Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.
Buying anything on Amazon? Please use the Geekzone Amazon aff link.


Guf



4 posts

Wannabe Geek


Topic # 114301 15-Feb-2013 09:22 Send private message

http://watchguardsecuritycenter.com/2013/01/31/h-d-moore-unveils-major-upnp-security-vulnerabilities/

http://www.grc.com/securitynow.htm#389

81 million publically routable IPv4 endpoints have UPnP (which only makes sense LAN-side) open on the WAN side, and worse, most of those have a copy of the reference implementation with next to no security in it, thereby allowing a single UDP packet over 1900 to take over the router.

XNet's previously recommended hardware is among those affected, in particular the WAG310G, which also looks like it might also have it's admin portal open WAN-side too!

Various honeypot machines are seeing a daily increase in probes against this port - the threat is very real and definitely increasing!

Use the ShieldsUp service at grc.com ( https://www.grc.com/x/ne.dll?bh0bkyd2 ) to check if you are vulnerable, as it has a specific test for this.

If you are, join in the pressure to get XNet to block UDP:1900 as it is very unlikely the router makers are going to move fast on this as it'd involve admitting liability.

And should they release an update, how many affected customers would actually be able to successfully apply a firmware update - how many would just call it too hard..?


Filter this topic showing only the reply marked as answer Create new topic
20193 posts

Uber Geek
+1 received by user: 1760

Moderator
Trusted
Biddle Corp
Subscriber

  Reply # 762838 15-Feb-2013 10:00 Send private message

If you have a voice device from WxC that's auto provisioned any firmware updates can be applied automatically by them.

The big question is whether Cisco / Linksys will release an update..

Guf



4 posts

Wannabe Geek


  Reply # 762850 15-Feb-2013 10:19 Send private message

IIRC I purchased this hardware in a shop, as it was the recommended option, but I'm not certain of that.

In that case, it having WAN-side admin portal open makes some sense tho.

Specifically, FTP, HTTP and HTTPS are wide open on it, along with UCP:1900 and also the TCP port that it says to connect to for the UPnP SOAP interface; even tho the UPnP query response puts that against the internal IP it's open externally, and all this while the UI's checkbox for UPnP is set to Disabled!

Guf



4 posts

Wannabe Geek


Reply # 772414 1-Mar-2013 18:09 Send private message

I have discovered that if I set up my router to DHCP a certain range but have a DMZ IP outside that range (i.e. a black hole DMZ), the UPnP port is no longer accessible, thus meaning my router is no longer vulnerable to the flaw it has.

I have also reconsidered my request to block UDP1900 at the ISP, as I have remembered that it is not a service port (0-1024) and thus not solely used for UPnP.

I strongly suggest that if you have a vulnerable router, such as the WAG310G, recommend to all users of those to do as I have done.  To find out, visit grc.com and use the Shields Up service there as it has a specific test for this.


Filter this topic showing only the reply marked as answer Create new topic




Twitter »
Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





Trending now »

Hot discussions in our forums right now:

Do I have the right to return this?
Created by corksta, last reply by KiwiNZ on 20-Dec-2014 20:38 (38 replies)
Pages... 2 3


Police Camera Van Disguise
Created by Reanalyse, last reply by TLD on 20-Dec-2014 17:40 (54 replies)
Pages... 2 3 4


Has Spark (Telecom) locked their iphone 6 ?
Created by anewguy2014, last reply by michaelmurfy on 17-Dec-2014 14:32 (25 replies)
Pages... 2


forgot how to unlock a car door
Created by joker97, last reply by joker97 on 19-Dec-2014 19:10 (49 replies)
Pages... 2 3 4


In defence of cats
Created by Rikkitic, last reply by DarthKermit on 17-Dec-2014 15:40 (68 replies)
Pages... 3 4 5


Slaughter of Innocents
Created by networkn, last reply by networkn on 19-Dec-2014 17:46 (64 replies)
Pages... 3 4 5


Can someone explain Chromecast to me
Created by Rikkitic, last reply by Reanalyse on 20-Dec-2014 21:06 (18 replies)
Pages... 2


Spray Foam Insulation
Created by AACTech, last reply by timbosan on 19-Dec-2014 16:58 (36 replies)
Pages... 2 3



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.

Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.