4 ms·
> I am actually somewhat skeptical of the security advantages of disabling UPnP for this purpose. The concern is usually that malware on a machine in the local
by cyounkins 5y ago
> I am actually somewhat skeptical of the security advantages of disabling UPnP for this purpose. The concern is usually that malware on a machine in the local network will use UPnP to map inbound ports...
For me the concern is not malware but crappy/insecure software proudly exposing itself on the internet.
Many IP cameras will use UPnP to make their web interface publicly accessible. Because of the long history of opening router ports, seeing a random open port on my public IP was quite surprising. If you haven't recently, check your own public IP in Shodan.io .
The cameras I've used run crappy web interfaces that almost certainly do not get security updates. If an attack was successful on the camera, from there the attacker would have access to my internal network.
- addingnumbers 5y agoOne of the interesting points he makes is that forwarding ports with IGDP is a small part of UPnP's functionality. By equating the two and discarding all of UPnP's other local service discovery features, for fear of IGDP specifically, perhaps we are throwing the baby out with the bathwater.
- tinus_hn 5y agoDisabling upnp on your router does not prevent your devices from using it amongst themselves. The only service advertised by the router is the part you don’t want anyway.
- addingnumbers 5y agoThat's not entirely true, a router with a full PnP stack would listen to and participate in SSDP discover queries, enabling more discoverable services per host. Only one service can listen on port 1900 for DISCOVER queries, but a SSDP-capable router can cache NOTIFY messages from services that can't listen, and reply to queries for them itself with the same record. It's admittedly a weak point to make in the context of consumer gear, though. Last I checked, even router OS's with sprawling functionality like OpenWRT and PFsense don't offer SSDP relaying as a supported feature. If you spent less than $200 on your router, there is probably no difference between disabling all of its UPnP capability and disabling IGDP specifically.
- programmer_dude 5y ago> Shodan.io How do I use this site? Do I have to register?
- slimsag 5y agoIts a search engine, you type your IP into the search bar at the top of the page
- programmer_dude 5y agoThe site already knows my public IP why do I have to enter it? This is sad.
- looperhacks 5y agoWell, checking your own IP isn't exactly its primary use case
- oynqr 5y agoDoes Google pre-fill your search queries?
- catlikesshrimp 5y agoThe google doodle provides information depending on your location and date upon entering the google website. They are stating that they have information about you and that they have information for you. And, yes, they do it proactively. Doesn't that count for you as search results with a query you didn't submit?
- deleted 5y ago[deleted]
- a-dub 5y ago> For me the concern is not malware but crappy/insecure software proudly exposing itself on the internet. my thoughts exactly.
- genewitch 5y agojokes on them, i have CGNAT!
- beermonster 5y agoThey go on to say “ The point is that I would agree that it's a good idea to disable UPnP, but not because of what UPnP does, and not just on your router. Instead, it's a good idea to be very skeptical of UPnP because of defective implementations in many embedded devices, especially routers, but also all of your IoT nonsense.”
- cyounkins 5y agoThey do, but that is referring to the potential for reflected DDoS attacks which is discussed in the previous paragraph. The referenced 'defective implementation' is that of UPnP. In my case, I'm also concerned with the service that is exposed.
- deleted 5y ago[deleted]