4 ms·

>It's not a novelty that allowing UDP port 1900 traffic from the Internet to your home printer or such is not a good idea. How would this even be possible? Hom

>It's not a novelty that allowing UDP port 1900 traffic from the Internet to your home printer or such is not a good idea. How would this even be possible? Home routers have to NAT everything. Normally you have to set up reverse NAT to get ports forwarded to the LAN.

detaro 9y ago
The printer is just an example - if you look at the tables with the collected data, the vast majority of devices they found are home routers.
TrickyRick 9y ago
Consider a printer (Or even an external disk) connected via USB to the router. A lot of home routers support sharing said printer over the network and some of those routers probably answer to UPnP requests on the WAN port as well.
dom0 9y ago
IPv6 (now you really need a real, properly configured firewall instead of NATting and praying)
- oh_sigh 9y ago
  Of course you can NAT with ipv6. There is a private address space in ipv6(fc00::/7) like there is in ipv4(192.168.0.0/16,...)
  - mjevans 9y ago
    There is additionally the link-local set of IPv6 addresses fe80::/64
  - croon 9y ago
    I don't think the issue was if you can, but if anyone would when they don't have to for lack of address space.
  - sp332 9y ago
    The IETF never really liked NAT, and the IPv6 spec doesn't really support it. http://www.ipv6.com/articles/nat/NAT-Pros-and-Cons.htm http://www.ipv6.com/articles/nat/NAT-Pros-and-Cons.htm
- easytiger 9y ago
  I'm convinced there will be a lot of relearning everythign we already know with IPv6
- laumars 9y ago
  While your point is true in the broader sense, it is worth noting that these were IPv4 addresses.
- deleted 9y ago
  [deleted]
- lima 9y ago
  Much harder to do network scans with IPv6 though.
- lmm 9y ago
  NAT and pray still leaves you screwed under IPv4 these days - attackers know how to bypass NAT-without-filtering. (I don't think firewalls are a good solution in general, but I would agree that they might be the least-bad way to handle crappy embedded/IOT-type devices).
  - ajross 9y ago
    The reflector attack in question cannot bypass a NAT setup in any meaningful way. Yes, there are tricks that make some protocols NAT-inspectable. It's not perfect. But as a default behavior it's proven surprisingly strong. Typical IPv6 deployments are significantly less secure, sadly.
    - lmm 9y ago
      On the other hand the main reason we have UPnP at all is to deal with the need to work around NAT - maybe these vulnerable devices simply wouldn't be running a UPnP stack at all under IPv6.
- api 9y ago
  Even better: fix your damn security. The security standard we use for everything in our network is: if it would be insecure if hooked directly up to the Internet, it is broken. Firewalls encourage poor security by creating a false sense of security and leading to developer and system administrator complacency. IMHO it would be better to get rid of them and let the insecure junk burn. To prevent DDOS exploitation the best would be to have grey hats take the latest exploits and mass-brick exploitable devices. We'd learn our lesson and then we'd have secure devices.
sebcat 9y ago
You don't have to have a router. The apartment building where I live have fiber, with twisted pair to each apartment. DHCP leases from the apartment gives you an external IP. It's possible to hook up a switch and get DHCP leases for multiple devices. I assume there's an upper limit, I've only tried it with two devices. Now, let's say I hook up a printer to a switch in that configuration. Is it smart enough to not respond to UPnP coming from globally routable addresses? This is why ingress filtering is important.
- zAy0LfpBZLC8mAC 9y ago
  > Now, let's say I hook up a printer to a switch in that configuration. Is it smart enough to not respond to UPnP coming from globally routable addresses? WTF? How would it not be utterly idiotic to not respond to UPnP requests from globally routable addresses? Why should it be impossible to print from some machine, just because it has a globally routable address?
  - rsync 9y ago
    "Why should it be impossible to print from some machine, just because it has a globally routable address?" Because it's an Internet. Sure, it's uncommon behavior and not what most people want, but let's not completely give up on the notion of being a peer on the network. The printer serves up (printing) just like a web server serves up web pages. You should be able to run a web server and participate as a peer, globally.
    - zAy0LfpBZLC8mAC 9y ago
      Well, your argument makes perfect sense ... just not as a reply to my rhetorical question ;-)
laumars 9y ago
The same way people run p2p clients like BitTorrent from home, or the nerdier people run home servers with SSH, RDP or HTTP(S) exposed: they just use the port forwarding features available on every single consumer router. Sometimes software / hardware will automatically assign a port forward via uPnP[0] (this is what many P2P clients will do), sometimes it's done manually[1][2][3][4]. The only difference here is the datagram, but routers have adaptive stateful firewalls (else services like FTP would fail despite being TCP) so they can handle the stateless nature of UDP just fine. [0] https://img.raymond.cc/blog/wp-content/uploads/2014/08/utorrent-enable-upnp.png https://img.raymond.cc/blog/wp-content/uploads/2014/08/utorr... [1] https://bt.i.lithium.com/t5/image/serverpage/image-id/27802iBC2C94E14E44AAA8?v=1.0 https://bt.i.lithium.com/t5/image/serverpage/image-id/27802i... [2] https://assets.virginmedia.com/help/assets/images/Port-Forwarding400.jpg https://assets.virginmedia.com/help/assets/images/Port-Forwa... [3] https://i.ytimg.com/vi/VvzFHHDvU8E/maxresdefault.jpg https://i.ytimg.com/vi/VvzFHHDvU8E/maxresdefault.jpg [4] https://advancedhomeserver.files.wordpress.com/2013/11/pf01a.jpg https://advancedhomeserver.files.wordpress.com/2013/11/pf01a...
- nix0n 9y ago
  Would a printer automatically decide to expose itself to the wider Internet in this way?
  - laumars 9y ago
    You're asking questions already covered in the article: https://blog.cloudflare.com/ssdp-100gbps/#openssdpisavulnerability https://blog.cloudflare.com/ssdp-100gbps/#openssdpisavulnera...
azernik 9y ago
"The vulnerable IPs are seem to be mostly unprotected home routers." I interpreted this as routers that themselves have uPnP implementations, probably intended to advertise themselves to clients on the local network, but that listen on all network interfaces by mistake.

detaro 9y ago

The printer is just an example - if you look at the tables with the collected data, the vast majority of devices they found are home routers.

TrickyRick 9y ago

Consider a printer (Or even an external disk) connected via USB to the router. A lot of home routers support sharing said printer over the network and some of those routers probably answer to UPnP requests on the WAN port as well.

dom0 9y ago

IPv6 (now you really need a real, properly configured firewall instead of NATting and praying)

oh_sigh 9y ago
Of course you can NAT with ipv6. There is a private address space in ipv6(fc00::/7) like there is in ipv4(192.168.0.0/16,...)
- mjevans 9y ago
  There is additionally the link-local set of IPv6 addresses fe80::/64
- croon 9y ago
  I don't think the issue was if you can, but if anyone would when they don't have to for lack of address space.
- sp332 9y ago
  The IETF never really liked NAT, and the IPv6 spec doesn't really support it. http://www.ipv6.com/articles/nat/NAT-Pros-and-Cons.htm http://www.ipv6.com/articles/nat/NAT-Pros-and-Cons.htm
easytiger 9y ago
I'm convinced there will be a lot of relearning everythign we already know with IPv6
laumars 9y ago
While your point is true in the broader sense, it is worth noting that these were IPv4 addresses.
deleted 9y ago
[deleted]
lima 9y ago
Much harder to do network scans with IPv6 though.
lmm 9y ago
NAT and pray still leaves you screwed under IPv4 these days - attackers know how to bypass NAT-without-filtering. (I don't think firewalls are a good solution in general, but I would agree that they might be the least-bad way to handle crappy embedded/IOT-type devices).
- ajross 9y ago
  The reflector attack in question cannot bypass a NAT setup in any meaningful way. Yes, there are tricks that make some protocols NAT-inspectable. It's not perfect. But as a default behavior it's proven surprisingly strong. Typical IPv6 deployments are significantly less secure, sadly.
  - lmm 9y ago
    On the other hand the main reason we have UPnP at all is to deal with the need to work around NAT - maybe these vulnerable devices simply wouldn't be running a UPnP stack at all under IPv6.
api 9y ago
Even better: fix your damn security. The security standard we use for everything in our network is: if it would be insecure if hooked directly up to the Internet, it is broken. Firewalls encourage poor security by creating a false sense of security and leading to developer and system administrator complacency. IMHO it would be better to get rid of them and let the insecure junk burn. To prevent DDOS exploitation the best would be to have grey hats take the latest exploits and mass-brick exploitable devices. We'd learn our lesson and then we'd have secure devices.

sebcat 9y ago

You don't have to have a router. The apartment building where I live have fiber, with twisted pair to each apartment. DHCP leases from the apartment gives you an external IP. It's possible to hook up a switch and get DHCP leases for multiple devices. I assume there's an upper limit, I've only tried it with two devices. Now, let's say I hook up a printer to a switch in that configuration. Is it smart enough to not respond to UPnP coming from globally routable addresses? This is why ingress filtering is important.

zAy0LfpBZLC8mAC 9y ago
> Now, let's say I hook up a printer to a switch in that configuration. Is it smart enough to not respond to UPnP coming from globally routable addresses? WTF? How would it not be utterly idiotic to not respond to UPnP requests from globally routable addresses? Why should it be impossible to print from some machine, just because it has a globally routable address?
- rsync 9y ago
  "Why should it be impossible to print from some machine, just because it has a globally routable address?" Because it's an Internet. Sure, it's uncommon behavior and not what most people want, but let's not completely give up on the notion of being a peer on the network. The printer serves up (printing) just like a web server serves up web pages. You should be able to run a web server and participate as a peer, globally.
  - zAy0LfpBZLC8mAC 9y ago
    Well, your argument makes perfect sense ... just not as a reply to my rhetorical question ;-)

laumars 9y ago

The same way people run p2p clients like BitTorrent from home, or the nerdier people run home servers with SSH, RDP or HTTP(S) exposed: they just use the port forwarding features available on every single consumer router. Sometimes software / hardware will automatically assign a port forward via uPnP[0] (this is what many P2P clients will do), sometimes it's done manually[1][2][3][4]. The only difference here is the datagram, but routers have adaptive stateful firewalls (else services like FTP would fail despite being TCP) so they can handle the stateless nature of UDP just fine. [0] https://img.raymond.cc/blog/wp-content/uploads/2014/08/utorrent-enable-upnp.png https://img.raymond.cc/blog/wp-content/uploads/2014/08/utorr... [1] https://bt.i.lithium.com/t5/image/serverpage/image-id/27802iBC2C94E14E44AAA8?v=1.0 https://bt.i.lithium.com/t5/image/serverpage/image-id/27802i... [2] https://assets.virginmedia.com/help/assets/images/Port-Forwarding400.jpg https://assets.virginmedia.com/help/assets/images/Port-Forwa... [3] https://i.ytimg.com/vi/VvzFHHDvU8E/maxresdefault.jpg https://i.ytimg.com/vi/VvzFHHDvU8E/maxresdefault.jpg [4] https://advancedhomeserver.files.wordpress.com/2013/11/pf01a.jpg https://advancedhomeserver.files.wordpress.com/2013/11/pf01a...

nix0n 9y ago
Would a printer automatically decide to expose itself to the wider Internet in this way?
- laumars 9y ago
  You're asking questions already covered in the article: https://blog.cloudflare.com/ssdp-100gbps/#openssdpisavulnerability https://blog.cloudflare.com/ssdp-100gbps/#openssdpisavulnera...

azernik 9y ago

"The vulnerable IPs are seem to be mostly unprotected home routers." I interpreted this as routers that themselves have uPnP implementations, probably intended to advertise themselves to clients on the local network, but that listen on all network interfaces by mistake.