Most Home Routers Vulnerable to Flash UPnP Attack 253
An Anonymous reader noted that some folks at GNU Citizen have been researching
UPNP Vulnerabilities in home routers, and have produced a flash swf file capable of opening open ports into your network simply by visiting an unfortunate URL. Looks like Firefox & Safari users are safe for now.
Nothing new, really (Score:4, Interesting)
It all hinges on going to a malicious web site. Just like email trojans, if you resist temptaion and use some common sense, do you really have to worry about this?
Re:Nothing new, really (Score:5, Informative)
And some sites may become malicious suddenly because of all those syndicated ads around.
Re: (Score:2, Informative)
Re:Nothing new, really (Score:5, Insightful)
All it takes is to get your nastyness in a bunch of Ad rotations from doubleclick and other scumbag webad companies and you can hose a huge swath of the net.
Re: (Score:3, Insightful)
99.9% of the shiit that gets blocked by these programs I don't need/want/miss anyway.
Re:Nothing new, really (Score:5, Insightful)
No infections either.
It looks like your doing everything except the simplest solution.
Oh and yes I use UPNP.
Re:Nothing new, really (Score:4, Insightful)
Re: (Score:3, Funny)
Isn't that redundant? The GP already stated,
Re: (Score:2)
Re: (Score:3, Insightful)
Re:Nothing new, really (Score:5, Informative)
I'm not really surprised to be honest - I always thought UPnP looked fishy to me so I disabled it on my router. I don't like the idea that anyone coming to visit can plug in their malware-ridden Windows laptop and reconfigure my router. Sure, having it turned off means X-Box Live is less happy but that only decreases the number of people who can call me "fag" on a daily basis. I wonder if Microsoft will update the X-Box Live support page where they say that UPnP doesn't make your network insecure...
I also have Flash disabled by default because it is well known to be insecure and buggy and a delivery system for malware. Most proper web-browsers either let you enable flash on a per-site basis or will allow you to do so with a plug-in and this is really the way to go.
Re: (Score:2, Insightful)
Re:Nothing new, really (Score:4, Interesting)
Re:Nothing new, really (Score:5, Insightful)
Why, look no further than the MyMiniCity/Goatse/2girls1cup links being posted here in every thread! At least one person clicks and ends up warning others. (Either by downmodding or posting.) Why, you just need someone who's curious enough to click.
On the other hand, it requires a bit of work to get someone familiar with malware to click on a 'you just won' banner and download the mystery prize. Don't even get me started on random email attachments following nonsense messages.
Turn off UPNP (Score:5, Insightful)
A. Unbox
B. Throw away the disk
C. Plug in your machine, Turn on the router and navigate to the webgui
D. Turn off UPNP
E. ??? (Change default name and password, set WPA, Turn off SSID etc....)
F. Profit...
The point is, I'd always been told to turn off UPNP 'cos sooner or later something is going to open ports that you don't know about.
Re: (Score:3, Insightful)
I'm okay with all of that. The only thing I never get is why to turn off the SSID broadcast. If it's well secured, it doesn't matter if they know it's there or not. Besides, I'm pretty sure that just listening to traffic will reveal the presence of a wireless network.
Re: (Score:3, Insightful)
Anyone who can break into your wifi can probably find your SSID if broadcast is disabled, all you need to do is wait and listen.
Re:Turn off UPNP (Score:4, Funny)
Re: (Score:3, Insightful)
Er, you 'don't get' the whole 'change default password crap'? Even though you 'usually' look up the password on a 'list of manufacturer default'?
Want to run that by us again? :-)
Re:Turn off UPNP (Score:4, Insightful)
WHERE $money; PUT $mouth (Score:4, Interesting)
I live in Cincinnati, Ohio. You come (wirelessly) break into my router, change the current settings by opening port 1337, and I'll refund the cost of your travel (as determined by hotwire or expedia's fare rates on the day of your travel), and pay you $100 additional, all in cash on the same day.
It's a SOHO router, but I won't tell you what make/model -- if your prowess is as you claim, you should have no trouble determining that. You may not enter the apartment or inspect any systems currently connected -- but you shouldn't need to. I have no other firewalls, proxy servers, or tricks on the front end of this router -- it's straight from modem to unit. You may have 48 consecutive hours to complete the task.
Still confident? Email me at radams theatsign tohuw.net and make arrangements.
Re:WHERE $money; PUT $mouth (Score:4, Funny)
Yeah, that'll work.
Re:WHERE $money; PUT $mouth (Score:4, Interesting)
Re:Turn off UPNP (Score:5, Informative)
Hidden SSID: One commonly expressed theory behind hiding a SSID is similar to why you lock your car. If your car is locked, it's a less attractive target than one which isn't. Hiding your SSID does make a network a less obvious target than one which is visible. It doesn't impede any serious search for networks by someone knowledgeable, but it will remain hidden to casual view. Is this vaguely inconvenient? Possibly, but then, really, so are locks. Really, I've never been so fond of that analogy.
If you like, I think a better analogy might actually be that hiding your SSID is like planting a bush in your front yard that obscures a direct view of your front door. It doesn't really make your door any more secure, in and of itself, but it might make it less obvious that there's a door there to begin with. Someone simply walking by might not notice it, but someone sitting in their car, watching folks come and go is sure to notice it. It just makes it more likely that a casual passerby might try one of the obvious doors nearby to see if they can get in, rather than trying yours.
MAC Filtering: Similarly, MAC filtering is better than not MAC filtering. The observer can't get on the network unless they spend enough time analyzing active traffic to sift for MAC info. Yes, with the right tools 'enough time' is relative, and not all that long. But, if you're not around using your wireless network when they're doing the analysis, it's difficult to obtain that info, since your MAC isn't being broadcast to begin with. Is it perfect security? Not by any means, but, again, it's a lot easier to get onto a network that's not using it than one which is. Not everyone is running Kismet with a wireless network card configured in promiscuous mode, and even with the number of folks who are, most are more likely to roll a half block down to the completely open network that's almost invariably there than spend time trying to get onto the more secure network, simply for the challenge of it.
Change the default password: If you seriously don't understand this, then you are completely clueless, regardless what tools you're using. Just because you can guess a few passwords using the short list that unimaginative folks commonly use doesn't mean that you can guess any password. (Of course, script kiddies commonly don't have any idea why what they use works, but that doesn't mean it doesn't.) If you were thinking at all about what you were writing, you'd see you make the point yourself as to exactly why it's important. You commonly 'just look up manufacturers default passwords'. If they set a proper password, it makes things more difficult, and you have to try to guess it. With a good password, you're not going to simply guess it.
Crashing the Router: As for your alternative, no decent router should ever come back up with the factory presets after a simple crash. It should always come up with the custom settings, or, failing that, remain hung until manually reset by hand. Even if they do come up with the factory defaults, for modern routers at least, that should be with the external management interface disabled.
Not
Re:Turn off UPNP MOD PARENT UP (Score:2)
Re: (Score:3, Insightful)
From a security perspective, I would never want one of these as, if someone were at my front door trying to pick the lock, they would be obscured from view. I find living in a neighbourhood where there is the appearance that all the neighbours are nosy is far more effective as a form of security.
Re: (Score:2, Insightful)
AC > I dont get the whole [yadda yadda yadda]
The hidden SSID and WEP encryption is meant as a polite message to white hat hackers that I'd rather they not use my AP as my bandwidth is metered by my ISP.
If you are an asshole who will hack and pwn my AP anyway then you're no better than the thief with the crowbar that smashes car windows to steal CDs and the spare change in coin boxes. If I'm lucky enough to be home as you do this, I'll grab my camera and a baseball bat to record your feats and your license plate, then use the baseball bat to smas
Re: (Score:3, Insightful)
Re: (Score:2, Informative)
Re:Turn off UPNP (Score:5, Informative)
Re:Turn off UPNP (Score:5, Informative)
Re:Turn off UPNP (Score:5, Informative)
Re: (Score:2)
Re: (Score:2, Insightful)
Re: (Score:2, Informative)
Personally, I just run a standard ISC DHCP daemon on one of my boxes and then configure it to dole out addresses to machines that need 'static' IPs for server functionality. I also have a dynamic port range for other boxes and devices that can change without any adverse effects.
On a Linux machine (currently there are packages for Ubuntu, Debian and Fedora, plus some others), this can be mad
Re: (Score:2)
I am using DD-WRT (http://www.dd-wrt.com/wiki/index.php/Main_Page), and it's much more functional than the original firmware of my linksys WRT-54GL router. It's also rock stable, once it's installed (Just follow the installation directions closely).
Re: (Score:2)
Re: (Score:3, Informative)
WRT54G (Arguably the most prolific consumer grade router in existence) does support static IP assignments via DHCP.
Certain versions, at least, do not. That was the main reason I switched to DD-WRT. The compact version also did not support it last I knew (a friend has this router).
But yes, even the D-Link DI-704 that I purchased in 2000 for $20 (i.e. it was really cheap a really long time ago) did support reserved DHCP, and I'll never again use a router without it. I personally find it unforgivable that Linksys' instructions for port forwarding essentially tell you to completely disable DHCP and just manually confi
Re: (Score:2)
Re: (Score:2)
You people actually run consumer-level commercial wireless routers?
Apparently I'm the only one here that runs a Smoothwall [smoothwall.org] router and a separate wireless bridge connected to a DMZ'ed network. Wired connections on the normal network, wireless on the DMZ. Soon I'll be upgrading to include a wireless card in my smoothie, and it will run everything. What self-respecting geek actually uses consumer-end garbage and doesn't DIY a proper router/firewall?
I AM on Slashdot, right?
Re:Turn off UPNP (Score:4, Informative)
It's a good gig: A Linux box with 5 Ethernet ports and a WiFi radio for ~$50.
Having zero moving parts and negligible power consumption is a big help, too.
Re: (Score:3, Interesting)
I have several PCs (one desktop, one old laptop, one ancient laptop) which I've tried to eliminate moving parts from.
The desktop is a machine which I occasionally use through a KVM, which only exists to operate a Soundblaster Live card using (exceptionally fine) KX Audio Driver. This turns an old (and also exceptionally fine), quadraphonic Pioneer receiver into a exquisitely-tweaked biamplification setup for the computer room's audio, while being able to convert to a rather featuref
Re: (Score:2)
Re: (Score:2)
Not trivial if your router doesn't support that feature. And I've worked with dozens of routers from SMC, Linksys, Dlink, etc that don't support it.
Re: (Score:2)
There's apps out there that assign different settings based on which network you're on, if you go between networks.
Re:Turn off UPNP (Score:5, Informative)
Re:Turn off UPNP (Score:5, Funny)
If uPNP is a godsend to those people... they need to get a better God.
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
Of course, if you want the benefits of TCP with this method, you then have to implement TCP over UDP to do this (which I know Hamachi does).
Re: (Score:2)
Re: (Score:2)
Basically if you're going to enable UPNP you might as well disable all your other security as well in the name of convenience.
Re: (Score:2)
Re: (Score:2)
Turning off SSID is pointless. It is easy to discover it for those that would want to know.
Open WiFi + this = trouble? (Score:3, Insightful)
Re: (Score:2)
Re: (Score:3, Insightful)
The fact that ports can be forwarded to a given host is not the real point of this article. More serious would be someone resetting the admin password, allowing the attacker to do things like set the DHCP-assigned primary DNS server to a malicious one, just as an example. Given how often phishing
Re: (Score:2)
From the article's comments:
The fact that ports can be forwarded to a given host is not the real point of this article. More serious would be someone resetting the admin password, allowing the attacker to do things like set the DHCP-assigned primary DNS server to a malicious one, just as an example. Given how often phishing attacks succeed, this seems like a legitimate threat. Notice that in this case the clients could be as hardened as can be, and they would still (unless a static DNS was manually entered) use the DNS server provided by the compromised router.
Hmm, but UPnP is special, in that it does quite serious things at the behest of unauthenticated requests, by design. Let's repeat that -- this isn't a 'bug' on the routers. UPnP is /designed/ to forward ports when it gets a request from inside the network, no questions asked.
Whereas, you do need at least a password (or a more esoteric vulnerability than UPnP; one that won't be as homogenous across various brands of router) to actually compromise the router in ways such as you describe.
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
Security vulnerabilities aside, open access points are a legal nightmare waiting to happen (child pornography, phishers, DDoS attacks, intrusion, etc.)
You've either missed the recent debate, or missed its point. The argument goes:
- If someone uses your open access point for nefarious means, you have a defence -- "But anyone could have done that".
- If someone uses your 'secured' access point for nefarious means, your defence requires a jury to understand the ease with which (say) WEP can be cracked.
And the likelihood of spammers, DDoSers, phishers etc. using your WiFi connection rather than their massive botnet is negligible.
Just repeating the argument. F
Re: (Score:2)
Why aren't you using WPA-PSK or WPA2-PSK instead of WEP? Using either WPA method is far more secure than WEP (which can be cracked by using a paperclip, the foil wrapper from a stick of chewing gum, two buttons from your shirt and a 20-oz bottle of Mountain Dew).
Re: (Score:2)
Just repeating the argument. FWIW my own access point is secured with 64 bit WEP, which I suppose is worst of both worlds. But it keeps my bandwidth available for myself, and uses a short passphrase I can remember.
Why aren't you using WPA-PSK or WPA2-PSK instead of WEP? Using either WPA method is far more secure than WEP (which can be cracked by using a paperclip, the foil wrapper from a stick of chewing gum, two buttons from your shirt and a 20-oz bottle of Mountain Dew).
I'm not sure my AP supports it -- I'm still on 802.11b and too tight to upgrade.
Re: (Score:2)
Re: (Score:2)
Who knows, a judge may find that you were criminally negligent by providing an open AP that was used in some crime. There's no good reason to take that risk. Setting aside the legal responsibilities for a moment, why would you even want to take the chance of being caught up in an investigation involving your unsecured AP? That's just asking for trouble. You wouldn't leave a loaded gun lying around for anyone to use or a running car unattended for anyone to drive off with, so why would you leave an access point unprotected?
An open AP is not a gun though, is it? I'm not sure it's facetious to say that I leave my rubbish bin outside on the street unsecured all the time. If someone stole it and hurled it through a shop window, I wouldn't be found criminally negligent for providing an unsecured missile.
I would be more concerned with someone connecting to my network and downloading/hosting child porn, which could get me (1) in serious trouble with the law and (2) an (unjustified) label as a child porn kingpin. It's just irresponsible and foolish to leave an AP open.
But you've not countered the argument (and I continue too play devil's advocate here) that an open AP gives you plausible deniability -- except for criminal negligence suggestion, for which I'm not aware of any precedence. Is it
Mozillazine forums had this two years ago (Score:3, Interesting)
My Home router is a Linux NAT Box. (Score:3, Interesting)
Anyway, my point. What about things like the Linksys WRT54GL?
The thing is, it would be awesome if there was a flash drive driven Linux device with a Cisco Style com port that ran off flash, could be OpenLDAP Server, Samba DC, Kerberos KDC, NAT Server, or actual router WITH a Cisco style Console port that are cheap. Why does this not exist??
Your point ? (Score:2)
Anyhoo, there's nothing uber special about Flash, you can just put a CF/SD card in an IDE/SATA adapter and attach it to a suitable computer, such as one of the fanless EPIAs [mini-itx.com], that one even has dual gige.
Re: (Score:2, Informative)
Re: (Score:3, Informative)
I have one (I have no financial relationship with them other than customer) and I really love it. Very low power, 4GB flash card (up to 8 now I think), 1GB of RAM, no fans, no noise and if I want to I can put a large USB external drive (or small laptop drive inside) to do NFS/SMB/ETC.
All that and the wonder of Linux IPTables, routing, NATting, OpenVPN, OpenSSH for around $300.
Let me be the first... (Score:2, Informative)
I installed it a couple of weeks ago, and really enjoy it. Banner ads have all but disappeared, and I don't even really notice (except for faster page loads and cleaner page layouts). If I want to see a YouTube video, that's easily accomplished--just click on the "F" icon in the blocked section of the page.
As an added bonus, I'm protected from all of these recent security breaches we've seen for Flash...aren't I?
Re: (Score:2)
Firefox isn't vulnerable to this in the first place, so your advice means nothing here.
Re: (Score:2)
Re: (Score:2, Funny)
Still, NoFlash... NoScript... soon I'll have to install NoImage and NoCSS. I guess it's time to go back to Gopher.
Browsers (Score:4, Informative)
Open open... (Score:5, Funny)
Hold on, now I'm confused: does this attack open open ports, or does it open ports open? Or even worse, does it open open open ports?
Re: (Score:2)
Re: (Score:2)
In some upnp implementations it's been shown that you can even do it the other way around - do things like forward port 80 outgoing to $hackers_proxy.
upnp is kinda useless anyway.. nothing that can't be done more safely and more controlled by static DHCP and standard port forwarding (or, better, getting multiple IP addresses from your ISP).
Don't try this at home (Score:2)
My larger point though is that in a web where the actual URL of content is becoming more and more meaningless as meta sites start to coagulate content around them, what do users on the client side h
What about the Wii browser (Score:2)
Turn off UPnP! (Score:5, Insightful)
Never used it. Never wanted it. Never turned it on. Always turned it off on EVERYTHING. UPnP is the problem here - a simple (unauthenticated) HTTP-style page requested in a browser suddenly starts opening ports to your network. It should not happen. Even my DSL router/wireless router/Linux router has SSL only, passworded access to do anything even approaching opening ports. And if a webpage pops up with an authentication dialog with the header "Wireless Router" and you type in your password, then you're a fool, unless you specifically requested the router's configuration page.
There's rarely even a log of what UPnP has done - which ports it's opened in the past etc. for whom.
Just turn the damn thing off. It's too dangerous.
Re:Turn off UPnP! (Score:5, Insightful)
But, agreed, it's scary stuff, if you believe your router ought to be a firewall. What's really needed is for home routers to start implementing authenticated UPnP, and for clients to work with it. (I must admit I've only glanced at the UPnP specs, but I seem to recall seeing references to an authenticated flavour).
Re: (Score:2)
Re: (Score:2)
Any half decent bittorrent client works of a single port and can be setup in minutes.
What is this 'chore' you're on about. I known virtual newbies do it without prompting.
Re: (Score:2)
xbox live works fine without any port forwarding at all.
I Googled, and you're right. However XBL uses UPnP if it's there, and I suspect that for most games, at least one Xbox needs to be able to accept() connections from the rest -- whether that's using port forwarding, a direct connection to the net, or whatever. So yeah, a given Xbox can run without any port forwarding, but if everyone did it, it would break (like in the old days when MSN Messenger file transfer worked if one side was NATed, but not if both were).
Any half decent bittorrent client works of a single port and can be setup in minutes.
What is this 'chore' you're on about. I known virtual newbies do it without prompting.
'Minutes' is more than zero effort, and I sus
Re: (Score:2)
An argument could be made that UPnP is more secure in that it only opens ports while a program uses them (provided the program is coded right), not all the time as most people would have done had they needed to open the ports manually. That doesn't negate the vulnerabilities in the
How about checking your router configuration (Score:2)
I recently bought a Sitecom router (Score:2)
Are router manufacturers finally learning?
My Xbox360 requires uPnP to be off (Score:2)
Local firewall and other factors (Score:2)
Now, to actually get to the computer, it would also have to bypass your software firewall as well.
Of course, all this does is open ports, it doesn't actually attack or exploit anything.
This is a potential exploit, but not a working one yet.
Off by default on my Netgear routers (Score:2)
I have a couple of Netgear routers and both shipped with UPnP off by default.
UPnP can be enabled or disabled for automatic device configuration. The default setting for UPnP is disabled. If disabled, the router will not allow any device to automatically control the resources, such as port forwarding (mapping), of the router.
Here is more info (Score:2)
"UPnP [wikipedia.org] comes with a solution for NAT (Network Address Translation) traversal, called the Internet Gateway Device (IGD) protocol. NAT traversal for UPnP enables UPnP packages to pass through a router or firewall without problems and without user interaction, (that is if that router or firewall supports NAT). It essentially allows any local UPnP device to punch arbitrary holes in the firewall, by letting the firewalled router create port forwardings automatically."
Re: (Score:2)
That depends. Did you install UPnP [dd-wrt.com], presumably because you want random ports to open up on your DD-WRT router without your consent?
If not then you're probably quite safe from UPnP based attacks.
Re:DD-WRT? (Score:5, Informative)
If the firmware has UPnP IGD enabled, then your machine is vulnerable to this attack.
The vulnerability is really Flash not restricting what untrusted scripts can do. The router's UPnP IGD profile is working as designed - an application on a machine within the firewall requests that an incoming port be forwarded, so the router does that. This is useful for VoIP, IM, P2P and other applications that need to be contactable from the outside world. Malicious programs that are running on your machine can always initiate outgoing connections, so generally the UPnP IGD is not allowing anything that cannot already be done. In the case of Flash, it is probably blocking most outgoing connections, so UPnP does expand the possibilities for a malicious Flash app to initiate connections with your machine. But unless Flash also allows you to open server sockets, the attacker would also need to find an exploitable service running on your machine.
All this should be detectable by a decent firewall program running on your local machine.
Questions about Wireless Router Security (Score:2)
Excuse my ignorance/confusion, but... I'm not up on the details of either Flash or UPnP, and yet I still need to understand this better and so I have a few questions.
I
Re:Questions about Wireless Router Security (Score:5, Informative)
There are some ports.. 137,139,445,etc. that you really don't want on the open internet. If the plugin does something like a port forward of 0-65535 to your machine suddenly *every* service on there is wide open to any attack. It'll bypass protections from eg. the default XP firewall as the packets will appear to be coming from the local LAN (the router) rather than the original source.
It's not just flash (although a malicious advert on a page is the most obvious vector for this). Anything that runs on your machine can do it.. I reckon you could craft such an attack in javascript even (XMLHttpRequest with the right code).
Once the ports are open anything that manages to run on your machine can leave itself wide open without having to make telltale outgoing port connections (although it's often said that outgoing connections are the reason upnp is 'not worse' than existing protections, no working trojan would work in that manner, since the target of the outgoing connection would quickly be found and shut down.. OTOH leaving a trojan on your machine listening on your machine waiting for the command to send spam/infect others/distribute child porn/whatever is much more real a thread).
Re: (Score:2)
Do you have any idea what you are talking about? If not, it would be best for you to sit quietly and let the grown-ups
Re: (Score:2)
Re: (Score:2)
Re:Opening port does not mean that it is exploitab (Score:2)
script/flash/exe/whatever opens port 445. Your network gets pwned.
Because there's no authentication upnp shouldn't be allowed anywhere near a network. At the very least a verified password should be needed to activate the port forwarding each time.
Really, developers shouldn't write shitty protocols that require it. Luckily it's becoming rarer.. few games need it (if any, these days.. certainly nothing recent), even bittorrent clients are