Some Older Linksys Routers allow UPnP Configurable from the net


Recommended Posts

Some Older Linksys Routers allow UPnP Configurable from

update the firmware or disable UPnP immediately!

  Quote

Routers from various manufacturers support UPnP (Universal Plug and Play) on their WAN interfaces, which apparently makes it possible for attackers to reconfigure them remotely via the internet and, for example, misuse them as surfing proxies or to infiltrate internal LANs. The problem was discovered by IT security specialist Daniel Garcia, who has developed the Umap tool to demonstrate the problem; the tool is available to download free of charge.

Umap detects UPnP-enabled end devices such as DSL routers and cable modems on the internet by directly retrieving the devices' XML descriptions. The required URLs and ports for some models are hard-coded into the tool. This enables the software to bypass the usual restriction that only allows UPnP to search for compatible hardware via multicast in local networks. Garcia says that entire device series by Edimax, Linksys, Sitecom or Thomson (SpeedTouch) respond to UPnP requests on their WAN interfaces.

Since UPnP isn't designed to include any authentication, the XML description can always be retrieved. Garcia said that, by performing an internet scan, he managed to detect 150,000 potentially vulnerable devices within a short period of time. Once initial contact has been made, the scanner sends such UPnP commands as AddPortMapping or DeletePortMapping to the devices via SOAP requests. LAN devices usually use these commands to access the internet via NAT. However, the devices from the manufacturers in question allow the port to be opened ? and redirected to any other LAN device ? via the WAN interface. Umap attempts to guess the internal IP address that is required to do so.

http://www.h-online.com/security/news/item/UPnP-enabled-routers-allow-attacks-on-LANs-1329727.html

  On 27/08/2011 at 19:43, littleneutrino said:

been disabled for rather some time. :p

Ya but what about the millions of users of Linksys routers that just plug it in and go.

  On 27/08/2011 at 19:46, HawkMan said:

Keeping upnp on because it's convenient, and keeping the firewalls on only computers because there's no reason to not have them on.

And overly sensationalist.

What if you were behind a linksys router, had UPnP and had folder shares setup on your network. Then a guy on the net configures your UPnP to allow folder shares accessible on the net?

  On 27/08/2011 at 19:32, warwagon said:

***WARNING!*** Linksys Routers UPnP is Configurable from the net

disable UPnP immediately!

For some reason this story isn't getting much press. Personally I think this is huge. I had a hard enough time just finding a site that talked about it.

maybe because it's not that big of a deal?

  On 28/08/2011 at 05:07, Ryoken said:

Anyone that has set all their shares to public, is an idiot.

Someone wants to get on my network feel free, you'll get to see that I have shares, but that's it.

The fact a someone on the net can configure your router from the outside and even see your shares should make you feel uneasy. Regardless if they can actually open the shares,

This isn't really a huge deal, because, as it was said before, there are plenty of computers out there not even behind a router. However having your ports open for anyone on the internet isn't a good idea. You could always be caught with a slightly outdated software or exploited with a zero day.

any newb knows not to enable UPnP....</joke>

Joking aside....what a bummer! I mean, I sit behind a netgear router as my primary gateway...a linksys I'm using as a switch...then a linksys I'm using as an access point, with multiple workstations on wifi...even a ps3...and still, don't have to worry about it. Life goes on....(least, for me anyway)

There's probably a large number of people that use Linksys routers with custom firmware. Newer firmware versions have a feature that says "UPnP clients are allowed to add mappings only to their IP". I'd imagine this would protect you from the kind of vulnerability talked about in the article.

Linksys will more than likely fix this in a firmware update. But now many "Average user" upgrade the firmware of their routers?

How many "Average user" also install custom firmware?

So my guess would be we have millions of average users with linksys routers out there that are non the wiser to this issue.

basically what I am getting at is that there are fewer with this issue than you think. Many routers do not enable upnp out of the box....I believe that there are more out there that do not than there are that do. I have run into less than a handful that have had this enabled out of the box. It is the gaming users (xbox, ps3, and possibly the wii users) that have this feature enabled...perhaps being that you have more experiance on the home side than I do in recent years you see different, but I am pretty sure that you have to enable this feature on most or all routers.

  On 29/08/2011 at 20:35, sc302 said:

basically what I am getting at is that there are fewer with this issue than you think. Many routers do not enable upnp out of the box....I believe that there are more out there that do not than there are that do. I have run into less than a handful that have had this enabled out of the box. It is the gaming users (xbox, ps3, and possibly the wii users) that have this feature enabled...perhaps being that you have more experiance on the home side than I do in recent years you see different, but I am pretty sure that you have to enable this feature on most or all routers.

Having to enable it, doesn't that defeat the purpose it was created for? I can see why home user routers would be on by default, and I could also see why business class routers would have it off by default.

  On 29/08/2011 at 20:43, warwagon said:

Having to enable it, doesn't that defeat the purpose it was created for?

how so? disabled for the majority, if you need it you enable it....it is a tick just like wpa is a tick to enable.

  On 29/08/2011 at 20:46, sc302 said:

how so? disabled for the majority, if you need it you enable it.

Ya, but they are Made for the 'Home users" Home users barely know where the address bar is, let alone how to log into their router and enable UPnP :cool:

I don't disagree with. If you need it turned on its a VERY easy thing to do. For the the home user, a not such an east thing to do.

  On 29/08/2011 at 20:48, warwagon said:

Ya, but they are Made for the 'Home users" Home users barely know where the address bar is, let alone how to log into their router and enable UPnP :cool:

very true and that is why you see many routers that have no wireless security and upnp disabled because they kept the defaults.

point being that although it is a flaw, the majority isn't succumed to this flaw being that they don't even know how to get in to it to check it's ip or if it is connected to the internet. the ones who this flaw is subject to are the people who know enough to enable it for whatever reason and should be keeping up on their security and updates.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • XMedia Recode 3.6.1.3 by Razvan Serea XMedia Recode is a free video and audio converter. XMedia Recode supports nearly all audio and video codecs. With XMedia Recode you can easily convert nearly all film and music files in the format you want. Convert for countless devices, select the predefined profile (iPhone, iPad, iPod Touch, Android-Tablets, Sony PSP, Amazon Kindle, Smartphones Blackberry, Wii und DS, Cowon, Android, HTC, Xbox360, Samsung, LG). XMedia Recode converts: 3GP in AVI, 3GP in FLV, AC3 in MP3, AC3 in WAV, ASF in 3GP, ASF in FLV, ASF in MP4, AVI in FLV, AVI in 3GP, FLAC in MP3, FLAC in WMA, FLV in 3GP, FLV in Mp3, DVD in 3GP, DVD in AC3, DVD in AVI, DVD in MP3, DVD in MP4, DVD in MOV, DVD in SVCD, DVD in VCD, DVD in WMV, OGG in MP3, OGG in WMA, MPEG in AVI, MP2 in MP3, MP4 in FLV, MP4 in AVI, M4P in MP3, MOV in 3GP, MOV in AVI, MOV in FLV, WMA in MP3, WMV in FLV, WAV in MP3. Main functions of XMedia Recode: Extracts audio tracks from DVD, Blu-ray and video files Framework also freely selectable color (Padding) Drag-n-drop of video files directly on the encoder Selection display format (1: 1, 3:2, 4:3, 5:4, 5:6, 11:9,16: 9, 16:10, 2.21: 1) Zoom shot (none, type character box, media, Pan Scan, to screen) ''Direct Stream'' copies the audio stream or video stream into the target format 2-Pass-Encoding Volume correction Can change framerate, bit rate, resolution Can extract audio stream of most video formats Produce DVD copies for mobile phones, various mobile devices Edit Video: Color correction Video cut Cropping Denoise Delogo Deblocking De-interlacing Flip Image Start Time End Time Resolution Rotate Image Sepia Sharpness Padding Video fade in / fade out XMedia Recode 3.6.1.3 changelog: Update of ffmpeg AOM AV1 Codec: Added "Quantization" options Update of x264 (3221) Codec Update of the Italian language file Update of the Korean language file Fixed minor bugs Download: XMedia Recode 64-bit | Portable ~20.0 MB (Freeware) Download: XMedia Recode 32-bit | Portable Download: XMedia Recode for Windows XP SP3, Vista | Portable ~10.0 MB View: XMedia Recode Website | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • It's not a joke but I think it is pretty hilarious I was searching Fitch for a credit rating on a fund.   I found what Fitch had to say about the fund including this disclarimer.  LOL "This abstract may have been generated in whole or in part using artificial intelligence and is therefore subject to error and inaccuracy, including but not limited to, hallucination" No link posted for privacy reasons.       
    • Save up to 83% on a lifetime subscription to 1minAI (choose from three plans) by Steven Parker Today's highlighted deal comes via our Apps + Software section of the Neowin Deals store, where for only a limited time, you can save up to 83% on lifetime subscriptions to 1minAI. Whether you're a copywriter, designer, social media manager, podcaster, small business owner, or just someone who needs AI for different uses, 1minAI is for you. Powered by various AI models, 1minAI offers a diverse range of AI features that can surely help you with whatever you need. Chat with numerous assistants, create images, write blog posts, optimize your website, and much more with ease. Plus, it’s always improving with weekly updates that you'll get through the 1minAI Newsletter and Public Roadmap. Powered by various AI models Chat with many assistants Chat with AI for smart and interactive conversations. Get help with all sorts of questions and tasks, making problem-solving and decision-making super easy. Chat with: GPT-4o, GPT-4 Turbo, GPT-4, GPT-3.5 (OpenAI) Claude 3 Opus, Claude 3 Sonnet, Claude 3 Haiku, Claude 2.1, Claude Instant 1.2 (Anthropic) Gemini Pro 1.5, Gemini Pro 1.0 (GoogleAI) Llama 3, Llama 2 (MetaAI) MistralAI Command (Cohere) Comprehensive writing tools Keyword Research Blog Article Generator Rewriter Content Expander Content Shortener Paraphraser Summarizer Grammar Checker LinkedIn Comment X (Twitter) Comment Facebook Comment Brand Voice Generator Advanced image processing and editing capabilities Image Generator Image to Prompt Image Variator Background Replacer Background Remover Text Remover Image Upscaler Search and Replace Image Editor Interact with PDF documents using various AI models Summarize the content of the PDF Translate the text within the PDF Answer questions based on the information in the PDF AI for audio & video editing Audio: Versatile audio editing and processing tools that help you edit, enhance, and manipulate audio files for various purposes. Text to Speech Speech to Text Audio Translator Video: Edit, enhance, and create videos with professional quality 1minAI Pro Plan Includes 4,000,000 credits/month plus the opportunity to generate up to 450,000 additional credits/month for free* All product features All AI features Flagship AI Models Unlimited prompt library Unlimited storage Unlimited brand voice Flexible credit use Monthly credits usage example Generate up to 1,112,500 words per month Research up to 5,933 SEO keywords per month Generate up to 1,186 images per month Upscale up to 741 images per month Remove background up to 74 images per month TTS up to 370,833 characters per month Transcribe audio up to 14,833 seconds per month Generate up to 37 videos per month 20 members Members Management Sharing - Collaboration Good to know Free 15,000 credits when logging in daily, equivalent to 450,000 credits/ month NOTE: Codes are NOT stackable. Length of access: lifetime Redemption deadline: redeem your code within 30 days of purchase Access options: web browser Updates included For example, a lifetime subscription to 1minAI (Business Plan) normally costs $540, but this deal can be yours for just $99.99, a savings of $440. For full terms, specifications, and license info please click the link below. Get the Business Plan lifetime deal for just $99.99, or learn more There are two other plans to choose from at the above link Although priced in U.S. dollars, this deal is available for digital purchase worldwide. We post these because we earn commission on each sale so as not to rely solely on advertising, which many of our readers block. It all helps toward paying staff reporters, servers and hosting costs. Other ways to support Neowin Whitelist Neowin by not blocking our ads Create a free member account to see fewer ads Make a donation to support our day to day running costs Subscribe to Neowin - for $14 a year, or $28 a year for an ad-free experience Disclosure: Neowin benefits from revenue of each sale made through our branded deals site powered by StackCommerce.
    • Be careful what you wish for. Microsoft’s ideas for bells and whistles either brings ads, web views, “AI stuff”, bugs, or all four. I’d be happy if it was just full of performance optimizations and bugfixes.
    • Still needs many more bricks to accurately model that pos. 
  • Recent Achievements

    • Dedicated
      Cole Multipass earned a badge
      Dedicated
    • Week One Done
      Alexander 001 earned a badge
      Week One Done
    • Week One Done
      icecreamconesleeves earned a badge
      Week One Done
    • One Year In
      PAC0 earned a badge
      One Year In
    • One Month Later
      PAC0 earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      564
    2. 2
      +FloatingFatMan
      188
    3. 3
      ATLien_0
      184
    4. 4
      Skyfrog
      113
    5. 5
      Som
      109
  • Tell a friend

    Love Neowin? Tell a friend!