Security mavens have uncovered a design flaw in most home routers that allows attackers to remotely control the devices by luring an attached computer to a booby-trapped website. The weakness could allow attackers to redirect victims to fraudulent destinations that masquerade as trusted sites belonging to banks, ecommerce …
UPNP and recent Belkin routers OK
My Belkin FSD7230-4 wireless router has a firmware setting to disable UPNP connections. UPNP is OFF by default.
So that headline should probably read "*some* home routers are vulnerable..."
Cheers from Canada
Airport Extreme Base Station?
Any idea what Apples Airport Extreme Base Station, which contains a small router, might be set to?
UPNP Just like Windows ME ... a bad idea
Which is why It is the first thing I turn off on all new installs I do.
I turned mine off..
on my SMC Barricade router, and now I can no longer control it. Typing 192.168.1.254 in my browser reports a 404. Niether can I telnet or ssh it.
In order to change anythong in the configuration I will have to use a paperclip to clear take it back to it's defaults. If I can remember my ISP user name and password.
The latest version of firmware for the Belkin FSD7230-4 'wireless' (when it works) router lacks uPnP. I find my current P2P progs like uPnP so I may have to
a) get around to rebuilding spare system
b) remove flash
c) not 'upgrade' firmware
d) all three
UPNP yes BUT only as a media distributor
I use upnp but only internaly through ushare(http://ushare.geexbox.org) and djmount to access it on my boxen. It's great for such things but I wouldn't touch it for a router EVER...
Orange UK router seems OK
The Siemens router (not the Livebox though) that came with my Orange broadband also had uPnP turned off by default.
Steve Gibson (http://www.grc.com) slaughtered in the press when he said how inherently unsafe UPNP was ?
How many years ago was that now - seven ?
Refund after today?
There is, of course, no way to know from the boxed item, what it can/can't do to the extent purchasers may need.
So, does a router that cannot have UPnP disabled, mean that it's not 'fit for purpose' and therefore, returnable for refund?
Linksys WRT54GL + DDWRTv23
Anyway, the problem here isn't really the routers, it's the morons who go to infected websites. We still need to stamp out the problem at the root.
RE: Refund After Today
I'd say they can't argue it, unless they want you to pull up a manager and start yelling how they sell insecure hardware in the middle of a PC world :P
You know.. I might go do that on my lunch. I've already got a few Bug-Bears to pick with PC world..
@ Tony trolle RE: i turned mine off
or you could just manually set the port forwards (sometimes called virtual servers by some manufactures) so you can turn upnp off and turn upnp off in the programs such as azureus and it will stop moaning at you
I've had it turned off for years, I never like the concept from day one. Never had a need for it, but guess I'm a bit more technical than you average Joe.
Oh and remember people, not every router has the same address.
UPnP is great. Rather than creating a port forwarding rule (which always leaves a certain port open), it only opens and forwards the port *while running the app which needs it*. Once the app closes, the port is also closed.
I'll rely on NoScript blocking Flash content that's not hosted on websites I explicitly trust, for now.
AEBS and that...
I think it does - Leopard's Back-to-my-Mac relies on uPnP.
Cisco 857's don't do it. As I found out when trying to play with Back-to-my-Mac. Still silver linings and that, eh?
It's me being a bit thick
But in order to set up the forwarding described I have to manually log in to my router with an ID and password. Does the UPnP not require the same authentication when done through this Flash exploit?
Turned mine off...about 2 minutes ago :P
Gibson was slaughtered in the press for being a scare-mongering f*ckwit.
Whilst he - quite rightly - declared UPnP unsafe, he also declared just about every other interface & protocol available to a PC unsafe too.
Besides, turning UPnP off has been considered good practice since it was first introduced.
Thumbs-up for Belkin
My (year-old?) Belkin not only defaults UPnP to Disable but includes a good explanation of the risks of enabling it.
i wasn't sure, but just checked on my D-Link G604T and it was turned off. I think I probably looked at it and said "what's that? sounds dodgy. Do I need it? no ...."
UPnP disabled here too
Think that until a couple of days ago it wasn't an issue as my aged BEFSR41 predated UPnP! However just got a WRT54GL and, as others have commented, during initial setup saw the enable/disable UPnP and without thinking disabled it! (Slight minus point was that it was enabled by default)
Also, interested to see that WRT54 also has the useful option of denying access to the settings web pages from the wireless interface which closes another potential (if unlikely in practice) harzard
Flash security flaw
I find it very tenious that the reason that this isn't a security flaw in flash is because flash is behaving the way it was designed too. This is complete rubbish.
It IS a security flaw in flash. I can see no justifiable circumstances why a flash script from the internet should be able to open a page to a private non-public ip address. It shouldn't be allowed.
That's a lovely word which I've seen a lot on El Reg recently. You're all quite the literacy mavens!
if only it was that easy
UPnP is supposed to be standardised, shame that in reality it isnt, every router has its own little foibles and bugs, many just plain dont work at all, or work once then crash. its been hell trying to write code to work smoothly with as many routers as possible. oh and someone said that the port forwarding vanishes when the application does, wrong, the program would have to explicitly send delete rule commands to the router.
RE: Airport Extreme Base Station?
The Apple Airport Extreme doesn't support UPnP instead supporting the competing, but seldom used, NAT-PMP standard.
NAT-PMP does a similar job to UPnP, perhaps it is also vulnerable?
Went to look. Big red icon beside UPnP and "To enable UPnP, check the Enable UPnP box and select a connection below."
Can't recommend my router to the colourblind but at least they got that default right.
The Orange Livebox...
Has UPNP on by default (well mine did)
UPnP requests from the internal network?
Because the request is sent by the web browser, the upnp request _is_ from the internal network.
Do other viruses and trojans change your primary DNS? It seems like it'd be a rather useful thing to do, if you're so inclined.
All excellent news except...
...if you have an Xbox360 and use Live.
I'll guess we'll have to wait for that penguin powered games console and in the meantime keep ourselves amused with board games or something.
Alternatively I might have a look and see if I can create a firewall rule on my router to only allow non-PC's on my network to use UPNP...
The links on the article seem to imply that it uses the IP address of the router to give it access to UPnP.
So does this mean that if the router has a non default IP address (or is not the default gateway) then its actually going to be hard to get into? How long is it going to take to scan all the IP addresses in my 192.168.x.x address range?
Daniel, it's OK, I can't get UPnP to work on my D-Link G604T, along with reliable name resolution under Linux and a way of using FTP that doesn't cause it to crash, so I think we're safe.
Dont need upnp
all you need is Static ip's on your network and port forwarding, unless you got a router that can forward ports by computer name then you might get away with using DHCP and port forwarding
who needs upnp anyways
RE: Flash security flaw
"It IS a security flaw in flash. I can see no justifiable circumstances why a flash script from the internet should be able to open a page to a private non-public ip address. It shouldn't be allowed."
What a load of BS. I guess you haven't heard of an Intranet then? How would it be told it's on the internet or an intranet - some corp's have internal servers that -do- have external (firewalled) IP addresses that are accessed from inside the LAN so simply checking it's (local machines) IP wouldn't work.
I suspect you already know the answer to that and you're just angling for a "most predictable smart-alec post" award.
Of course the router is fit for purpose, it routes traffic from one place to another. I don't see any manufacturers advertising their products as totally secure, they just say "our router will route traffic".
Just because it doesn't say whether uPnP can be disabled on the box doesn't mean you have a legal right to buy it to find out, and then return it for a refund if it doesn't do what you want. Don't get rights mixed up with voluntary returns policies. If you specifically want functionality that isn't mentioned on the box, then you need to ask the reseller and if PC World tell you that uPnP can be disbaled but you then find it can't be, then you have a right to a refund. Of course, trying to get PC World to admit to telling you duff gen is another issue entirely....
Upnp - no go area
I never switch on Upnp. Not only is it a bad practice, but in case you have 'smart' windos machines around, they will autodetect the 'feature' and use it to switch the ISP link on/off. So, say you have 4 machines connected and you close down one, all others loose their connection as well. This is what happened on an older speedtouch icm. windos XP.
It should be switched off by default - always - and I really see no reason for anyone using it at all. The same applies to stupid flash stuff as far as I'm concerned....
The only times I ever hear about UPNP it's in connection with a security vulnerability. I don't think I've ever had cause to use it, and I probably never will.
Need to know more but don't know enough; where do I start
I see these regular stories on Reg about holes in routers etc. I've got a software firewall, noscript etc. etc. but I read the stuff above about NAT, port forwards, now UPnP, IPtables for routing and all that, and it's clear that my fragmentary knowledge of IP ("four numbers. Dots inbetween") doesn't cut it. I've two books on networking & they taught me nothing - they really were trivial. So, experts, please recommend a solid book or somewhere to start.
BTW I work in IT so I'm only a newbie in networks.
So when i get home and disable it with my WRT54GL im gone and knackered my 360 live account?
With google you can find many of these inforrmation resources. What you should start to learn are the fundamentals. Search for 'TCP/IP networking howto' and a lot will show up.
This is a reasonable page to get started:
I have learned my original TCP/IP knowlegde from a book connected to the Novell 3.12 NOS. It was a very comprehensive book and perfectly clear. It just does not cover all those 'new thingies' like NAT etc.
...came with UPnP enabled... but when (way back then) the service was enabled on my PC it used to use up half my CPU and bandwidth so I turned it off by disabling the service on my PC. Having done that, I figured I didn't need it on my router either and disabled it.
Can't see why people are arguing to be honest. It's cack - turn it off. Make sure when you buy a router that it CAN be turned off.
Re: Need to know more but don't know enough; where do I start
I wouldn't claim to be an expert, but I recall these two being good.
Data Communications, Computer Networks and Open Systems
# ISBN-10: 020142293X
# ISBN-13: 978-0201422931
Andrew S. Tanenbaum
# ISBN-10: 0130384887
# ISBN-13: 978-0130384881
There's a lot of overlap there, and I'm not sure they cover upnp which is relatively recent.
SMC Barricade can be OK
UPNP has long been turned off on my SMC BR14UP and it works fine.
Never used it
Since I know that only a very few ports are required for the stuff I use and they are all on one PC on my network I've never used UPnP. Mind you, as I have a linksys router I binned the standard firmware and moved to Tomato - much better than the standard stuff and has UPnP off by default.
Looking back 7 years ago today, just about every other interface & protocol was insecure. (pre XP... at a time when people were buying Windows ME on new computers! Most users had fat32 file systems!) I wish people had listened, since nobody really did, we have russian computer gangs, massive bot nets, turks defacing websites, chinese pen testing DOD computers, spam, prolific viruses and nigerian royalty.
UPNP is about as much use as an ashtray on a motorbike. If you're too lazy to learn playschool networking, don't network.
Sometimes this "use stuff even if you don't know how to use stuff" philosophy makes me want to puke.
The fault is prolly a bit of both
Flash for not having the ability to switch off UPNP and UPNP for blind obeissance. You might want to also blame the router manufacturers for allowing an untrustworthy protocol to redirect something as necessary as DNS.
Has everyone missed the point...
...if you don't go to dodgy websites in the first place where these people are likely to have put the crafted flash, then you haven't got a problem.
Again - common sense and having half a brain prevails.
I'm leaving my UPnP on, thankyou very much, even if I don't have many applications that use it.
UPNP was intended ...
...to be a fix for users who didn't know how to configure their routers. Sadly these are probably the group most likely to be directed to a website with all kinds of whacky exploits.
@ Russell Preece
Do "dodgy websites" have a banner advertising their dodginess?
- Product round-up Ten excellent FREE PC apps to brighten your Windows
- Hi-torque tank engines: EXTREME car hacking with The Register
- Review What's MISSING on Amazon Fire Phone... and why it WON'T set the world alight
- Product round-up Trousers down for six of the best affordable Androids
- Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...