Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint Security

// // //
4/13/2018
09:35 AM
Larry Loeb
Larry Loeb
Larry Loeb

Misconfigured Routers Could Be Used for Botnets, Espionage

A recent white paper released by Akamai finds that thousands of misconfigured routers using older UPnP protocols could be turned into malicious botnets or used for espionage.

Universal Plug and Play -- UPnP -- is an older protocol aimed at easing device and service discovery and a way to configure devices and networks. The idea behind it was to let devices on a LAN automatically expose their services and functionality to other devices that were located on the device's local network.

Now, however, the content delivery network Akamai has found it can be used to create proxies that hide the location of the originating traffic.

And that's really useful for malicious botnets, as well as for espionage.

UPnP has been known to be insecure for over a decade. In 2006, problems with how certain implementations handled network segmentation across the WAN -- external Internet -- and LAN were first brought to light. The first toolkit to exploit these showed up around 2011.

(Source: Akamai)
(Source: Akamai)

Akamai was investigating some attacks on its networks when it found that some routers would expose UPnP services that were meant for inter-device discovery through its WAN interface. Researchers later figured out that these routers were misconfigured.

In its white paper, Akamai explained that by using these exposed services, an attacker would be able to inject network address translation (NAT) entries into the remote device, and could expose machines behind the router. In other cases, attackers could inject Internet-routable hosts into the NAT table -- rules that control how IPs and ports from the router's internal network are mapped to the network above it -- which would cause the router to act as a proxy server.

It starts with the Simple Service Discovery Protocol (SSDP) probe response. From the location header, the attacker can communicate with the TCP-enabled UPnP daemon by changing the URL to use a public-facing address.

If the device is vulnerable to injection, a simple SOAP/XML payload can be crafted by the attacker which will inject a malicious NAT entry.

This may allow bypassing of the router's firewall to gain access to the admin interface. A brute force attack may work since no rate limiting or alerting is usually present on the login dialog.


The fundamentals of network security are being redefined -- don't get left in the dark by a DDoS attack! Join us in Austin from May 14-16 at the fifth annual Big Communications Event. There's still time to register and communications service providers get in free!

Akamai found 765,000 -- 16% of the total 4.8 million scanned -- of the devices were confirmed to expose their vulnerable TCP implementations. Over 65,000 -- 9% of vulnerable, 1.3% of total -- of these vulnerable devices were discovered to have active NAT injections. The most-identified IP injected was found over 18.8 million times across 23,286 devices.

The second-most-injected IP showed up over 11 million times across 59,943 devices. A majority of the injections were found to target TCP ports 53 (15.9 million for DNS), 80 (9.5 million for HTTP), and 443 (155,000 for HTTPS)

The actual purpose of this proxy network is unclear. It could be used to avoid censorship. It could also be a way to hide spamming or click fraud. A botnet using this technique could carry out a distributed denial of service (DDoS) attack as well. Whatever the attackers do with it, this flaw allows them to hide the traffic that they cause.

End users will not be able to detect a vulnerability like this on their own. Disabling UPnP to stop future infections may affect the network in areas such as gaming or media streaming.

Akamai gives a list of known affected routers in its posting. There may be more the company has not enumerated. It may well be that the only way out in this case is to replace the affected routers with one that has been hardened. Consumers may not be happy at all to hear that.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-48285
PUBLISHED: 2023-01-29
loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.
CVE-2023-0564
PUBLISHED: 2023-01-29
Weak Password Requirements in GitHub repository froxlor/froxlor prior to 2.0.10.
CVE-2021-4315
PUBLISHED: 2023-01-28
A vulnerability has been found in NYUCCL psiTurk up to 3.2.0 and classified as critical. This vulnerability affects unknown code of the file psiturk/experiment.py. The manipulation of the argument mode leads to improper neutralization of special elements used in a template engine. The exploit has be...
CVE-2023-0562
PUBLISHED: 2023-01-28
A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched re...
CVE-2023-0563
PUBLISHED: 2023-01-28
A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-form.php of the component Assign Locker. The manipulation of the argument ahname leads to cross site scripting. It is possible to initiate the...