5 ms·
I believe UPNP is used commonly by many of the IoT devices that end up in botnets.
by jackweirdy 10y ago
I believe UPNP is used commonly by many of the IoT devices that end up in botnets.
- bradleyjg 10y agoAs I understand it UPNP allows a device to negotiate a port map with a NAT box. But the developer of the IoT device would have to specifically want to map port 22 or 23. It's not something that would happen automatically. So are you saying that these IoT device makers not only hard-coded root usernames and passwords into their devices, but deliberately set up UPnP mappings to those ports? That looks malicious rather than negligent. Am I missing something?
- SteveNuts 10y agoI've heard a lot of routers accidentally or negligently allow upnp on the WAN interface
- bradleyjg 10y agoThat's pretty horrifying but if true it answers my question about how this can affect so many devices. It sounds like whether because they were the directly hacked devices or because of this UPnP flaw, home routers are the main villain here. Not smart lightbulbs and webcams which the news media seemed to want to blame -- though the latter may well have been secondary villains.
- jackweirdy 10y agoYour understanding is the same as mine. I don't think that's necessarily malicious though. I also don't think it would have to be to 22/23 - do we know that SSH or Telnet were the attack vector? Thinking about general IOT devices, even if it were SSH this time it well be a web UI with RCE next time.
- marmot777 10y agoA large number of the devices were manufactured by XiongMai Technologies. Judge for yourself whether the backdoor was put in place intentionally. https://krebsonsecurity.com/2016/10/iot-device-maker-vows-product-recall-legal-action-against-western-accusers/ https://krebsonsecurity.com/2016/10/iot-device-maker-vows-pr...
- profmonocle 10y agoI'm surprised there are UPNP implementations that even allow mapping to specific, low-numbered ports. (Well, not surprised as much as disappointed.)