4 ms·
> Universal Plug-n-Play And, like so many other attempts to "simplify" supposedly complex configuration, in addition to being a massive security hole to attack
by commandlinefan 8y ago
> Universal Plug-n-Play
And, like so many other attempts to "simplify" supposedly complex configuration, in addition to being a massive security hole to attackers, it's almost useless to the home users for whom it was meant because it only works under a very narrow, mostly undocumented set of assumptions and if any of those assumptions are invalid, it fails silently.
- nerdponx 8y agoIf I have UPnP disabled, am I safe?
- greglindahl 8y agoThere's no way to be "safe". You might be safer if you disable UPnP, it certainly decreases the attack surface.
- creeble 8y ago> There's no way to be "safe". You're implying that all routers are vulnerable?
- flylikeabanana 8y agoI think the point is that any software system is vulnerable
- creeble 8y agoVulnerable to this particular exploit? Your router is either vulnerable to this exploit, or it's not. Afaict from the article, the exploit relies on a UPnP-enabled router; if UPnP isn't enabled, I don't believe your router is vulnerable.
- kibibu 8y agoNo routers are invulnerable.
- creeble 8y agoTo this exploit?
- creeble 8y agoI'm sorry, I didn't intend to start a nit-pick on whether or not all software contains bugs. My response was too glib. The GP asked: > If I have UPnP disabled, am I safe? The answer is yes: If you can disable UPnP, your router will be safe from this particular exploit. Which is, I think, what he was asking. Everyone should disable UPnP in their routers. It won't make your router "safe" from all exploits, but it will make it safe from this one, and you can do it now, immediately, without replacing hardware or firmware.
- greglindahl 8y agoThanks, my reply wasn't very good either. I suspect most people can disable UPnP without ever noticing a problem. If anything, it is more used by malware than anything you actually want.
- OJFord 8y agoI disabled it after this post, but it appears Plex switches to 'indirect' mode (it goes out to the Internet and back in) without it; i.e. I am using UPnP. It's not clear what the solution is - update firmware? I am on the latest. Use OpenWRT (or whatever it's called these days)? Every time I look into it (I really want to!) I stop at the simple 'I want to do this, I will happily buy a new router, which one do I buy and know it works well and will continue to work well with updates?'
- WorldMaker 8y agoPlex has had a major forum breach for basic user data including IP addresses [1], around the time of the botnet's first discovery in 2017, which has me greatly wondering if Plex may have been an inadvertent bootstrap vector for this attack? Worrying, if that's the case. [1] https://haveibeenpwned.com/PwnedWebsites#Plex https://haveibeenpwned.com/PwnedWebsites#Plex
- OJFord 8y agoUsually a problem for things like Plex, ISPs with double NAT actually do users a favour here.
- WorldMaker 8y agoUPnP wouldn't exist without NAT. The underlying root cause of UPnP is NAT (and the slow deployment of things like reliable mDNS implementations). Admittedly, Plex would have different security problems without NAT, given its model, but arguably those security problems would have simpler solutions in a world without NAT.
- joombaga 8y agoYou can explicitly forward the ports used by Plex.