76 posts in this topic

THE EQUIPMENT AT THE TARGET IP ADDRESS

DID RESPOND TO OUR PROBES!

It asked to be probed more often, as it hasn't been getting any lately.

:)

Share this post


Link to post
Share on other sites

UPNP just asks for trouble, why would I want some phantom application allowing itself in and out of my firewall. Not to mention left over ports being left open. If I have anything that needs opened I do it myself.

Share this post


Link to post
Share on other sites

My main router is an old (and I mean REALLY old) Netgear RP614 v2, and it is not vulnerable. :huh:

Edit: Happy Birthday, Budman!!!! :punk: :pint: :pint: :pint: :pint: :pint: :pint: :pint: :pint: :pint: :pint: :pint: :pint:

Share this post


Link to post
Share on other sites

pfSense, enough said.

Share this post


Link to post
Share on other sites

To those who don't get it and want the short version:

The problem is that some routers will respond to UPnP requests, wherever they're coming from. If they're coming from the LAN--no problem (unless you don't trust other machines/devices within your own LAN). If they're coming from the WAN port--then that's bad and you should disable it.

If you need more details than that, then listen to the podcast on the GRC site.

Share this post


Link to post
Share on other sites

I disable it anyway. The fact that UPnP, by design, lets any application communicate with the router and open ports should make any security conscious user uneasy.

Not really. At this point you have already lost and been invaded anyway, and the route out should be of much more concern than than the route in, and if the program in question can open a route in, it's also capable to two way communication without opening a port.

that site is scaremongering at best anyway. notice how it ONLY reports how many "open" routers has been found with the test, not how many secure ones.

Share this post


Link to post
Share on other sites

Mine passed. Thanks Warwagon!

Share this post


Link to post
Share on other sites

It would allow any malicious program to actively contact your router, open whatever ports it wants, and then transmit data through those ports all without your knowledge.... pretty big security hole if you ask me.

From the inside, at which point you've already lost and UPnP isn't needed anyway

Share this post


Link to post
Share on other sites

Disabled by default on Gargoyle. I can't believe it took me so long to put this on my WNDR3700.

post-45228-0-52650300-1360022836.png

Share this post


Link to post
Share on other sites

All good here:

THE EQUIPMENT AT THE TARGET IP ADDRESS

DID NOT RESPOND TO OUR UPnP PROBES!

Share this post


Link to post
Share on other sites

I got the good news !! :D

Share this post


Link to post
Share on other sites

All good here as well. :)

Share this post


Link to post
Share on other sites
THE EQUIPMENT AT THE TARGET IP ADDRESS

DID NOT RESPOND TO OUR UPnP PROBES!

Amped Wireless R20000G Passed! UPnP Enabled

Also mine's not on the affected devices list either!!!! Go Amped!!!!

Also mine shipped with uPnP disabled as well as WPS disabled. Extra points for them!

Share this post


Link to post
Share on other sites

safe here, thanks man, I didn't even know about this, my upnp is on (Y)

(Cisco e4200)

Share this post


Link to post
Share on other sites

Still not sure how people think this is suddenly new... it's been like that for a while. Didn't one of the US agencies mention this years ago?

I've always suggested to disable UPnP.

Share this post


Link to post
Share on other sites

So is this a just rubbish. Default settings on router since I bought it and I got a pass.

I just have a forward to my web server.

Router is

Netgear DG834GT with the firmware updated to the latest.

Share this post


Link to post
Share on other sites

I have an Airport Extreme router. I don't see an option for UPnP on the Airport Utility. Then again, it doesn't have many options at all.

THE EQUIPMENT AT THE TARGET IP ADDRESS

SUED OUR UPnP PROBES!

1 person likes this

Share this post


Link to post
Share on other sites

BLASPHEMY! YOU GOT A SECRET MICROSOFT BRANDED ROUTER AND YOU KNOW IT.

Share this post


Link to post
Share on other sites

Today I had to help setup a computer for a little old lady. While I was there I ran the UPnP test. Her's failed! She had a D-link (Go figure) .... logged into the router and turned off UPnP, ran the test again and then it passed. So the rest does work!

Still not sure how people think this is suddenly new... it's been like that for a while. Didn't one of the US agencies mention this years ago?

I've always suggested to disable UPnP.

Because UPnP should NEVER be on the WAN side (internet). This means a bad guy could send a packet to your IP and if your router responds (Which is what this test is for) he could open a port in your route from the outside (Internet)

1 person likes this

Share this post


Link to post
Share on other sites

pfSense, enough said.

Not practical for the average consumer, enough said.

From the inside, at which point you've already lost and UPnP isn't needed anyway

Not from the inside, the exploit is that it responds to UPnP from the WAN side, that's the problem.

Not really. At this point you have already lost and been invaded anyway, and the route out should be of much more concern than than the route in, and if the program in question can open a route in, it's also capable to two way communication without opening a port.

that site is scaremongering at best anyway. notice how it ONLY reports how many "open" routers has been found with the test, not how many secure ones.

I think your failing to understand the exploit, typically the packet is formed on the LAN side from an application, which is passed to the router, the router opens up the ports requested. The problem is here, if you are running one of the exploitable routers, ANYONE from the WAN side, can sent a correctly formed packet to your router, over the net, and your router will open the port for them. This should never be allowed on the WAN interface.

Share this post


Link to post
Share on other sites

that site is scaremongering at best anyway. notice how it ONLY reports how many "open" routers has been found with the test, not how many secure ones.

That is because MOST routers SHOULD pass the test!!! There shouldn't be very many routers that by default have UPnP on the WAN. The people who have run this test in this thread have proven that.

It's a MUCH bigger deal if you fail the test than if you pass it.

Share this post


Link to post
Share on other sites

uPnP is the dumbest idea. whats the point of the firewall if applications are just going to open dat dere ports anyways? if you get a piece of malware that runs a server on your pc,it will just open the ports it wants,and runs beautifully. if you open your own ports,you at least know what you're getting yourself into. you don't even have to have malware. you might have a vulnerable application that is actively listening on a port.

Share this post


Link to post
Share on other sites

guys please be sure you specify the router you are using for the tests... some of you didn't and that's not helpful...

That is because MOST routers SHOULD pass the test!!! There shouldn't be very many routers that by default have UPnP on the WAN. The people who have run this test in this thread have proven that.

It's a MUCH bigger deal if you fail the test than if you pass it.

My Amped Wireless R20000G and my R10000 both shipped with UPNP disabled.

I enabled on both and they pass the test and "do not respond"

Share this post


Link to post
Share on other sites

guys please be sure you specify the router you are using for the tests... some of you didn't and that's not helpful...

My Amped Wireless R20000G and my R10000 both shipped with UPNP disabled.

I enabled on both and they pass the test and "do not respond"

I agree they could list their router. But we are already more than 4 pages in. So people could either flip through the pages looking to see if someone who ran the test has the same router than them, or they could just go to the site and click the button.

This thread was created not really as a list of routers affected but as away people can test themselves against the issue.

Share this post


Link to post
Share on other sites

uPnP is the dumbest idea. whats the point of the firewall if applications are just going to open dat dere ports anyways? if you get a piece of malware that runs a server on your pc,it will just open the ports it wants,and runs beautifully. if you open your own ports,you at least know what you're getting yourself into. you don't even have to have malware. you might have a vulnerable application that is actively listening on a port.

It's so that when somebodies mother who views the computer as a magic box wants to make a Skype call with somebody, she doesn't have to reconfigure the firewall to let things pass through.

I'm running a dual stack (v4/v6) setup, and the UPnP daemon I'm running doesn't support the v6 side yet so any open ports only happen for v4 traffic. It's surprisingly annoying to track down what uses what ports to add them to the firewall.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now
Sign in to follow this  
Followers 0

  • Recently Browsing   0 members

    No registered users viewing this page.