Vulnerabilities / Threats
1/29/2013
11:35 AM
50%
50%

Unplug Universal Plug And Play: Security Warning

Tens of millions of devices with UPnP are remotely exploitable, warns Metasploit creator. New tool detects vulnerable devices, which include 6,900 different product versions spanning 1,500 vendors.

More than 23 million Internet-connected devices are vulnerable to being exploited by a single UDP packet, while tens of millions more are at risk of being remotely exploited.

That warning was issued Tuesday by vulnerability management and penetration testing firm Rapid7, which said its researchers spent six months studying how many universal plug and play (UPnP) devices are connected to the Internet -- and what the resulting security implications might be. The full findings have been documented in a 29-page report, "Security Flaws In Universal Plug and Play."

"The results were shocking, to the say the least," according to a blog post from report author HD Moore, chief security officer of Rapid7 and the creator of the open source penetration testing toolkit Metasploit. "Over 80 million unique IPs were identified that responded to UPnP discovery requests from the Internet."

UPnP is a set of standardized protocols and procedures that are designed to make network-connected and wireless devices easy to use. Devices that use the protocol -- which is aimed more at residential users rather than enterprises -- include everything from routers and printers to network-attached storage devices and smart TVs.

[ Despite Oracle's efforts to fix Java-related vulnerabilities, Java Security Work Remains, Bug Hunter Says. ]

Despite its convenience, approximately 45 million of the UPnP-using IP addresses spotted by Rapid7 led to a device that's vulnerable to one of three attacks, which are outlined in the company's report. "All told, we were able to identify over 6,900 product versions that were vulnerable through UPnP. This list encompasses over 1,500 vendors and only took into account devices that exposed the UPnP SOAP service to the Internet, a serious vulnerability in of itself," Moore said.

"We strongly suggest that end users, companies and ISPs take immediate action to identify and disable any Internet-exposed UPnP endpoints in their environments," said Moore. "UPnP is pervasive -- it is enabled by default on many home gateways, nearly all network printers and devices ranging from IP cameras to network storage servers."

To help people spot vulnerable UPnP devices, Rapid7 released ScanNow for Universal Plug and Play. The free scanner for Windows can be used to "identify exposed UPnP endpoints in your network and flag which of those may [be] remotely exploitable through recently discovered vulnerabilities," said Moore. The exploitable vulnerabilities have already been added to the Metasploit open source penetration testing framework.

One of the most likely targets of a UPnP attack would be routers, since attackers could alter the DNS settings to point the device to an attacker-controlled server. At that point, the attacker could use the router to send spam, run a clickjacking scam to profit from false advertising impressions, or even eavesdrop on all traffic being sent through the device.

Interestingly, Moore found that 73% of all discovered Internet-facing UPnP instances were built with one of just four software development kits, and versions of two of those kits -- MiniUPnPd and Portable SDK for UPnP -- contain remotely exploitable vulnerabilities. "In the case of the Portable SDK for UPnP, over 23 million IPs are vulnerable to remote code execution through a single UDP packet," he said.

Some of the exploitable flaws have already been patched in the software development toolkits, such as Portable UPnP SDK version 1.6.18, which was released this week. But even with the SDK fixes, don't expect patches to be released for most of the vulnerable devices. "It will take a long time before each of the application and device vendors incorporate this patch into their products," said Moore. "In most cases, network equipment that is 'no longer shipping' will not be updated at all, exposing these users to remote compromise until UPnP is disabled or the product is swapped for something new."

Indeed, the exploitable flaws spotted in the MiniUPnP SDK were excised from the software more than two years ago. "Yet over 330 products are still using older versions," said Moore.

This isn't the first security warning involving UPnP devices. For example, US-CERT issued a security alert in 2008 after finding that the devices could be exploited via a malicious Flash file, which could be used to infect a victim's system and then take control over any connected device that supports UPnP. In 2001, meanwhile, researchers at eEye warned that vulnerabilities in Microsoft's implementation of UPnP -- later patched -- could be exploited to trigger a buffer overflow and give an attacker access to any default installation of Windows XP.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: just wondering...Thanx
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.