UPnP networking flaw puts millions of PCs at risk

[Brink]

Common bugs in networking systems are placing PCs, printers and storage devices at risk, according to security researchers.

According to the security team at Rapid7, technology used worldwide in both routers and standard networking equipment is making it possible for hackers to potentially infiltrate approximately 40 million to 50 million devices worldwide.

The vulnerability lies in the standard known as Universal Plug and Play (UPnP). This standard set of networking protocols allows devices such as PCs, printers and Wi-Fi access points to communicate and discover each other's presence. After discovery, devices can be connected through a network in order to share files, printing capability and the Internet.

Read more at source:
UPnP networking flaw puts millions of PCs at risk | Security & Privacy - CNET News

 

[Phone Man]

Here is a link to a test by Rapid7, the research group that published this article, to see if your router is safe from this exploit.

Universal Plug and Play Check by Rapid7

I'm looking good.



Jim

 

[Layback Bear]

Thanks Brink and Phone Man.

 

[Layback Bear]

It's amazing over 200 viewers and no replies to a serious security problem. Is that a sign everybody is safe or they don't care?

 

[Anak]

Same here, I'm good.

 

[A Guy]

I'm clean. The irony is before I saw this, I D/L the scanner, and it needs Java to run! No Java (and it's vulnerabilities) for me

|MG| ScanNow for UPnP 1.0.0.0 Download

A Guy

 

[COMPUTIAC]

Good to go !

 

[DocBrown]

Mine checked out as safe.

 

[Phone Man]

I'm clean. The irony is before I saw this, I D/L the scanner, and it needs Java to run! No Java (and it's vulnerabilities) for me

|MG| ScanNow for UPnP 1.0.0.0 Download

A Guy

The ScanNow is used to test your internal network to see what devices are vulnerable but if they are behind a Router they should be screened from the Internet and the Router Check makes sure the Router is blocking these requests.

Jim

 

[Dwarf]

Mine's in the clear as well.

 

[Lady Fitzgerald]

I'm clean. The irony is before I saw this, I D/L the scanner, and it needs Java to run! No Java (and it's vulnerabilities) for me

|MG| ScanNow for UPnP 1.0.0.0 Download

A Guy

 

[Anak]

I'm clean. The irony is before I saw this, I D/L the scanner, and it needs Java to run! No Java (and it's vulnerabilities) for me

|MG| ScanNow for UPnP 1.0.0.0 Download

A Guy

As far as I know there are no traces of Java on my machine, and the scanner started and ran okay for me.

Hmmm, maybe I better double check.


As an aside, There is also a scanner at: https://www.grc.com | GRC | ShieldsUp!


>Click on the Proceed Button.
>You may or may not see a Security warning, if you do, click on Continue.
>You should see the dark orange Test Button below his intro to that page.


I'm good with this one also.

Be advised, your IP address will be visible, but only to you and GRC .

Look around there are other tests you can perform: Look under, Freeware; Securities, Utilities.

 

[COMPUTIAC]

Thank's for the ShieldsUp link. I'm good to go also.

 

[Phone Man]

Steve, thanks for the GRC link. I have used his products for years and didn't know he added that quick test on his ShieldsUp page. These test are really important for someone that does not use a router and their system is direct to their modem. In that case he also has his UnPlug n' Pray utility https://www.grc.com/unpnp/unpnp.htm that will stop and disable the UPnP services.

Jim

 

[Slartybart]

My router passes.

Gibson Research noted that Universal Plug and Play was a security risk an longgggggg time ago, based on FBI reports.

I don't know if Steve's Unplug 'n Pray utility is Win7 compatible, but you can manually disable the UPnP Device host in Services if you don't use it. That's what I did, as well as disabling the Server and Windows Connect Now - Config Registrar services.

Bill
edit: I really should refresh before I post. Thanks to all who mentioned GRC. The Shields Up! UPnP test is fairly recent, I visited that page about 6 months ago.

 

[x BlueRobot]

I have Java disabled for all my browsers, and still managed to complete the test with no problems

 

[Phone Man]

My router passes.

Gibson Research noted that Universal Plug and Play was a security risk an longgggggg time ago, based on FBI reports.

I don't know if Steve's Unplug 'n Pray utility is Win7 compatible, but you can manually disable the UPnP Device host in Services if you don't use it. That's what I did, as well as disabling the Server and Windows Connect Now - Config Registrar services.

Bill
edit: I really should refresh before I post. Thanks to all who mentioned GRC. The Shields Up! UPnP test is fairly recent, I visited that page about 6 months ago.

Here is the quote from GRC:

What, exactly, does UnPnP do?
Under Windows XP, the Universal Plug & Play system is supported by two service processes, the "SSDP Discovery Service" (SSDPDS) and the "Universal Plug and Play Device Host" (UPNPDH). Although both services are started upon demand, the SSDP service is started when Windows XP is booted. The SSDPDS service is the Internet server component which opens and exposes Windows XP to the global Internet. The UPNPDH service is only started when needed and its operation is dependent upon SSDPDS.

To disable the Universal Plug & Play system: UnPnP first stops the UPNPDH service if it is running, then disables its future operation. After this is done the SSDPDS service is stopped and also disabled. This shuts down Windows XP's external Internet server to prevent exposure to any presently known or later discovered UPnP vulnerabilities.

To re-enable the Universal Plug & Play system: UnPnP simply reverses the process. The SSDPDS service is set to start on demand, and it is then started. Then, the UPNPDH service is also set to start on demand, but it is not started. With the SSDPDS service running the Windows XP system will have TCP port 5000 open and accepting remote connections and UDP port 1900 listening for inbound datagrams.

UnPnP's actions are completely benign and reversible. There are no known negative side effects caused by disabling the Universal Plug & Play components when they are not needed. They may easily be re-enabled if they are ever needed at any time in the future.

So you can just stop and disable these two services manually as they are the same in Windows 7 and 8.

Jim

 

[Phone Man]

I have Java disabled for all my browsers, and still managed to complete the test with no problems

That is normal. This test does not required Java. The internal test ScanNow is the one that requires Java.

Jim

 

[Anak]

Steve, thanks for the GRC link. I have used his products for years and didn't know he added that quick test on his ShieldsUp page. These test are really important for someone that does not use a router and their system is direct to their modem. In that case he also has his UnPlug n' Pray utility https://www.grc.com/unpnp/unpnp.htm that will stop and disable the UPnP services.

Jim

Your welcome Jim, and so have I.
Every new machine that we get goes through the UnPlug n' Pray utility. I seem to remember one that was called 'Probe my Ports', but I don't see it on his site, might be obsolete.

To answer you and Slartybart about when Gibson may have acted on this, I found a video by a friend of Gibson's, Leo Laport I used to watch him on 'Call for Help' on the satellite network ZDTV until DirecTv took him off.

The video is 1:34:49long and was published January 30, 2013, two days ago, That looks like Gibson on the static display, but when you start to watch it goes to Leo.



My full results of the GRC test, strange though, I didn't get the Security Warning the second time I ran it:

 

[Britton30]

Thank's for the ShieldsUp link. I'm good to go also.

Click proceed as he said, you'll see the router test.

Also I was able to run the first test with no Java too.