw. Someone else scratched their head and decided to check the software for more code defects of similar nature. My simple change kick-started off around 15 more changes making my downstream project more secure and stable. I got more than my money's worth by submitting my work upstream.

      It's not about someone else "stealing" your work, it's about doing less work and often getting more work done for free.

      --
      I want this account deleted.
  3. Re:Who cares about RTFA by Anonymous Coward · · Score: 0

    Damn you Anonymous Coward and you HD Moore's Law!

  4. UPnP is a vulnerability by Anonymous Coward · · Score: 0

    n/t

    1. Re:UPnP is a vulnerability by telchine · · Score: 1

      Does anyone know where I can find a list of routers which aren't vulnerable?

    2. Re:UPnP is a vulnerability by OolimPhon · · Score: 1

      Does anyone know where I can find a list of routers which aren't vulnerable?

      Have you tried scanning the Internet?

    3. Re:UPnP is a vulnerability by Stalks · · Score: 1

      This!

      uPnP is a solution to a non-problem. Whats the point of any firewall if an application can request a hole through it?

      There is the capabilities of having ACLs but the majority of routers it is just a tick-box to enable/disable, allowing any device internally to have free reign to accept incoming requests.

    4. Re:UPnP is a vulnerability by green1 · · Score: 4, Informative

      Almost all routers are not vulnerable, if you are smart enough to uncheck the UPnP box. I haven't seen many where you can't disable it. and as has been pointed out elsewhere. Running a firewall where any malware can request a gapping hole in it sort of defeats the purpose.
      These flaws are already a non-issue to anyone who takes security seriously. The problem is that the average user leaves things as they come from the factory, and they come from the factory vulnerable.

    5. Re:UPnP is a vulnerability by hairyfeet · · Score: 2

      Nooo...its a solution to a VERY real problem but its a problem that most geeks don't realize exists. You see your average Joe has all these devices that can connect to the Internet, multiple PCs, tablet, phone, Internet enabled TV, but they don't have a damned clue on how to make ANY of that shit play nice with one another or to set it up so they can use them on the net as they were designed.

      So UPNP was invented so Joe average wouldn't have to pay a guy like me a couple of hundred bucks to set up their network while at the same time not having the routers set to just broadcast in the clear with zero encryption and for that? it actually worked pretty well. Now we need a new generation that will be backwards compatible enough so that everyone isn't gonna have to throw out their TVs or tablets while bumping up the security.

      But you can't just throw the baby out with the bathwater as folks still need a way to get all this stuff to hook up and to talk to each other without having to have a degree just to get it to work. Like it or not UPNP is a very useful tech to Joe and Jane average and as we get more and more internet capable devices they'll need plug and play simple even more.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    6. Re:UPnP is a vulnerability by Stalks · · Score: 1

      My understanding was that UPnP was for punching a hole in the firewall/NAT for incoming requests.Joe Average doesn't need this functionality does he?

      Outgoing NAT on consumer grade routers is a separate feature from UPnP and isn't required to use your laptop/TV/tablet/phone on the internet.

      I think UPnP at the most (ni the average house) is used by the Playstation to host or any other server-less P2P network for connectivity. Solve that problem, and we're gold.

    7. Re:UPnP is a vulnerability by Myopic · · Score: 1

      What about those of us who want to use UPnP and so can't trivially uncheck the box?

    8. Re:UPnP is a vulnerability by tqk · · Score: 1

      You see your average Joe has all these devices that can connect to the Internet, multiple PCs, tablet, phone, Internet enabled TV, but they don't have a damned clue on how to make ANY of that shit play nice with one another or to set it up so they can use them on the net as they were designed.

      So Microsoft, instead of handing the user a rag and a bottle of Windex (or water diluted vinegar which works just as well) to clean their dirty [Ww]indows so they can see out, instead handed them a hammer so they can break the glass.

      Amazing. UPnP has been a disastrous idea from day one. It surprises me every time I hear of someone who's ignorant of this.

      --
      "Tongue tied and twisted, just an Earth bound misfit ..." -- Pink Floyd.
    9. Re:UPnP is a vulnerability by l33t+gambler · · Score: 1

      NAT is not an argument for security, don't combine it with a firewall like that. uPnP was a workaround to the NAT problem that was a workaround to the single public IP most ISP's provided to their customers. I remember I had to coax my ISP to give me more IPs so I could play Starcraft 1 online with my friends against other players. Great fun, and I got to play around with a Juniper traffic shaper and IP assignment.

      If you want to run a server or host anything, having support for uPnP is great - you don't have to login to the router and open any ports. Just run the program or game and everything just works.

      It is really sad that these security holes has been uncovered, but even more sad that hardware manufacturers seldom offer software support beyond their shelf time. I think we need a consumer law that says you can return or exchange your hardware if the manufacturer refuses to update their firmware. And if they won't provide new hardware to you, they should be forced to open-source their unsupported stuff in the name of security.

      Hmmm that might become really insteresting if I think about Microsoft, Windows XP and Internet Explorer 6 :D

      --
      Teasing the nobles, and rightfully so!
    10. Re:UPnP is a vulnerability by Anonymous Coward · · Score: 0

      Joe Average doesn't need this functionality does he?

      He does if he wants to use bittorrent.

    11. Re:UPnP is a vulnerability by UltraZelda64 · · Score: 2

      Then sleep well knowing that your insistence on continuing to use a known insecure feature just for a little bit of extra convenience might just come back to bite you in the ass eventually. The rest of us who know the flaws of UPnP and how to manually set up port forwarding and/or port triggering have likely already done this long ago; we survived, our networks aren't broken. It's really not difficult; just a couple switches on the router to match the ports of the software you use.

    12. Re:UPnP is a vulnerability by UltraZelda64 · · Score: 1

      Nooo...its a solution to a VERY real problem but its a problem that most geeks don't realize exists. You see your average Joe has all these devices that can connect to the Internet, multiple PCs, tablet, phone, Internet enabled TV, but they don't have a damned clue on how to make ANY of that shit play nice with one another or to set it up so they can use them on the net as they were designed.

      Well, it's about time they fucking learn. Computers don't need to be dumbed down to toaster levels... their increasing number of users need to learn a thing or two about a network of they want to have one in the first place. This mass retardation of computers has allowed even the dumbest people to do basic things on them, and that's great--but if these people want to do anything more advanced, then maybe it's time that they read up and learn how. This mass dumbing down of computing and networking is creating security problems while at the same time inviting even more dumbasses in droves. The world would be better off with fewer of these people, even if that means fewer new computer owners.

      There is a reason you have to go through a period of training at a new job, and plenty of practice followed by a test just to get your license to drive a vehicle. There is a certain skill set that is expected, and with computers, that should be no different. Any machine down to a damn cash register should be understood before just diving in. Fuck, you should even have a basic understanding of a toaster before you use one, or else you'll end up getting burned, electrocuted, or even burn the damn house down. It is the users who need to get smarter... not the computers.

    13. Re:UPnP is a vulnerability by Jmc23 · · Score: 1

      Are you sure you want to use upnp over the internet? The upnp setting does not affect local network upnp.

      --
      Don't complain about syntax, grammar, or spelling. There is no.hell like input on android.
    14. Re:UPnP is a vulnerability by aztracker1 · · Score: 1

      I tend to think of it as very useful... if you've spent the time trying to do on-demand ports for games, irc, ftp etc... it's not fun opening up all those nat forwards... upnp is a bit easier. Though, I'm generally the only user on my network at home...

      --
      Michael J. Ryan - tracker1.info
    15. Re:UPnP is a vulnerability by green1 · · Score: 1

      Translation: "how can I enable a security vulnerability while disabling a security vulnerability?"
      The sentence just doesn't parse that way does it?
      There is no secure way to let any piece of software that wants to open your firewall do so. The whole concept of a firewall is disabled by the idea of UPnP.

      If you need a port opened, then open the port. Letting random software do it automatically is just asking for trouble.

    16. Re:UPnP is a vulnerability by klui · · Score: 1

      Appropriate reply based on user name. I see what you did there.

    17. Re:UPnP is a vulnerability by Max_W · · Score: 1

      I've read that in Estonia children are educated at school, at young age, the practical usage of computers and networks. I would add to it digital photography, image editing, digital cartography, and smartphones.

    18. Re:UPnP is a vulnerability by TechyImmigrant · · Score: 1

      >My understanding was that UPnP was for punching a hole in the firewall/NAT for incoming requests

      No, uPnP is primarily about AV devices finding each other so they can do stuff like sending video from the video source to the TV. It's network detection and selection, device discovery, service discovery and service negotiation. All run of the mill consumer electronic behaviors that the industry has managed to massively screw up for the past 30 years. P1394 tried and screwed it up (discovery and negotiation). uPnP tried and screwed it up (bad security, ineffective discovery). P802 tried and screwed it up - LLDP (too little), 802.21 (too late). I could go on. You still cannot string one wire, or wireless interface between standards compliant boxes, computer, dvd, tv, speakers, roku-esque box and have them find each other and present a user with the right options like "watch dvd" or "watch roku" or "watch TV".

      The punching-a-hole thing is a router behavior to allow uPnP to work across the router (whether firewalled or not), because by default they block uPnP, as they should.

       

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
    19. Re:UPnP is a vulnerability by Stalks · · Score: 1

      Okay thats great thanks.

      My experience of UPnP has been from routers and firewalls. For example the linux daemon for upnp upnp just adds a NAT rule in the UPNP table.

      The pfSense option does the same thing.

      The article is about upnp from many IPs (via routers I would of imagined)

    20. Re:UPnP is a vulnerability by TechyImmigrant · · Score: 1

      Yes. Millions of vulnerable uPnP implementations in consumer electronics, behind cheap NAT routers that by default allow a uPnP hole.

       

      --
      I should use this sig to advertise my book ISBN-13 : 978-1501515132.
  5. Is it ``hacking'', the way they discovered it? by girlinatrainingbra · · Score: 4, Interesting
    So did they come up with the number of vulnerable sites from (a) -- sales figures of devices with UPnP enabled by default,

    or did they actually do active spidering of (b):

    1 -- a representative sample of IP addresses in a particular space 2 -- a wide ranging probe of many many IP addresses all around the world?
    .

    If they did (a) above, then sure it makes sense. If they did (b1) or (b2) above, especially if they didn't get the permission of every IP address which they probed/tested, then aren't they doing illegal penetration testing, even if all they are doing is checking for the existence of a responding port? I mean one or two or an accidental port knock would be like knocking IRL on a random stranger's door, but a sequential serialized intentional attempt to knock on so many doors to test vulnerability, well that's just annoying and wrong, and possibly illegal,eh?

    1. Re:Is it ``hacking'', the way they discovered it? by Anonymous Coward · · Score: 5, Informative

      Their methodology is explained in the report. Halfway through the first page of executive summary you'll find the following:

      UPnP discovery requests were sent to every routable IPv4 address approximately once a week from
      June 1 to November 17, 2012.

    2. Re:Is it ``hacking'', the way they discovered it? by girlinatrainingbra · · Score: 2

      yep, i noticed that too when i RTFA'd after posting, just like every other dottir here on /. ;>)

    3. Re:Is it ``hacking'', the way they discovered it? by AC-x · · Score: 1

      If they did (b1) or (b2) above, especially if they didn't get the permission of every IP address which they probed/tested, then aren't they doing illegal penetration testing, even if all they are doing is checking for the existence of a responding port?

      Would it be illegal though? For example how would it be illegal to scan port 80 on every public IP address?

    4. Re:Is it ``hacking'', the way they discovered it? by girlinatrainingbra · · Score: 1
      Well, they didn't have to use a representative sample of IP addresses, as they went ahead and sent "probes" about UPnP to every routable IPv4 address over 4+1/2 months (from June to mid-november 2012)
      .
      Halfway through the first page of executive summary you'll find the following: UPnP discovery requests were sent to every routable IPv4 address approximately once a week from
      June 1 to November 17, 2012.

      I didn't notice that detail the first time I read the article.

    5. Re:Is it ``hacking'', the way they discovered it? by mellon · · Score: 1

      It's good to know that the slashdottir are looking out for us.

    6. Re:Is it ``hacking'', the way they discovered it? by Bengie · · Score: 2

      As far as I can tell, scanning ports is not illegal unless you do so in a manner that can DOS them.

    7. Re:Is it ``hacking'', the way they discovered it? by Gr8Apes · · Score: 1

      But then you're expecting people to RTFA? The nerve!

      --
      The cesspool just got a check and balance.
    8. Re:Is it ``hacking'', the way they discovered it? by Zero__Kelvin · · Score: 1

      " aren't they doing illegal penetration testing, even if all they are doing is checking for the existence of a responding port? I mean one or two or an accidental port knock would be like knocking IRL on a random stranger's door, but a sequential serialized intentional attempt to knock on so many doors to test vulnerability, well that's just annoying and wrong, and possibly illegal,eh?"

      You are kidding right? Also, a better but still imperfect analogy would be that they are walking down streets observing if doors exist, and if they are closed or open. A knock is an attempt to gain access, which they are not doing.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    9. Re:Is it ``hacking'', the way they discovered it? by Anonymous Coward · · Score: 1

      If your last name is Slashdottir, that probably means that you're a girl whose Icelandic mom got to "hang out" backstage at a Guns n Roses concert a few years back.

    10. Re:Is it ``hacking'', the way they discovered it? by Anonymous Coward · · Score: 0

      It's good to know that the slashdottir are looking out for us.

      What about the slashsson?

    11. Re:Is it ``hacking'', the way they discovered it? by Anonymous Coward · · Score: 0

      This is a spammer that copies parts from other people's comments and adds a link. Do not click the link.

    12. Re:Is it ``hacking'', the way they discovered it? by girlinatrainingbra · · Score: 1

      Yeah, scanning port 80 ought not be illegal, as port 80 is recognized as a resource point for the WWW, but if you kept trying out ports 25 for SMTP looking for an accessible proxy or 23 or 107 for telnet or even banging on 22 for ssh and even trying a few default user/pw combos, that somehow feels wronger, doesn't it? That's more like walking up to the door and not just rattling the knob but telling the butler, "hey it's me, let me in, you know me!, c'mon let me in!"

    13. Re:Is it ``hacking'', the way they discovered it? by AC-x · · Score: 1

      "Feels wronger" doesn't mean it's actually illegal tho

    14. Re:Is it ``hacking'', the way they discovered it? by Anonymous Coward · · Score: 0

      In the time it took you to compose your post you could have skimmed the article and found out how to not ask a stupid question for the whole world to ROFL at.

  6. Long standing bet by EmperorOfCanada · · Score: 5, Insightful

    I have had a long standing bet as to how long it would take for someone to really nail most of the routers out there. It has always puzzled me how something like Linux or Windows can have a vulnerability of the week which is (usually) patched by most users in a flash. Yet there are many very old d-link, linksys, etc routers out there doing their thing without being massively attacked.

    The closest that I have seen to a good widespread attack was when a certain DSL modem would crash when script-kiddies were attacking NT machines and the same attack jammed up that model DSL modem. That wasn't really an attack and it didn't amount to much.

    So my bet still stands with modification: there will be an attack, it will be soon, it will be a worm, and people will (mostly) be blissfully unaware of (why is my internet so slow) it and certainly be incapable of dealing with it. Thus it will come down to the ISPs to deal with it which should be interesting to watch.

    1. Re:Long standing bet by Anonymous Coward · · Score: 0

      Simple, there's a smaller attack surface. Just look at the exploited flaws in client applications: script engines (javascript, flash), parsing code for complicated document formats. Complex code, large attack surface. Router software isn't complex like that, right?

    2. Re:Long standing bet by Corwn+of+Amber · · Score: 3, Insightful

      Router software is utter, total, complete shit and all of it is attackable with 25-year-old buffer overflows.

      GP is right. A worm packing a handful of attacks, designed to replicate on old routers, would make hundreds of millions of victims and nothing could stop it.

      It would actually force the rock-stupid morons to replace their obsolete hardware, though. That would be a good thing. Even if they buy the new castrated shit hardware that won't ever be supported.

      --
      Making laws based on opinions that stem up from false informations leads to witch hunts.
    3. Re:Long standing bet by Anonymous Coward · · Score: 0

      Like they don't have that same 25-year-old buffer overflow bug in the new model?

    4. Re:Long standing bet by Corwn+of+Amber · · Score: 1

      They have other bugs, still buffer overflows. Basically, all models that don't have sanitation on all inputs can be hacked that way. And there are zero consumer routers that sanitize everything. But there are a lot of consumer routers that can very simply be 0wned and stay 0wned.

      Still wondering why anyone ever bothered making botnets out of Windows boxes. It's so much easier to keep routers infected than PCs.

      --
      Making laws based on opinions that stem up from false informations leads to witch hunts.
    5. Re:Long standing bet by Anonymous Coward · · Score: 0

      That sounds really bad. Someone could install bittorrent and tor relays on 80 million routers. Just thinking...

    6. Re:Long standing bet by Bearhouse · · Score: 2

      Interesting thought, which has probably occurred to other people, of course.
      I suppose the reason why we have not seen large-scale attacks on routers so far, (and maybe there are some out there already, undetected) is that it has just been easier to infect PCs and use them in botnets, with the tools widely available.
      Would probably take a little more time and ingenuity to setup a net of zombie routers, with the need to tailor the worm or whatever a little to each model/software stack.
      However, once it was in place, can you imagine the disruption? Most SOHO & home users don't know anything about their ISP modem/routers at all, and use them by default as their firewall. Imagine that *gone* tomorrow. An ISP trying to roll-out large-scale firmware updates via a non-tech-savy audience sounds like a recipe for disaster. (Although I suppose many of the later models support remote update...).
      Since many users have no choice in their selection of ISP device, it is surely the responsibility of the ISP to make them secure...yeah, like it's their responsibility to get us all IPv6-compatible stuff too...don't hold your breath.

      In the meantime, roll your own firewall box everyone, and while you're at it, do one for your friends and relations. It's cheap and fairly easy.
      Here's a good place to start.
      http://www.amazon.com/Building-Firewalls-OpenBSD-PF-2nd/dp/8391665119 (You don't have to use BSD, of course, most any flavour of *x will do)
      Or just download a distro where pretty much all the work has been done for you.
      http://www.techradar.com/news/software/applications/7-of-the-best-linux-firewalls-697177

      Of course, sitting smug and secure behind your shiny new firewall box will not help if you cannot access the net except via your compromised POS router. If you can, buy a decent one to substitute for the ISP-supplied crap.

    7. Re:Long standing bet by 2fuf · · Score: 1

      The way you describe it'll be hard to call your bet. How can one disprove this hasn't already happened?

    8. Re:Long standing bet by Anonymous Coward · · Score: 1

      Still wondering why anyone ever bothered making botnets out of Windows boxes. It's so much easier to keep routers infected than PCs.

      Try to put something on a device that is underpowered for the job it is designed for. Many DSL routers break CPU and/or memory wise if you really use your connection.

    9. Re:Long standing bet by Anonymous Coward · · Score: 0

      How many models of routers with different OSes and architectures do you think are out there? How many of them have development toolchains readily available?

      You could target something like WRT, but then those are more likely to get patches and/or have UPnP disabled.

      It could be used for pointed attacks, but then again, what kind of targeted attack worthy organization has UPnP facing Internet?

    10. Re:Long standing bet by peragrin · · Score: 1

      It is simple processing power.

      you hack a router the victims internet slows down. Whether your using bandwidth or not. They notice it, eventually call the ISP. The ISP makes you plug a real computer in and suddenly everything is moving fast again.

      You go to best buy plunk down some cash get another router. The old one goes in the garbage.

      no more bot node.

      --
      i thought once I was found, but it was only a dream.
    11. Re:Long standing bet by DarkOx · · Score: 1

      Traditionally the light weight home routers vulnerable or not have just not been targets. It was easy enough to get control of the much more powerful machine behind it. If you wanted a spam bot a PC is much more useful. If you are an identity theif etc, the PC will have information on it, the route probably not so much. If you are script kiddy and you just want metasploit to grab some screen shots for the lolz then again the PC behind the router was more interesting.

      I am not saying that in an attack control of the router is not an incredibly valuable asset to your operation but it was hardly needed for attacking home PCs and of little value on its own. As these things are getting more powerful with more memory and capable processors, a botnet of home routers might be useful in its own right so I agree its coming. The reason that old d-link, linksys etc is doing its thing is because nobody really cares about it.

      --
      Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
    12. Re:Long standing bet by Gr8Apes · · Score: 1

      I did this a long long time ago. It's true, even rolling your own kernel isn't that hard. But it does add to the noise, heat, and power draw. I would prefer to have a sub 10W silent router over a 180+W noisy one any day of the week. Now, the first thing you do with any router is disable UPnP, especially on ISP provided systems. The next thing you do is use your own router behind the ISP one. Now you're in full control of all in/out traffic and can monitor it if you'd like.

      --
      The cesspool just got a check and balance.
    13. Re:Long standing bet by drinkypoo · · Score: 1

      I used to have a PC which was a router. But now I have a router which is a computer.

      I will probably go back to Wireless-G, and then I'll be able to use tomato again. But at least my current router is Linux-based. For some reason there's no alternate distributions for it, probably mostly because the GPL sources/build environment don't actually work. Thanks, D-Link.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    14. Re:Long standing bet by tlhIngan · · Score: 1

      I have had a long standing bet as to how long it would take for someone to really nail most of the routers out there. It has always puzzled me how something like Linux or Windows can have a vulnerability of the week which is (usually) patched by most users in a flash. Yet there are many very old d-link, linksys, etc routers out there doing their thing without being massively attacked.

      Easy - routers are not monocultures. They vary in price and capabilities from sub-$20 specials to $200+ with fast processors, lots of RAM, USB, etc. etc. etc.

      A vulnerability in one is not necessarily a vulnerability in all, and may only be present in one specific firmware revision. And routers fall out of support very rapidly, so now you've got an attack surface comprised of hundreds of router models, each of which has a handful of different firmware revisions.

      The closest that I have seen to a good widespread attack was when a certain DSL modem would crash when script-kiddies were attacking NT machines and the same attack jammed up that model DSL modem. That wasn't really an attack and it didn't amount to much.

      That's because most of the ISP provided CPE is often of one model running a very specific firmware revision. Which leads to a monoculture and makes it much easier to do a targeted attack (you only attack the ISP's IPs, and can be reasonably confident that the hole exists on practically all of the ISO's CPE).

    15. Re:Long standing bet by fast+turtle · · Score: 1

      If we're lucky, it'll force the rock stupid ISP's to roll out IPv6 world wide. That would fix the god damn problem the fastest and solve the problem if address exhaustion we're already facing. Get all of us home users off IPv4 and onto IPv6 with the damn modems actually supporting multiple IPv6 addresses.

      --
      Mod me up/Mod me down: I wont frown as I've no crown
  7. I saw this coming 5 years ago by Anonymous Coward · · Score: 1

    Let any application open a port to the outside world on your router? Really? and nobody gave a damn about the consequences or even understood its power. Meanwhile I sat back and watched as millions of people enabled it by default on products shipped out worldwide and said nothing because NOBODY CARED they /wanted/ the convenience and turn-key solution that UPnP provided and didn't want to bother learning how to open their own ports manually.

    1. Re:I saw this coming 5 years ago by Anonymous Coward · · Score: 0

      Let any application open a port to the outside world on your router? Really? and nobody gave a damn about the consequences or even understood its power. Meanwhile I sat back and watched as millions of people enabled it by default on products shipped out worldwide and said nothing because NOBODY CARED they /wanted/ the convenience and turn-key solution that UPnP provided and didn't want to bother learning how to open their own ports manually.

      5 years ago?

      Dude, I remember this from 9 years ago.

      Any technology that purports to make a device accessible to every host on a network - UPnP, Bonjour/Zeroconf, what have you - is bound to have at least one remote exploit. And should be disabled by default.

      On a Windows box, I don't use a software firewall to keep an eye on potential malware, I use it to keep a lid on the software I pay for.

    2. Re:I saw this coming 5 years ago by sumdumass · · Score: 2

      Steve Gibson of grc.com had been warning about plug'n play since late 2001 when windows XP was on it's first release. He even offered a service to quickly turn it off and scan for it.

      Of course that was back when MS claimed their software firewall on XP was enough to put your computer directly onto the internet and you could use the XP machine as a router with internet connection sharing actually working easily on it. And if doing so, the average time from fresh install to infected was about 5 minutes or so- Often before you AV could update and detect the infection. I think that rose to about 15 minutes after some updates and I lost track of what it might be now.

      Anyways, the alarms have been going up for about 12 years now. I wasn't aware that routers were implementing it until recently so I'm sure I'm in the problem pile on this.

    3. Re:I saw this coming 5 years ago by bill_mcgonigle · · Score: 1

      Anyways, the alarms have been going up for about 12 years now. I wasn't aware that routers were implementing it until recently so I'm sure I'm in the problem pile on this.

      Not sure if it was exposed in lowend firmwares, but we were turning it off in ddwrt back in '04 (maybe it was still ewrt at that point).

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    4. Re:I saw this coming 5 years ago by Anonymous Coward · · Score: 0

      I've also known that this was a potential source of vulnerabilities for many years now. Ultimately, the presence of UPnP adds very little value to systems, and turning it off doesn't degrade the system as far as I've been unable to tell.

      For my Windows machines, I have a post-setup series of scripts which turn off the two services related to UPnP, and domestic gateway/routers I've turned it off manually for every change in hardware since at least 2004.

    5. Re:I saw this coming 5 years ago by Anonymous Coward · · Score: 0

      OP AC here, 5 years ago I was made aware that everyone and their pet dog/cat/rabbit had UPnP enabled by default by all routers/modems.

      Up until then I knew of its existence and disabled it by default, but wasn't aware that other people were stupid enough to actually use it, 5 years ago I was made aware that enough people are stupid enough to leave it on.

      It was a sort of idiocracy-eye-opener.

    6. Re:I saw this coming 5 years ago by Nerdfest · · Score: 2

      Does anyone know if the latest DD-WRT, OpenWRT, and Tomato releases are vulnerable?

    7. Re:I saw this coming 5 years ago by Anonymous Coward · · Score: 0

      OpenWRT 12.09 (Attitude Adjustment) uses MiniUPnPd v1.6, but only if you choose to install it. v1.6 was released around 18 months ago, and the article says that versions more than 2 years old are vulnerable. So it appears to be safe. In any case, no UPnP daemon is installed by default.

      I don't follow DD-WRT or Tomato... I think they're dead-end projects, personally.

    8. Re:I saw this coming 5 years ago by Anonymous Coward · · Score: 1

      Gosh, BOTH informative and a troll. Hey people, it makes it hard to moderate if you don't put your differing characteristics in separate posts.

  8. V1.0? by hedley · · Score: 1

    How many vendors are going to patch some obsolete hw to get the lib updated? I would be surprised if they can build images for some of those old products. That said, it seems a bit of an uphill crack, you have to know the target CPU, the lib version, and prepare a useful injection rather than just a denial of service. Still, it is interesting that people are still acting as documented on data coming over the wire, sprintfs into buffers with %s was an eye opener to me. These days for web stuff I use the c++ string class, fixed c buffers look weak to me with unvalidated socket input.

    H.

    1. Re:V1.0? by Corwn+of+Amber · · Score: 1

      How many vendors are going to patch some obsolete hw to get the lib updated?

      Zero.

      I would be surprised if they can build images for some of those old products.

      I'm certain that most of them have simply lost or let bitrot the toolchains they need to build those images.

      That said, it seems a bit of an uphill crack, you have to know the target CPU, the lib version, and prepare a useful injection rather than just a denial of service.

      Pack several exploits in the worm.

      Still, it is interesting that people are still acting as documented on data coming over the wire, sprintfs into buffers with %s was an eye opener to me. These days for web stuff I use the c++ string class, fixed c buffers look weak to me with unvalidated socket input.

      H.

      Shovelware kit will always be programmed all wrong and never be updated, be it by their rock-fuck owners or greedy makers.

      --
      Making laws based on opinions that stem up from false informations leads to witch hunts.
    2. Re:V1.0? by Anonymous Coward · · Score: 0

      How many vendors are going to patch some obsolete hw to get the lib updated?

      Zero.

      Nope.

      Toyota is recalling 907,000 vehicles, mostly Corolla models, around the world for faulty air bags and another 385,000 Lexus IS luxury cars for defective wipers.

      Toyota Motor Corp. spokesman Naoto Fuse said Wednesday there have been no accidents or injuries related to either of those defects

      manufactured between December 2001 and May 2004.

      So how old are these "obsolete" routers, and why is a ten year old piece of equipment seen as "obsolete"? My car is an '02, why can I still not only get it serviced, but recalled for design flaws, while Microsoft and Cisco can just tell me to fuck off when a defect is found in their wares?

      Could it be that the do BECAUSE THEY CAN?? The real question is, why do we put up with this nonsesnse? Why aren't we up in arms and demanding product recalls, not just for routers but Windows XP as well?

      -mcgrew (can't log on here)

  9. No surprise here... by Anonymous Coward · · Score: 0

    This is what you should expect when you design a protocol as unnecessarily complex and as undocumented as UPnP.

    A friend and I were thinking of using UPnP to help people run servers for a game we're working on, but documentation for the protocol is seemingly non-existant, and from what we can tell, it's quite complex as well, requiring a lot of parsing of plain text (XML is more bug-prone than binary data in that respect) and using protocols that are clearly bad ideas (like HTTP over UDP, rather than doing something sane like creating a UPnP protocol by just sending packets with the necessary information in them rather than wrapping it all up in a bunch of XML and HTTP and then some bastardized form of HTTP at that).

    We found libupnp, and thought about using it, but even it's quite complex for the given task. All we want to do is tell the fucking router that we'd like an open port. Why should that be so difficult? Quite honestly, the router only needs 16 bits of data from us to fullfill the request, but for some reason they've taken something so simple and wrapped it in layers of bullshit. That sort of thing just begs for vulnerabilities to be present everywhere, since rather than spend time reviewing code and verifying that it works correctly, developers instead spend all their time just getting things to work at all.

    1. Re:No surprise here... by ledow · · Score: 1

      And you've just given me one more reason to think that my policy of "turn it off" (since it was first put into a consumer OS) was correct.

      "All we want to do is tell the fucking router that we'd like an open port. Why should that be so difficult?"

      Because it's MY DAMN COMPUTER and network, that's why. And you have no need to open my ports. You can talk outwards, no problem at all, to any destination that will accept a connection. And most home routers will NOT accept a connection (you have to think of people who DON'T have UPnP enabled or compatible hardware too, or have software firewalls in the way as well, etc.). Why do I need to let traffic through other than what your servers have sanitised and handled for me?

      The number of actual applications for UPnP is vanishingly small, and all solved by just running an intermediary server to handle connections which requires next-to-nothing in terms of resources (literally, a £10/month VPS would be overkill just for that, and most people that would need it have something like a website anyway that could run off the same machine).

      And the simple examples of Skype/Steam show that there's NO NEED TO, whether joining gameservers or providing streaming video from both ends simultaneously, unless I'm deliberately setting up a network service that NEEDS to be accessible to the world. And if I can't figure out a port-forward interface on a router for that, maybe I shouldn't be doing it.

      Opening a port really is old-hat, and not something that's worked reliably on any random machine/network for decades (You'll notice that things like TeamViewer etc. just run a local client and talk out to a accessible server, faffing with port-forwards just isn't worth the hassle). And there's no need to do it. And UPnP is a just way for it to happen automatically (whether it works or not is another matter) without any user say-so in it. If that isn't enough to scare you off having used it for the past decade, maybe you need to run a network or two and see what it means in real terms of impact upon what you need to do.

      If your application NEEDS to open ports, run an intermediary server which is publicly accessible, secured, and only exposes that port necessary. If you haven't got the resources / brains to do that, I don't want you opening ports into my networks and personal computers anyway.

    2. Re:No surprise here... by Anonymous Coward · · Score: 0

      Wow, Linus was right, masturbating monkeys indeed. It's nice that you take the previous post all out of context and then use it to talk down to them and to belittle them. Nice in that it may have given you some validation and made you feel righteous and fulfilled. You know when you do that it's like a great psychological cry for help that the rest of us can read, don't you?

    3. Re:No surprise here... by pnutjam · · Score: 1

      Friends don't let friends allow app guys to mess with network/security.

      --
      Cheap storage VM.
  10. find the posts by r00t · · Score: 3, Interesting

    Just yesterday, lots of Slashdot readers claimed UPnP was totally reasonable for security. It's time for a wall of shame. Here is the story:

    http://it.slashdot.org/story/13/01/29/0111238/58000-security-camera-systems-critically-vulnerable-to-attackers

    I'll start.

    adolf: http://it.slashdot.org/comments.pl?sid=3415287&cid=42722879
    Miamicanes: http://it.slashdot.org/comments.pl?sid=3415287&cid=42723217
    julesh: http://it.slashdot.org/comments.pl?sid=3415287&cid=42723393

    1. Re: find the posts by Anonymous Coward · · Score: 0

      The article talks about vanurabilities in the implementation. How does this make the protocol bad?

    2. Re:find the posts by Anonymous Coward · · Score: 1

      Maybe you should start with the link to your comment where you claimed it was not (and specifically because of bad implementation, instead of just being an unauthenticated protocol). Otherwise you don't have the told-you-so right, and your comment is nothing but a flamebait.

    3. Re:find the posts by Anonymous Coward · · Score: 0

      NAT is NOT a firewall. If bypassing it hurts your security, you're doing something horribly wrong.

    4. Re:find the posts by KingMotley · · Score: 1

      And... They are still right. Particularly adolf's analysis is pretty much spot on. I didn't bother to read the rest.

      If you are scared that you might get some malware on a device located behind your router, you've already lost the game. The malware could have already grabbed all your important stuff and posted it to an overseas website. Do you also have key locks on the INSIDE of the doors that lead out of your house? I mean what if a burglar snuck into your house somehow, now they would be able to unlock the door to allow "anyone" inside. Pretty much the same thing.

      That said, I'm sure there are bad implementations of UPnP out there. Stuff they shouldn't let happen, like letting device A open ports to device B. Obviously that's a major flaw in the implementation because then any compromised device could intentionally expose any other device directly to the internet, but even that is paranoia, as the malware could just set up a tunnel to that device from the internet through an outbound connection that it started.

      The additional security afforded by turning off UPnP in any decent implementation of it affords you very little security, and almost anything that could happen via the exploit could also happen with out it using a different malware implementation.

      If you see something wrong with the logic in this, I'd sure like to hear it, but please, if you aren't a networking expert and especially if you don't understand security, please don't bother replying. I'm not interested in teaching people how networking works, nor do I want to dumb down the networking analogies into car speak for the mechanic who has a computer friend who told him otherwise.

  11. Brilliant by design by Anonymous Coward · · Score: 1

    Rapid7 provide a testing tool. It requires Java. So to find one vulnerability, you have to install another.

    1. Re:Brilliant by design by Anonymous Coward · · Score: 0

      Strange, my system has a patched version of Java.

    2. Re:Brilliant by design by rvw · · Score: 2, Insightful

      Rapid7 provide a testing tool. It requires Java. So to find one vulnerability, you have to install another.

      So don't install the Java plugin in your browser and quit bullshitting.

    3. Re:Brilliant by design by Anonymous Coward · · Score: 0

      Sounds like a butthurt java developer living in denial about his favourite technology circling the drain.

    4. Re:Brilliant by design by Anonymous Coward · · Score: 0

      So don't install the Java plugin in your browser and quit bullshitting.

      Because for most of the JRE's life it was impossible to install java without installing the java plugin into the web browser.

    5. Re:Brilliant by design by Anonymous Coward · · Score: 0

      I'm curious, how do you 14 year olds find this site? It's not like... reddit hip or anything.

    6. Re:Brilliant by design by Anonymous Coward · · Score: 0

      Aren't "native" Java applications given way more permissions than the browser plugin?

      So isn't that a worse vulnerability?

    7. Re:Brilliant by design by gl4ss · · Score: 1

      Aren't "native" Java applications given way more permissions than the browser plugin?

      So isn't that a worse vulnerability?

      native apps have native permissions, SO WTF MAN?

      --
      world was created 5 seconds before this post as it is.
  12. FYI If you have Verizon FiOS... by eksith · · Score: 4, Informative

    ...Like I do, you may find the router's UPnP page mysteriously missing from the "Advanced" section of your admin panel. This is a brilliant move on their part to avoid users breaking their skype/game access and then calling tech support.

    But the page itself is still there. Only the link was removed. To get to it, visit : http://192.168.1.1/index.cgi?active%5fpage=900

    Suck it, Verizon!

    --
    If computers were people, I'd be a misanthrope.
    1. Re:FYI If you have Verizon FiOS... by eksith · · Score: 1

      Forgot to add, my router model is MI424WR-GEN3I

      --
      If computers were people, I'd be a misanthrope.
    2. Re:FYI If you have Verizon FiOS... by rvw · · Score: 4, Funny

      ...Like I do, you may find the router's UPnP page mysteriously missing from the "Advanced" section of your admin panel. This is a brilliant move on their part to avoid users breaking their skype/game access and then calling tech support.

      But the page itself is still there. Only the link was removed. To get to it, visit : http://192.168.1.1/index.cgi?active%5fpage=900

      Suck it, Verizon!

      Forgot to add, my router model is MI424WR-GEN3I

      Hey I just tried to login to your browser, but it seems to be a Linksys Router, and that link didn't work, got a 404 back. So please - for the next time - make sure what your talking about!

    3. Re:FYI If you have Verizon FiOS... by Anonymous Coward · · Score: 0

      Disclaimer:
      Readers might get varying results, when trying to log in to 192.168.1.1.

      There, fixed that for you.

    4. Re:FYI If you have Verizon FiOS... by Anonymous Coward · · Score: 0

      of cos u get 404! i got their frist and hacked dat n00b asshoConnection reset by peer

    5. Re:FYI If you have Verizon FiOS... by eksith · · Score: 1

      Not sure if this is trolling or genuine. But just in case it's genuine, please visit YouTube and browse for cat videos. Watch about 4 hours worth and then read this

      --
      If computers were people, I'd be a misanthrope.
    6. Re:FYI If you have Verizon FiOS... by hughperkins · · Score: 1

      Whooshy-whoosh! I've always wanted to do that :-D

    7. Re:FYI If you have Verizon FiOS... by Zaiff+Urgulbunger · · Score: 1

      Skype works for me without UPnP being enabled. I also play the odd online game and haven't noticed any issues.

    8. Re:FYI If you have Verizon FiOS... by KingMotley · · Score: 1

      You don't notice it on skype much, but in the case that both the sender and receiver are both behind non-UPnP NAT routers, then your entire conversation gets sent to a node somewhere on the network. That node could be Mr Joe badguy who likes to listen in to people's skype calls (Not hard to do). I know sending files didn't used to work at all, but they might have fixed that in the past couple of years, I really didn't keep up on the changes skype made. In any case, not only does it send packets to a 3rd party that could be intercepted easily (transparently), but it also adds latency to the call that isn't necessary.

      Contrast this to if both of you are either on an un-NATed machine, or are running UPnP on the NATing device, then your packets are sent directly to the end user (hopping across the normal routers between you -- so the packets may still interceptable, but much harder to do and isn't likely to happen on any large scale).

      If one of you is NATed (with no UPnP), but the other isn't then one part of the transmission may go through a 3rd party, or if using TCP, it's possible to use the connection back channel to route the packets directly. UDP can cause cause additional problems as it's a connection-less protocol and many/some routers may not allow receiving UDP at all (no back channel) if your are NATed without UPnP, which again adds latency.

      Also in addition to routing through a 3rd party, your connection bandwidth is then limited by the 3rd parties bandwidth as well as your own. Slower file transfers, switching to a lower quality codec, garbled/freezing video, etc etc. In many cases the 3rd party may actually be one of Microsoft's servers since they run supernodes to try and handle some of the required bandwidth if possible.

  13. Lol shovelware by Corwn+of+Amber · · Score: 2

    Yes, shovelware applies to hardware too. Hardware like home routers, which are NEVER EVER updated - be it by their rock-dumb owners or their irresponsible manufacturers.

    And then this happens. All the time forever, until the greedy fucks who make those never-updated shit get slapped with fines for gazillions, and THEN the surviving ones would begin to think of SUPPORTING the crap they sell, instead of shoveling poorly-differentiated models that only exist to make the non-castrated one more expensive than it has any sort of right to be. But then market segmentation is worth so much more than supporting the products you sold! Why would they sell at what the product is worth (i.e. marginal production cost) when they can pretend to turn more profit by selling half-products at full price so that the complete product costs three times what it should? And when making several models by chopping out necessary things from the reference one, it gets much more complicated to support all the kinds of half-products, instead of making one that works well and is supported for long.

    Also, the only company that does Just That - good productsat some price point, but no range of half-products headed by one real model (that all the shit ones are based on, minus vital features) happens to be the most profitable company in the world. Just sayin'.

    --
    Making laws based on opinions that stem up from false informations leads to witch hunts.
    1. Re: Lol shovelware by Anonymous Coward · · Score: 0

      Quite interesting that everybody here understands that there are million of small router device owners out ther that can hardly operate a windows machine let alone flash and update their router. Yet when a company decides to set their router's automatic update(remember the linksys case?)on by default we flame them to death...

  14. 2001 just called.... by SwampChicken · · Score: 1

    http://www.grc.com/unpnp/unpnp.htm

    1. Re:2001 just called.... by Anonymous Coward · · Score: 0

      ...did you warn them?

    2. Re:2001 just called.... by Anonymous Coward · · Score: 0

      That's PNP not UPNP and very different.

    3. Re:2001 just called.... by Anonymous Coward · · Score: 0

      wrong wrong wrong WRONG WRONG WRONG wrong wrong

    4. Re:2001 just called.... by Anonymous Coward · · Score: 0

      So you're saying that's wrong?

  15. Who to blame? by Anonymous Coward · · Score: 0

    I blame the banking industry for colluding to set LIBOR.

  16. all your 23 million bases by Anonymous Coward · · Score: 0

    are potentially belonging to someone? are we talkin root level type executions?

  17. if this is legal by Anonymous Coward · · Score: 0

    then 'anonymous' is doing it all wrong.

    when they hack a site, they just need to put a little notice on it.

    "your site is vulnerable. we are researchers, not hackers. this has been an public service of anonymous."

    captcha: sesame

  18. We were warned by Mike+Frett · · Score: 1

    Microsoft was one of the founders of the UPnP Forum, Apple isn't a member. Not to mention that Microsoft pushed this API very hard. We were warned of the vulnerability of this protocol back in 2001. There was a big deal with Windows ME and XP about disabling this service also, It was Microsoft whom ignored all the vulnerabilities at first, if they scared OEMs then the OEMs wouldn't implement this protocol.

    This is yet another example of why Microsoft has too much power and shouldn't be dictating what's in my hardware. How long until Secure Boot gets this same treatment of access to your system?.

  19. Attack surface is still smaller by Dr.+Evil · · Score: 1

    Remote buffer overflow in what? the Linux Kernel? IPTables?

    There are some crappy routers which expose remote administration tools by default, but those are the exception. Most old home routers only flaw is to enable Universal PnP out of box and not to encrypt wireless.

    1. Re:Attack surface is still smaller by Jeng · · Score: 1

      Actually I doubt a technical attack is necessary to hinder the security considering how many people just keep the default passwords for their routers.

      --
      Don't know something? Look it up. Still don't know? Then ask.
    2. Re:Attack surface is still smaller by Dr.+Evil · · Score: 1

      No home router I've ever seen has allowed login on the Internet exposed interface.

      Wifi yes though. Very much yes, and very vulnerable.

    3. Re:Attack surface is still smaller by Dr.+Evil · · Score: 1

      "No home router I've ever seen has allowed login on the Internet exposed interface. "

      By default I mean.

    4. Re:Attack surface is still smaller by Jeng · · Score: 1

      Yes, good point, that would only be useful for attacks that come from the users computer.

      --
      Don't know something? Look it up. Still don't know? Then ask.
  20. Level7 is a Phishing vulnerability by gishzida · · Score: 1

    I followed the link to the article... then the link to the PDF follow the link to their "Vulnerablity Detector"... Start to install... Read the Legalese... The terms are suspicious... Click OK tpo continue... The next screen asks for personal information. Red Lights and Alarms go off. Anytime a "security vendor" lists contract terms like those and then wants my name and address when I did not want or ask to contract a service. I killed the installer.

    Level7 is not preventing a problem --- it is the problem. If you installed their client you have just been pwned...

  21. 2 preventative fixes (1 for Windows users)... apk by Anonymous Coward · · Score: 0

    1.) IF you use a router (NAT stateful packet inspecting type hopefully)? Examine its settings for UPnP - & disable it!

    (E.G./I.E.-> LinkSys/Cisco models DO offer this (I have that in my wired BEFSX41 unit here))

    2.) Per my subject-line - for Windows users, specifically: Disable Windows' "UPnP Device Host" service (Run services.msc & right-click on that service name, setting it to disabled)

    (Assuming you DON'T need its services, that is... & if you do? That's a risk you're taking until this is fixed!)

    ---

    * VOILA: Problem solved, & rather easily...

    APK

    P.S.-> And, there you go...

    ... apk

  22. Me not understand by jones_supa · · Score: 1

    Why is the uPnP service facing Internet anyway? Shouldn't it be accessible only from LAN?

    1. Re:Me not understand by LunaticTippy · · Score: 1

      You are correct, it shouldn't be exposed to the WAN. Doing so is an implementation flaw, and this flaw is widespread. uPnP has other problems, but this particular one is truly awful.

      --
      Man, you really need that seminar!
  23. Sweet! by Anonymous Coward · · Score: 0

    I was shocked that I had to, repeatedly, argue about the insecurity of the entire UPnP concept with supposedly technical people on Slashdot. This article and your post is a sweet stab to the face of those morons.

    UPnP is a ludicrous concept intended to facilitate the installation of network devices by complete neophytes. It is a marketing tool, not a networking or security tool. Even without this "new" vulnerability UPnP is a disaster that should always be disabled.

    Having UPnP turned on is the equivalent of turning off your firewall. Arguments in favor of UPnP are proof of not having a clue.

  24. Additionally: I covered this 5++ yrs. ago... apk by Anonymous Coward · · Score: 0

    Per my subject-line above - In my security guides for Windows users -> http://www.pcreview.co.uk/forums/secure-windows-2000-xp-server-2003-and-even-vista-make-fun-do-t3511888p2.html (search UPnP on that page, it covers that which I posted in my reply I just replied to now, "for posterities' sake"...)

    * :)

    APK

    P.S.=> "Onwards & UPWARDS"...

    ... apk

  25. "Great minds think alike"... apk by Anonymous Coward · · Score: 0

    Except I have documented PROOF of it, from 5++ yrs. ago here -> http://tech.slashdot.org/comments.pl?sid=3418595&cid=42736725 & since late 2007 in fact!

    * See subject-line though, in any event... lol!

    APK

    P.S.=> "Onwards & UPWARDS"... apk

  26. I've had a long-standing FIX since 2007... apk by Anonymous Coward · · Score: 0

    http://tech.slashdot.org/comments.pl?sid=3418595&cid=42736557

    * :)

    ( I cover it in 2 ways there, & have BEEN covering it since late 2007, per security guides for Windows users -> http://tech.slashdot.org/comments.pl?sid=3418595&cid=42736725 I wrote up back then - that still do a good job, even today, even vs. THIS vulnerability... )

    APK

    P.S.=> "Onwards & UPWARDS"...

    ... apk

  27. Automatic Updates by Anonymous Coward · · Score: 0

    Quite interesting that everybody here understands that there are million of small router device owners out ther that can hardly operate a windows machine let alone flash and update their router. Yet when a company decides to set their router's automatic update(remember the linksys case?)on by default we flame them to death...

    I'm pretty sure that if Cisco had rolled out a patched firmware that didn't change the features, functionality or configuration on the router that most people would have been quite OK with it, maybe even happy.

    But, Cisco rolled out a whole new feature set firmware that removed control from the end user, moved their configs to the coud, forced them to create cloud accounts to regain any access to their own routers, started collecting user usage data for advertisers or what-have-you.

    In scenario one, bugs are automatically fixed. In scenario two the router is hijacked and its functionality significantly altered without notification. That's a huge difference.

  28. I've been proving 'em wrong since 2007 then... apk by Anonymous Coward · · Score: 0

    See here -> http://tech.slashdot.org/comments.pl?sid=3418595&cid=42736725

    * :)

    APK

    P.S.=> Additionally, in 2 discrete ways (hardware, in router settings - AND software level by services, for Windows users @ least (the predominant type online no less)) -> http://tech.slashdot.org/comments.pl?sid=3418595&cid=42736557

    ... apk

  29. Bridge your FIOS modem... apk by Anonymous Coward · · Score: 1

    Set it into "bridged" mode, & get a GOOD NAT stateful packet inspecting router!

    (E.G./I.E.-> For example, my LinkSys/CISCO BEFSX41 for example, can do this - most, CAN!).

    Why?

    It works, since it sets THEIR FIOS (or DSL) modem into "dummy terminal mode", & then allows YOUR router to take overcontrol duties instead!

    (Which, odds are, since your firewalling router has more features for security, odds are, including UPnP control, "hardware-side" - then, you can also do this OS-side too, in Windows as well for more "layered-security"/"derfense-in-depth" -> http://tech.slashdot.org/comments.pl?sid=3418595&cid=42736557 by disabling the service for UPnP too...)

    * :)

    I cover the software-side, for a GOOD reason too - routers can & DO get "compromised" in OTHER WAYS besides this issue is why...

    (Hence, my coverage of OS side too, as that "layered-security"/"defense-in-depth" as well!

    APK

    P.S.=> Been covering this since late 2007 in security guides I wrote up -> http://tech.slashdot.org/comments.pl?sid=3418595&cid=42736725

    ... apk

  30. Tomato Firmware v1.28 not vulnerable by Nimey · · Score: 1

    I've got an old Linksys WRT54GL running the latest Tomato Firmware (v1.28; development seems to have stopped), which has MiniUPNP v1.4 providing Universal PnP services. Version 1.4 is not vulnerable to the exploits listed in the whitepaper (1.0 is), so it's probably safe to keep it turned on.

    --
    Hail Eris, full of mischief...

    E pluribus sanguinem
    1. Re:Tomato Firmware v1.28 not vulnerable by Philotomy · · Score: 1

      FWIW, Tomato 1.26 and 1.27 also use miniupnp v. 1.4

  31. Suddenly old UPnP problem is hot - Media Servers? by FlameWise · · Score: 1

    I did actually install that Gibson thing to disable my UPnP in 2001 because I didn't see a use for accessing my Plug-and-Play hardware over the net - the very concept of plugging something into one machine and accessing it from another as if it had been plugged in there felt far too much like a security problem to me.

    Seems these days this is just becoming a hot topic again because Media Servers seem to use UPnP for streaming music and movies to your TV, or speakers, or smartphone, or tablet - yes, right across the Internet.

    And some WLAN routers now tout their built-in Media Server as a feature, and of course you want to allow access to them from the Internet because of smartphone tunes... ...and all apparently without proper security, or at least I was never prompted for login details.

  32. Router/NAT for Security? by PPH · · Score: 1

    You fool! Anyone who depends on their router for security is an idiot. You assumed that your brand new laptop would be safe when connecting to your home LAN, behind that router? What were you planning on doing when you took it to Starbucks and used their WiFi?

    Security need to be built into each device in the form of a software firewall. Unneeded ports need to be closed, whether you are on a LAN or not. Once this is taken care of, you can assume that your home/office LAN is as hostile as the Internet at large. Which isn't a bad policy, seeing as how many idiots bring infected laptops or free USB drives in to work all the time.

    --
    Have gnu, will travel.
    1. Re:Router/NAT for Security? by Anonymous Coward · · Score: 0

      Know of a working software firewall with even half the granularity of iptables on Windows?

    2. Re:Router/NAT for Security? by PPH · · Score: 1

      Nope. I don't do Windows. But this is something the Microsoft crowd should have been working on. Instead of the Metro UI.

      --
      Have gnu, will travel.
  33. This is a problem of libupnp old versions not UPNP by Anonymous Coward · · Score: 0

    Most of the media reports are irresponsible. The flaw reported by US-CERT and Rapid7 are to a coding error in libupnp, an open source library for the UPNP standard. Old versions of that code (like many more I suspect) have buffer overflow errors. This has nothing to do with the UPNP standard or UPNP in general. It is unfortunate that router manufacturers have not implemented the newer versions of UPNP IGD:2 and DeviceProtection:1.

    Ultimately there are lots of users that don't update their firmware and so are exposed to numerous threats without knowing it.

  34. Just checked the net facing router and wan router by Anonymous Coward · · Score: 0

    I just check the internet facing modem (a Chinese Zyxel-1432 based thingamabob) and the DNS-server/router that it connects to for my internal network (my trusty old WRT-54GL). Neither of these have UPnP enabled. Hopefully when it says 'disabled' it really is 'disabled'. I likely have UPnP enabled within ubuntu. I looked at metasploit's software, but when they stared with installer questions like 'when was your last dental checkup', 'what is the name, address, and phone number of your dentist so we can confirm your last checkup', 'how much money do you have in your bank' and 'what is the personal identification number (pin) number of your bank so we can confirm your account balance' along with 'what is your recent (20 years max) sexual history (include drunken parties)', I got annoyed and deleted all the metasploit stuff. Their software is not signed (at least with md5sum) either. I don't trust it.

  35. identity theft : another route for prosecution? by girlinatrainingbra · · Score: 1

    ah, if only there were a way to mark spammer-trolls and slowly-deactivate their accounts without inviting a way for other types of trolls to abuse that capacity to mark down people whom they do not like. The scary / scarier part is that they picked a "name" Diane Kua that is actually a name of "1 real person in the USA" when you search for them. That identity theft is probably part of this spam-troll technique, but their blatant use of a real person's identity may be the leverage against them because it might actually be unlawful and illegal to impersonate an actual person that way: using identity theft.

  36. Why do braindead apps/games need open ports by knorthern+knight · · Score: 1

    Why?!? UPNP should only be necessary for running servers. If you want to host a game server or ftp server or web server, port-forward the appropriate port(s) on your NATing router. Hopefully, you have some basic understanding of the security implications.

    What I don't understand is how UPNP got accepted as a protocol. Why are some apps so braindead that clients need UPNP? TFA mentions "smart TVs, IP cameras, printers, media servers and routers to name a few". An ordinary PC can subscribe to Netflix without UPNP. Why does a "smart TV" need to be "discoverable" from outside? Why The F*** would I (or 99% of users) want to have my router/TV/printer/etc "discoverable" from the outside?

    Bittorrent is both client and server. A user who doesn't have a clue about securely running a server has no business running bittorrent.

    --

    I'm not repeating myself
    I'm an X window user; I'm an ex-Windows user
    1. Re:Why do braindead apps/games need open ports by hairyfeet · · Score: 1

      Because a LOT of that shit won't work unless its got two way communications? yeah i know its fucking stupid, but YOU try setting up Internet TVs or STBs or the like and find out how quickly that shit falls down and goes boom if you don't have UPNP, games won't work, devices won't get updated lists for like TV listings, nothing will work if they don't have UPNP allowing 2 way communications.

      Again I agree completely that its fucking stupid but you are talking about billions of dollars in devices you are gonna have to shitcan or pay some guy like me a couple hundred bucks to do a service call to set up every. single. time. because without UPNP many of these damned things will just refuse to do shit. Sadly the only other way I can think of without shitcanning billions of dollars worth of stuff is just dump them on a DMZ and let them be one big giant fucking botnet because without full 2 way communications most of that shit just won't work, so its either leave it on a DMZ or allow UPNP.

      Believe me, I've looked into alternatives, there isn't one. Once UPNP was invented all progress just halted and now every device expects UPNP off the bat and won't do shit without it.

      --
      ACs don't waste your time replying, your posts are never seen by me.
  37. How does that address the problem? by knorthern+knight · · Score: 1

    > If we're lucky, it'll force the rock stupid ISP's to roll out IPv6 world wide. That
    > would fix the god damn problem the fastest and solve the problem if address
    > exhaustion we're already facing. Get all of us home users off IPv4 and onto
    > IPv6 with the damn modems actually supporting multiple IPv6 addresses.

    How does that address the problem? What makes you think that brand new barely-tested IPV6 firmware would be any more secure than older patched IPV4 firmware?

    --

    I'm not repeating myself
    I'm an X window user; I'm an ex-Windows user
  38. GRC by Anonymous Coward · · Score: 1

    Upnp was spotted as an issue years ago by Gibson research Corp more than 10 years ago. He even made tools to test for it. www.grc.com