Some Older Linksys Routers allow UPnP Configurable from the net


Recommended Posts

Some Older Linksys Routers allow UPnP Configurable from

update the firmware or disable UPnP immediately!

  Quote

Routers from various manufacturers support UPnP (Universal Plug and Play) on their WAN interfaces, which apparently makes it possible for attackers to reconfigure them remotely via the internet and, for example, misuse them as surfing proxies or to infiltrate internal LANs. The problem was discovered by IT security specialist Daniel Garcia, who has developed the Umap tool to demonstrate the problem; the tool is available to download free of charge.

Umap detects UPnP-enabled end devices such as DSL routers and cable modems on the internet by directly retrieving the devices' XML descriptions. The required URLs and ports for some models are hard-coded into the tool. This enables the software to bypass the usual restriction that only allows UPnP to search for compatible hardware via multicast in local networks. Garcia says that entire device series by Edimax, Linksys, Sitecom or Thomson (SpeedTouch) respond to UPnP requests on their WAN interfaces.

Since UPnP isn't designed to include any authentication, the XML description can always be retrieved. Garcia said that, by performing an internet scan, he managed to detect 150,000 potentially vulnerable devices within a short period of time. Once initial contact has been made, the scanner sends such UPnP commands as AddPortMapping or DeletePortMapping to the devices via SOAP requests. LAN devices usually use these commands to access the internet via NAT. However, the devices from the manufacturers in question allow the port to be opened ? and redirected to any other LAN device ? via the WAN interface. Umap attempts to guess the internal IP address that is required to do so.

http://www.h-online.com/security/news/item/UPnP-enabled-routers-allow-attacks-on-LANs-1329727.html

  On 27/08/2011 at 19:43, littleneutrino said:

been disabled for rather some time. :p

Ya but what about the millions of users of Linksys routers that just plug it in and go.

  On 27/08/2011 at 19:46, HawkMan said:

Keeping upnp on because it's convenient, and keeping the firewalls on only computers because there's no reason to not have them on.

And overly sensationalist.

What if you were behind a linksys router, had UPnP and had folder shares setup on your network. Then a guy on the net configures your UPnP to allow folder shares accessible on the net?

  On 27/08/2011 at 19:32, warwagon said:

***WARNING!*** Linksys Routers UPnP is Configurable from the net

disable UPnP immediately!

For some reason this story isn't getting much press. Personally I think this is huge. I had a hard enough time just finding a site that talked about it.

maybe because it's not that big of a deal?

  On 28/08/2011 at 05:07, Ryoken said:

Anyone that has set all their shares to public, is an idiot.

Someone wants to get on my network feel free, you'll get to see that I have shares, but that's it.

The fact a someone on the net can configure your router from the outside and even see your shares should make you feel uneasy. Regardless if they can actually open the shares,

This isn't really a huge deal, because, as it was said before, there are plenty of computers out there not even behind a router. However having your ports open for anyone on the internet isn't a good idea. You could always be caught with a slightly outdated software or exploited with a zero day.

any newb knows not to enable UPnP....</joke>

Joking aside....what a bummer! I mean, I sit behind a netgear router as my primary gateway...a linksys I'm using as a switch...then a linksys I'm using as an access point, with multiple workstations on wifi...even a ps3...and still, don't have to worry about it. Life goes on....(least, for me anyway)

There's probably a large number of people that use Linksys routers with custom firmware. Newer firmware versions have a feature that says "UPnP clients are allowed to add mappings only to their IP". I'd imagine this would protect you from the kind of vulnerability talked about in the article.

Linksys will more than likely fix this in a firmware update. But now many "Average user" upgrade the firmware of their routers?

How many "Average user" also install custom firmware?

So my guess would be we have millions of average users with linksys routers out there that are non the wiser to this issue.

basically what I am getting at is that there are fewer with this issue than you think. Many routers do not enable upnp out of the box....I believe that there are more out there that do not than there are that do. I have run into less than a handful that have had this enabled out of the box. It is the gaming users (xbox, ps3, and possibly the wii users) that have this feature enabled...perhaps being that you have more experiance on the home side than I do in recent years you see different, but I am pretty sure that you have to enable this feature on most or all routers.

  On 29/08/2011 at 20:35, sc302 said:

basically what I am getting at is that there are fewer with this issue than you think. Many routers do not enable upnp out of the box....I believe that there are more out there that do not than there are that do. I have run into less than a handful that have had this enabled out of the box. It is the gaming users (xbox, ps3, and possibly the wii users) that have this feature enabled...perhaps being that you have more experiance on the home side than I do in recent years you see different, but I am pretty sure that you have to enable this feature on most or all routers.

Having to enable it, doesn't that defeat the purpose it was created for? I can see why home user routers would be on by default, and I could also see why business class routers would have it off by default.

  On 29/08/2011 at 20:43, warwagon said:

Having to enable it, doesn't that defeat the purpose it was created for?

how so? disabled for the majority, if you need it you enable it....it is a tick just like wpa is a tick to enable.

  On 29/08/2011 at 20:46, sc302 said:

how so? disabled for the majority, if you need it you enable it.

Ya, but they are Made for the 'Home users" Home users barely know where the address bar is, let alone how to log into their router and enable UPnP :cool:

I don't disagree with. If you need it turned on its a VERY easy thing to do. For the the home user, a not such an east thing to do.

  On 29/08/2011 at 20:48, warwagon said:

Ya, but they are Made for the 'Home users" Home users barely know where the address bar is, let alone how to log into their router and enable UPnP :cool:

very true and that is why you see many routers that have no wireless security and upnp disabled because they kept the defaults.

point being that although it is a flaw, the majority isn't succumed to this flaw being that they don't even know how to get in to it to check it's ip or if it is connected to the internet. the ones who this flaw is subject to are the people who know enough to enable it for whatever reason and should be keeping up on their security and updates.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Ouch!  I hope you can find a replacement. I built a PC for the first time in 9 years... and of course I chose a case with a glass side panel.  Building in it scared the hell out of me the entire time!
    • $80 is too much for an Outer World game, period. Even I know that and I don't play the game. Mario Kart? Sure. Everyone plays or has played Mario Kart. I guess MS is trying to push everyone onto game pass. Which makes sense for them.
    • The $80 video game - A new frontier of cost, or a bridge too far? by Paul Hill The Xbox Games Showcase took place over the weekend, followed by Obsidian Entertainment’s The Outer Worlds 2 Direct deep-dive event into the upcoming game. Shockingly, this will be Xbox Game Studios' first $79.99 game, and unfortunately, it’s part of a larger trend. The price creep is not new; this is just the latest iteration of increasing prices. Just over a decade ago, when the Xbox One launched, you could expect to pay $59.99 for a new standard edition of a game and in 2020, with the launch of the Xbox Series X, prices were nudged up even higher to $69.99. Now, Microsoft is trying to push Xbox Game Studios titles even higher to $79.99, which could set a precedent. Here's an overview of game prices over the years: Xbox Console Release Period Typical AAA Game Price (USD) Original Xbox 2001-2005 $49.99 Xbox 360 2005-2013 $59.99 Xbox One 2013-2020 $59.99 Xbox Series X|S 2020-2025, 2025-Present $69.99, $79.99 The decision to increase game and console prices was not announced this week, but at the start of May. The recent Xbox Games Showcase has just drawn attention to the issue again. The price rises are set to come with some of the games launched during this year’s holiday season. Given the inflation we’ve seen since 2020, rising salaries to keep up with the inflation, and the unilateral tariffs the US is trying to impose on countries the world over, it’s not too surprising to hear Microsoft say prices need to go up due to development costs. Nevertheless, it will still be an unwelcome shock, especially to younger gamers who may not even be out of school and struggle to, or get their parents to pay for an $80 game. Even if you do have a steady income, there is a good chance that your wage has failed to keep up with inflation, making it more difficult to afford brand-new $80 games. In this editorial, I will take a deeper dive into the economic realities of game development and the justifications used to raise prices periodically, the impact on developers, alternative actions consumers can take to avoid paying so much money for games, and the specific context of The Outer Worlds 2’s price rise. The economic realities of game development and the justification for price increases During the COVID-19 pandemic, people were told to stay at home in most countries. In developed countries such as the UK, there were furlough schemes to tide people and businesses over, but production fell significantly in many countries, including the US, where manufacturing output fell at a 43-percent annual rate. The pandemic reduced output from producers globally, which led to the same amount of money chasing fewer goods, causing prices to go up. As inflation rocketed, workers across the economy sought out higher-paying jobs and pay increases, leading to even more money chasing fewer goods and ensuring inflation kept on. As a result, Microsoft was affected by higher hardware production costs, higher wages for developers working on games, and higher fees paid to actors needed for the games. All of these costs are being passed onto customers through increased game, console and accessory prices, and increased subscription costs. The $80 price tag will mainly affect AAA games because they have larger development teams, take longer to make, have more complex graphics, and animators, programmers, and writers who work on these titles are able to demand higher salaries. These games are also trying to innovate more, so they have to use next-gen technologies and pay the associated research and development costs, which get passed onto customers. In general, there is greater demand from consumers looking for the best graphics, which also pushes costs up as complexity rises. The public's demand for better graphics and stories means that development costs go up. While gaming revenue has been rising in many places, the large costs companies face mean diminishing returns on sales. Raising the cost of games and subscriptions is just one way that studios can cover their increased costs. Outside of the company-consumer relationship, public companies like Microsoft are always under pressure from shareholders to continuously increase revenues, which is another reason the company could be raising AAA game prices to $80. Consumer perception and the value proposition of an $80 game Seeing a $10 increase for popular games can be pretty jarring for consumers when the price of games already seems high enough, but what is not seen is the cost that these games take to make, especially with the expectation that the graphics must continually improve with each new update. When you take an objective look at the situation, you can justify the price increase given everything that these companies need to pay for behind the scenes. That said, the move will undoubtedly impact budget-conscious gamers, students, and those with limited disposable income. While these groups will be more excluded from AAA games, there are other options available, which I will cover later. In the case of The Outer Worlds 2, many people have criticized the price tag and said it is ironic considering the fact that the game critiques unregulated capitalism. If this type of sentiment sticks, it could drive more people away from AAA games to cheaper alternatives. As Xbox Game Studios’ first game out of the gates with the increased price, The Outer Worlds 2 will also be the title to take the most flak, whereas subsequent games could get away more lightly because $80 will already be the new normal. Gamers will also likely be cheesed off about the price increase, considering many games, including The Outer Worlds 2, have paid downloadable content (DLC). When games used to be cheaper, you could justify the additional cost of DLC, but when a game costs $80 upfront, then you have to pay for DLC, it seems like less of a good deal. The Outer Worlds 2 and the $80 price point: A case study Helping to justify the $80 price tag is Obsidian Entertainment’s reputation for creating strong role-playing games, deep character development, and choice-driven narratives. Fans of the company will be some of the least likely to worry about the new price because they know they’ll get a game they like for their hard-earned cash. Just like The Outer Worlds 2, the first installment was a full-priced game when it launched six years ago. At the time, full-priced meant $60, so the second installment is going to cost you an extra $20. Online opinion suggests that the price they paid for the first game was worth it, and the second game could be similar. According to this Reddit thread, the poster claimed that they, and many other players, easily spent over 100 hours playing The Outer Worlds, meaning it cost less than $1 per hour, well worth it according to that person. According to How Long To Complete, the game takes about 13.5 hours to 40 hours, depending on how thorough you are. This is much longer than Call of Duty games (Modern Warfare III came in at 17 hours for completionists), and you’re also going to be getting a focused RPG that is praised for its quality over quantity, reflected in the various awards it has won. Given that The Outer Worlds 2 will be one of the first games with the revised price tag, many players will likely try to find fault with it, such as its length, depth of content, technical performance, and replayability. As a sequel, it will also face the bias that it’s not as good as the original. We mentioned that The Outer Worlds isn’t the longest game out there, it isn’t egregiously short like Call of Duty, and it’s also not huge, like many popular titles. We have no official word about how long the upcoming game will take to complete, but if it takes the same time to complete as the first one, players will certainly think twice before handing over $80. Speaking with Eurogamer recently, Brandon Adler, the director of The Outer Worlds 2, said that the developers did a pretty good job predicting what would draw criticism, notably the small worlds. In the second game, the developers have addressed this by making the worlds about 50% bigger and ensuring there is more stuff at the cool places players travel to. Adler also said that players didn’t think much about the feel of the guns in the first game, so this time, they’ve reworked things to improve how guns feel. The game has also been improved to feel more reactive to character decisions, potentially boosting the replay value. All of this was possible because Obsidian Entertainment had more resources to throw at the game thanks to its partnership with Microsoft, which it didn’t have with the first game. The Outer Worlds 2 will be launching day one on Xbox Game Pass, meaning that if you’re a subscriber, you can play the game without the big $80 upfront price tag, for as long as you have Game Pass. The increase in game prices will likely make Game Pass more appealing to players who simply don’t have the money to throw at games that are this expensive. With that said, there’s a very legitimate fear people have with Game Pass, and that is that it has started fine, but as more people turn to it and away from physical games, the stuff you get for the subscription will get worse and worse. Just look at Netflix. Around 2012, the Standard plan cost $7.99, but nowadays, it costs $17.99, and the Standard with Ads plan costs $7.99 instead. In a decade, if most people have moved to subscriptions, is Microsoft going to start “offering” ads to increase its revenues? In April 2022, Game Pass had 10 million subscribers, and by February 2024, that figure had grown to 34 million. Alternative models and potential solutions As alluded to in the previous section, players can dodge paying $80 for new games by picking up a Game Pass / PlayStation Plus subscription if the game is being offered as part of those subscriptions. Not only do you get to avoid the high price of games you want to play, but you may also use your subscription to try out other games you wouldn’t have otherwise tried. This can be good for developers looking to get their games onto people’s consoles. Many games, including The Outer Worlds 2, are available on Game Pass on the first day they come out, helping players avoid high initial prices. On the flipside, Game Pass subscribers are less likely to buy games, which can hurt developers who do not get as many full-game sales. While the value for money with these subscriptions could decline over time, like Netflix has, in the near term, it’s a viable option for people on a budget to get their hands on $80 games. Xbox Game Pass Standard costs $14.99 per month with access to hundreds of games. To spend $80 on that, you’d need to have been subscribed for over five months, which is plenty of time to complete a game and play several other titles included in your subscription, too. Another approach to dealing with rising development costs could have been to introduce tiered releases of games, such as deluxe editions, or increase the prices of existing higher tiers. By offering players extra features or accompanying merchandise or by raising the prices of existing higher tiers, real fans can self-select to pay a higher price, helping cover development costs. Another interesting option for those who don’t want to pay $80 upfront for a game is titles that fall under the Games as a Service model. These include subscription games or free-to-play games that rely on players buying in-game content. The latter model is already very popular on mobile platforms, and it makes games more accessible to younger players. Some of these games let you buy in-game items to speed up progress, but in many cases, you can get away with paying absolutely nothing. Finally, for those who do not want to subscribe to Game Pass or PlayStation Plus, and also do not want to pay $80 for a single game, there’s always the option to switch to indie games instead, where you can pay a much lower price for titles. Doing this has lots of benefits. First, it exposes you to more games that have potentially implemented new ideas and mechanisms. It helps the developers financially as they have fewer sales than big AAA games. Second, it tells Microsoft and AAA game makers that you’re not going to be spending $80 on one game or not nearly as much, making it more difficult for them to justify the price or continued hikes in the future. Conclusion Unfortunately for players, the constant demand for game improvements has led to increased costs for game studios, necessitating the passing on of costs to players in the form of $80 games. The decision to increase the price of The Outer Worlds 2 has already drawn criticism from gamers, with some finding it ironic that a game critiquing capitalism has been one of the first to put its price up. Outer Worlds 2 faces a unique challenge as one of the first games to be sold for $80. It’s likely to have to absorb the worst of the backlash compared to the titles that come later when people have accepted the price rises. Additionally, Outer Worlds 2 may be a AAA game, but it’s certainly not as popular as Call of Duty or Assassin’s Creed—this could pose a challenge for Obsidian Entertainment. Rising game prices, especially for AAA games, are probably not going away due to the costs associated with developing new tools for making better games and paying increasing wages. While this sucks for consumers, especially those on a budget, there are still options available, including a Game Pass subscription, playing free-to-play games, and buying much cheaper indie games. The increase in gaming prices could even be a good thing for the smaller game studios, as they may be able to attract more customers. This allows these smaller developers to increase revenues to reinvest in their business and grow. More people switching to cheaper indie games, as mentioned earlier, would make it harder for AAA game makers to justify further price rises. The $80 price tag for games is likely here to stay, even if it does discourage players from buying games outright. Not only does it help developers fund the cost of development better, but it also acts as a funnel for Microsoft to get more subscribers on Game Pass. Not only that, but Nintendo has also announced an $80 price tag for some of its games. To be fair to studios working on AAA games, many of the titles people buy today have longer play times compared to games in the past, the graphics are much better, and there tend to be additional play modes. Just look at PS1 and PS2 games, which were largely offline. Compared to consoles that came after, they introduced a multiplayer mode, in addition to the single-player campaign, which does justify a higher price. With the introduction of VR devices and the new gaming experiences they offer, it’s fair to say that game makers are not resting on their laurels and charging the Earth at the same time. Tangible improvements are being made that justify an increased price. I think that we will see game prices for AAA titles continue rising every five years or so, going forward, and a steady increase of people shifting over to subscription services like Game Pass. As we have seen from the backlash to the current price rise, studios will also need to balance how much they’re investing in new games in the first place with how much customers are willing to pay. I think that if games ever jump from $90 to $100 or more, that could create a significant purchasing roadblock in people’s minds, so game makers would need to tread carefully at that point.
    • I love the way liquid glass looks. They just need to tweak certain parts like control center. This is only beta 1.
  • Recent Achievements

    • One Year In
      Wulle earned a badge
      One Year In
    • One Month Later
      Wulle earned a badge
      One Month Later
    • One Month Later
      Simmo3D earned a badge
      One Month Later
    • Week One Done
      Simmo3D earned a badge
      Week One Done
    • One Month Later
      greege earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      549
    2. 2
      ATLien_0
      239
    3. 3
      +FloatingFatMan
      164
    4. 4
      Michael Scrip
      119
    5. 5
      +Edouard
      92
  • Tell a friend

    Love Neowin? Tell a friend!