11 ms·

Note that this was a deliberate setup. The safest thing to do for home routers is to kill UPNP, so that random devices on the inside can't open listening ports

Note that this was a deliberate setup. The safest thing to do for home routers is to kill UPNP, so that random devices on the inside can't open listening ports to the outside.

coldpie 10y ago
Hmm, what do you mean by "deliberate setup"? Reading through it, it looks like the behavior any naive user would do while setting up the camera.
- neaden 10y ago
  I think they mean that he didn't take reasonable precautions to prevent it being hacked, but as you said that's because most users won't take those precautions either. The intention was for this to get hacked though.
pawadu 10y ago
Possibly stupid question: How can I verify that upnp is really disabled? (I don't trust my router to do it correctly) edit: https://www.grc.com/su/UPnP-Rejected.htm https://www.grc.com/su/UPnP-Rejected.htm
- tener 10y ago
  Probably sniffing the packets should work. But even if you do that properly there is always a high chance your router will be compromised and you won't be able to fix it. To be extra sure just treat it as such and put a firewall between it and your LAN. That requires time to configure, but may satisfy the paranoid.
  - countingteeth 10y ago
    What? Put a firewall in front of your firewall, because more firewalls is better? How about use a firewall that's not shit to begin with.
    - eximius 10y ago
      Consumer grade gear is universally shit. Low end business gear is universally shit. My comcast business router is absolutely awful. I need to get around to putting it in bridge mode and putting a real router behind it. The best thing it could possibly be for me is a coax to ethernet paperweight.
      - FLUX-YOU 10y ago
        Is it better to just build a home network box for a software defined network: router, firewall, possibly cable modem, etc.?
      - clarry 10y ago
        My home "router" doesn't even have fucking bridge mode. I am mad about it.
        y4mi 10y ago
        not saying its the case for you, but it might be interesting to some: some ISPs don't allow you to enable the bridge mode on the management website of the device. you need to logon to their website with your service account and either open an actual ticket or go through an automated process to "unlock" bridge-mode. its kinda silly but understandable, as you need to have some understanding of networking for this but most people dont have any at all. and incorrectly configured bridge mode kills any chance of internet for consumers.
        zokier 10y ago
        Even so, I'd setup my own router/firewall and handle the ISP supplied device as essentially untrusted. It won't be pretty, but its at least tolerable solution until you can work out a better setup.
        cgvgffyv 10y ago
        Mikrotik. Or EdgeRouter Lite or X. $100, Debian-based, they even sell it with an SFP port. You can install FreeBSD if you like that better.
dr_zoidberg 10y ago
While you're correct that there are ways to prevent this kind of thing happening, how many end consumers will do it? I think it was a valid experiment, he got it out of the box and did a minimal setup to prevent his network from being compromised, but not the "IoT" device per-se, and then just waited on the bait to catch something.
mixedCase 10y ago
>The safest thing to do for home routers is to kill UPNP No no no!!!! This is going about it completely the wrong way and is setting us up for failure come IPv6 (if it's not already a thing for you). We need half-decent security practices not a temporary workaround that requires user intervention. In this case a randomly generated password printed somewhere inside the device's box or on the device itself is enough to stop Mirai and similar dumb botnets.
- nat4ever 10y ago
  Yes. Yes. Yes. An internet that requires devices to be publicly exposed to the entire internet, and directly addressable at all times, is not an internet I want to participate in. You WILL negotiate a firewall, before learning anything about the devices I use. ESPECIALLY if I am prevented from knowing their internals, whether by willful disclosure or unlawful reverse engineering. I control The Spice. I control the universe.
  - deathanatos 10y ago
    I wouldn't/don't mind better research/work into better permission systems for OS's/processes; allowing the user control over what gets exposed to incoming connections and what is allowed to make outgoing connections is fine and good. NAT, and uPnP, is not that. In the case of uPnP: if uPnP was SOP, wouldn't the camera (needing to be "remotely accessible" because the Internet of Crap) just make the requisite uPnP calls, likely making everything accessible? NAT, in particular, is terrible. Trying to explain to a normal user how to establish NAT port-forwarding for devices or applications is a UX nightmare. NAT, in particular, kills off entire classes of protocol design, necessitating hacking around NAT by routing traffic through untrustable third-party servers. NAT is further not a firewall: one anything inside your NAT gets remotely exploited, and everything else is wide open. (And that's at best; depending on the protocol in use, you might not even need remote code execution.) (And uPnP's support in my experience has been utterly pathetic.)
    - nat4ever 10y ago
      Of course, I'm being a little cheeky, but ah, my sentiment of digging a moat around a house with an unlocked door is an idea I'll always keep in my back pocket, and show no hesitation in applying a ridiculous solution to a ridiculous problem. Obscurity and inscrutability certainly will never supplant the Objective Ideological Truth that "Security" tries to be, but it's often useful as a source of leverage when all other leverage would be denied to you. You could never ever claim to endorse obscurity for its own sake during a daily stand-up or a conference call, because people woud rip you to shreds for any number of valid reasons, but when push comes to shove, and you find yourself on the losing side of someone else's moral hazard, being able to throw a smoke screen up, where a brick wall would be preferred, is sometimes all you can do.

Note that this was a deliberate setup. The safest thing to do for home routers is to kill UPNP, so that random devices on the inside can't open listening ports to the outside.

coldpie 10y ago

Hmm, what do you mean by "deliberate setup"? Reading through it, it looks like the behavior any naive user would do while setting up the camera.

neaden 10y ago
I think they mean that he didn't take reasonable precautions to prevent it being hacked, but as you said that's because most users won't take those precautions either. The intention was for this to get hacked though.

pawadu 10y ago

Possibly stupid question: How can I verify that upnp is really disabled? (I don't trust my router to do it correctly) edit: https://www.grc.com/su/UPnP-Rejected.htm https://www.grc.com/su/UPnP-Rejected.htm

tener 10y ago
Probably sniffing the packets should work. But even if you do that properly there is always a high chance your router will be compromised and you won't be able to fix it. To be extra sure just treat it as such and put a firewall between it and your LAN. That requires time to configure, but may satisfy the paranoid.
- countingteeth 10y ago
  What? Put a firewall in front of your firewall, because more firewalls is better? How about use a firewall that's not shit to begin with.
  - eximius 10y ago
    Consumer grade gear is universally shit. Low end business gear is universally shit. My comcast business router is absolutely awful. I need to get around to putting it in bridge mode and putting a real router behind it. The best thing it could possibly be for me is a coax to ethernet paperweight.
    - FLUX-YOU 10y ago
      Is it better to just build a home network box for a software defined network: router, firewall, possibly cable modem, etc.?
    - clarry 10y ago
      My home "router" doesn't even have fucking bridge mode. I am mad about it.
      - y4mi 10y ago
        not saying its the case for you, but it might be interesting to some: some ISPs don't allow you to enable the bridge mode on the management website of the device. you need to logon to their website with your service account and either open an actual ticket or go through an automated process to "unlock" bridge-mode. its kinda silly but understandable, as you need to have some understanding of networking for this but most people dont have any at all. and incorrectly configured bridge mode kills any chance of internet for consumers.
      - zokier 10y ago
        Even so, I'd setup my own router/firewall and handle the ISP supplied device as essentially untrusted. It won't be pretty, but its at least tolerable solution until you can work out a better setup.
      - cgvgffyv 10y ago
        Mikrotik. Or EdgeRouter Lite or X. $100, Debian-based, they even sell it with an SFP port. You can install FreeBSD if you like that better.

dr_zoidberg 10y ago

While you're correct that there are ways to prevent this kind of thing happening, how many end consumers will do it? I think it was a valid experiment, he got it out of the box and did a minimal setup to prevent his network from being compromised, but not the "IoT" device per-se, and then just waited on the bait to catch something.

mixedCase 10y ago

>The safest thing to do for home routers is to kill UPNP No no no!!!! This is going about it completely the wrong way and is setting us up for failure come IPv6 (if it's not already a thing for you). We need half-decent security practices not a temporary workaround that requires user intervention. In this case a randomly generated password printed somewhere inside the device's box or on the device itself is enough to stop Mirai and similar dumb botnets.

nat4ever 10y ago
Yes. Yes. Yes. An internet that requires devices to be publicly exposed to the entire internet, and directly addressable at all times, is not an internet I want to participate in. You WILL negotiate a firewall, before learning anything about the devices I use. ESPECIALLY if I am prevented from knowing their internals, whether by willful disclosure or unlawful reverse engineering. I control The Spice. I control the universe.
- deathanatos 10y ago
  I wouldn't/don't mind better research/work into better permission systems for OS's/processes; allowing the user control over what gets exposed to incoming connections and what is allowed to make outgoing connections is fine and good. NAT, and uPnP, is not that. In the case of uPnP: if uPnP was SOP, wouldn't the camera (needing to be "remotely accessible" because the Internet of Crap) just make the requisite uPnP calls, likely making everything accessible? NAT, in particular, is terrible. Trying to explain to a normal user how to establish NAT port-forwarding for devices or applications is a UX nightmare. NAT, in particular, kills off entire classes of protocol design, necessitating hacking around NAT by routing traffic through untrustable third-party servers. NAT is further not a firewall: one anything inside your NAT gets remotely exploited, and everything else is wide open. (And that's at best; depending on the protocol in use, you might not even need remote code execution.) (And uPnP's support in my experience has been utterly pathetic.)
  - nat4ever 10y ago
    Of course, I'm being a little cheeky, but ah, my sentiment of digging a moat around a house with an unlocked door is an idea I'll always keep in my back pocket, and show no hesitation in applying a ridiculous solution to a ridiculous problem. Obscurity and inscrutability certainly will never supplant the Objective Ideological Truth that "Security" tries to be, but it's often useful as a source of leverage when all other leverage would be denied to you. You could never ever claim to endorse obscurity for its own sake during a daily stand-up or a conference call, because people woud rip you to shreds for any number of valid reasons, but when push comes to shove, and you find yourself on the losing side of someone else's moral hazard, being able to throw a smoke screen up, where a brick wall would be preferred, is sometimes all you can do.