Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
by jacquesm on Wednesday June 28, 2017 @11:09PM
(#14660477)
One of the documented use cases for UPnP is IGD which expressly allows UPnP devices to configure fire wall rules and to set up NAT to map ports to the outside world. So a UPnP device that wishes to expose itself to the outside world is able to do so and this is by design, not by accident. Whether you agree with that or not is another matter.
[ Parent
| on HN ]
Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
by MichaelGG on Wednesday June 28, 2017 @11:36PM
(#14660573)
That doesn't mean the upnp listener needs to listen on the WAN interface.
Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
by CountSessine on Thursday June 29, 2017 @02:23AM
(#14661181)
Agreed - but can there ever be any legitimate use case for an home router to speak IGD over its WAN interface? IGD is typically meant to allow your Xbox on your LAN to set up forwarding rules.
Re:Stupidly Simple DDoS Protocol (SSDP) Generates 100 Gbps DDoS
by duskwuff on Thursday June 29, 2017 @03:28AM
(#14661432)
None. Exposing miniupnpd on a public interface is always a misconfiguration. I'm disappointed that the application even allows it -- it has to know which one is public to set up IP forwarding rules, so it has no excuse.