UPnP exploit

[jussi]

I'm sure the more knowledgeable experts on the site can expound on this more, but basically last month a group of researchers found many routers with Universal plug and play (UPnP) turned on are allowing hackers to remotely access your router. They can then turn off your firewall and basically gain access to your network. The researches found 80 million public IP addresses responded to UPnP requests. Here's an article explaining it much better. If you google it, you will find several stories about it. Although I haven't seen much coverage in mainstream news orgs. I went to site below and verified my router did not respond to the probe. He's a security expert and does a weekly podcast with Leo Laporte.

How Attackers Can And Will Exploit UPnP Flaws

grc.com/shiledsup

[gsmittle]

My router just uses 1/2" and 1/4" bits.

g.

[dbhost]

First off, we are talking computer network routers, not wood routers,

secondly UpNP has been a well known attack vector for years. Router MFGs are still turning it on by default because certain services, particularly DNLA which is used for streaming media / smart TVs type stuff, requires it. Basically speaking if your router is equipped with a USB port, you can bet by about 99% accuracy that it has UpNP turned on by default, and is vulnerable. Not having a USB port does NOT mean you are safe though.

Your best bet is to google your make and model router, with the string UpNP vulnerability. For example I have a Linksys E4200, so in the Google search I would search for "Linksys E4200 UpNP vulnerability".

Advanced / Expert users should look into compatibility of their routers with the DD-WRT firmware which is much more secure, and configurable than stock firmware, but doesn't cover all routers...

[Stytooner]

I use a Cisco Valet plus.
It is pretty good. It can network to machines in both shops. It didn't answer the query in that link.

[dbhost]

Lee,

I am not 100% certain, but I think those older Cisco Home routers have the same firmware as the Linksys. Take a look at the Cisco website in regards to verifying / enabling / disabling UPNP...

http://homekb.cisco.com/Cisco2/ukp.a...pid=96&slnid=3

[Stytooner]

Thanks, David.
I was able to turn it off. That should do it.

[dbhost]

Not sure if your router has WPS (Wireless Protected Setup), but if it does, turn that off too...

[cwsmith]

I wish I were more "up" on this technology, but I'm afraid I have to rank this in with all the other computer stuff I simply can't keep up with. Funny, because for well over a decade I was sort of the "go to" guy for almost everything dealing with computers. Now, I'm about as "dumb as a chicken" I think.

I have a Netgear router here, that seems to work okay, though on occasion I have difficulty with making a connection. The router and cable moden are up on the second floor in the library and I keep this laptop down here in the basement shop.

I do have it set up with a password and IIRC, the Upnp feature is secured. It comes up as a "secure network" and I have to use a password to have any other device access it.

At those times when I don't seem to make an automatic connection or at least a full-service one, I usually have to have my laptop disconnect and then re-connect "to available networks"... and that list shows three other networks (all secure) in my neighborhood).

One of the things that troubles me though is that I have noticed times when my computer is shutdown and I'm up in the library and I'll notice the activity light flickering, like it is being accessed or that someone is trying to access it. I've never been given a definitive answer from Netgear as to whether that "flickering" light is actually what I think it is though, and my son (who is much better versed on these things [I would think] doesn't seem to know either!

Personally, I think I'm way more security conscience than he is though, as he keeps his router and computers constantly on! And, he uses one of those software programs that will auto fill in most any form that he is presented with.

I always turn my computer off when I'm not at the keyboard; and because I don't have a good feeling about that busy indicator, I've taken to switching off the Netgear router too. Not that anyone could get at my "shutdown" computer, but I don't want the accessing the internet through my router or having the experimental time to gain access to my router and then access my computer when I do have it on.

If anyone has any opinions about that, they are most welcome.

The other thing is this "auto" fill-in-the-blanks software that some people use. I guess I look at it from the perspective that if you keep this data all in one file structure (like the software would use), then all one would have to do is buy such software and do a little investigation to discover it's location and coding... once done, you'd know where to look on anyone's computer that might be signalling it's access.

CWS

[mpc]

UPnP is one of those "automatic configuration" mechanisms that make it easy for non-Techies to plug stuff together. Like almost any such mechanism it is based on a industry-wide agreement of protocols, pre-defined IP ports, pre-defined access codes, etc. Once any of those get "in the wild" the hackers make tools to rapidly scan pretty much every IP address they can access looking for vulnerabilities. Devices supporting UPnP are supposed to be on the private side of a router and its firewall, not on the "Internet" or WAN side. Some routers though, either with buggy software or improperly configured user menu settings, will "pass through" the IP ports used by UPnP from the WAN side to the local Intranet side. That leaves UPnP wide open.

Many routers use a similar "automatic configuration" mechanism called "Wi-Fi Protected Setup" aka "WPS" to configure the wireless connections. Users turn this ON when first installing the router and setting up laptops, iPads, etc. to connect to it... and then turn it OFF. In theory that keeps other devices from connecting unless they already know the encryption key. Guess what... not all routers actually turn OFF the WPS function even when the menu setting is OFF! Firmware updates or switching to a different router are the only cure for such bugs.

mpc

[dbhost]

You are correct that UpNP should NOT be used on the public WAN side of a router, but some vendors (Asus for one, and Cisco / Linksys for another) that use the newer "Cloud enabled" features in their routers pass through UpNP requests for their cloud adminstration stuff. It is a stupid design decision based on making things pretty looking and easy for consumers (which is good) at the expense of making things way too easy for crackers (which is bad).