Re:To prevent hacking, disable Universal Plug and Play now
by mstromb on Tuesday January 29, 2013 @09:04PM
(#5137662)
"Rapid7 strongly recommends disabling UPnP on all external-facing systems," reads a little differently than "disable UPnP now"
Don't expose services to the internet that you're not willing to make public. Duh? What I got from this article is that some devices that people connect to the internet are configured poorly, probably came out of the box like that, and that maybe I should go double check that my router isn't misbehaving. Note that they have lists of vulnerable devices at the end of the paper, which I'll link here.
The discussion of libupnp is kind of terrifying on its own: "There are no less than seven unique buffer overflows in version 1.3.1 of this code." Which sounds pretty bad until you notice that by "this code" they're referring to a single function.
The paper itself is much better than the Ars article, by the way.
Re:To prevent hacking, disable Universal Plug and Play now
by SCdF on Tuesday January 29, 2013 @09:58PM
(#5137789)
I don't think it's that.
They've been fairly vocal in forums and random discussions about how page views are what's most important to them (when people complained about the site redesign the answer was invariably "page views are going up so it must be working").
So I think that's the direction they're heading in. Changing the format of the slug to be shorter and snappier improves page views. Following Kim Dotcom stories, holding reverence for anonymous and being pro-piracy gets them page views.
I do wish them all the best, and they are a business, but I do wish they were more interested in pleasing their '10,000 fans' deeply instead of everyone shallowly, since it's so hard to find that kind of thing these days.
(disclaimer, I used to pay money for Ars until the site design. Now I check it every day but read about a 10th of the articles I used to. Sad times.)
Re:To prevent hacking, disable Universal Plug and Play now
by thedrbrian on Wednesday January 30, 2013 @06:33AM
(#5139026)
On the other hand how many of the smart audience actually click on or buy something through an advert? How many things do you buy on a whim due to a shiney advert? Being on the Internet I am only a quick google away from tens of reviews of practically anything and I'll factor that into a purchase decision more than a neat advert full of marketing fluff.
Re:To prevent hacking, disable Universal Plug and Play now
by hackinthebochs on Wednesday January 30, 2013 @12:50AM
(#5138297)
Yeah I really don't get the alarmism in the article, or in the white paper. Is there any legitimate reason to have UPNP exposed to the internet? If its exposed on a public network, why bother with a buffer overflow when the protocol itself is designed to open whatever ports you want.
If you're concerned and can't merely disable the service, you should scan it from another system with something like Nessus.
Edit: UPnP uses UDP port 1900 and TCP port 2869, so you should be able to add something like the following (untested; assumes WAN interface = vlan1) to the startup script (Administration>Commands), atleast for IPv4 (and unless they clobber additional rules somehow during the course of normal operation):
Don't expose services to the internet that you're not willing to make public. Duh? What I got from this article is that some devices that people connect to the internet are configured poorly, probably came out of the box like that, and that maybe I should go double check that my router isn't misbehaving. Note that they have lists of vulnerable devices at the end of the paper, which I'll link here.
libupnp: https://docs.google.com/spreadsheet/ccc?key=0ApUaRDtAei07dFd...
miniupnp: https://docs.google.com/spreadsheet/ccc?key=0ApUaRDtAei07dDh...
soapapi: https://docs.google.com/spreadsheet/ccc?key=0ApUaRDtAei07dGx...
The discussion of libupnp is kind of terrifying on its own: "There are no less than seven unique buffer overflows in version 1.3.1 of this code." Which sounds pretty bad until you notice that by "this code" they're referring to a single function.
The paper itself is much better than the Ars article, by the way.
Ars Technica has been on a lowest-common-denominator kick as of late. Titles like this get more pageviews.
They've been fairly vocal in forums and random discussions about how page views are what's most important to them (when people complained about the site redesign the answer was invariably "page views are going up so it must be working").
So I think that's the direction they're heading in. Changing the format of the slug to be shorter and snappier improves page views. Following Kim Dotcom stories, holding reverence for anonymous and being pro-piracy gets them page views.
I do wish them all the best, and they are a business, but I do wish they were more interested in pleasing their '10,000 fans' deeply instead of everyone shallowly, since it's so hard to find that kind of thing these days.
(disclaimer, I used to pay money for Ars until the site design. Now I check it every day but read about a 10th of the articles I used to. Sad times.)
A difference of opinion isn't always pandering. (I find those stories pretty interesting actually, and I've been reading them for a long time too.)
I would happily disable UPnP but it would break a ton of stuff including online games etc.
http://svn.dd-wrt.com/ticket/1909
If you're concerned and can't merely disable the service, you should scan it from another system with something like Nessus.
Edit: UPnP uses UDP port 1900 and TCP port 2869, so you should be able to add something like the following (untested; assumes WAN interface = vlan1) to the startup script (Administration>Commands), atleast for IPv4 (and unless they clobber additional rules somehow during the course of normal operation):
iptables -I INPUT 1 -i vlan1 -p tcp --dport 2869 -j DROP
iptables -I INPUT 1 -i vlan1 -p udp --dport 1900 -j DROP
http://www.youtube.com/watch?v=BE-JB078Ax4&list=PL2AD825...
meta key (windows key) + r to open the run dialogue
type in `services.msc`
find "UPnP Device Host"
right click the entry
click "stop"
use the Startup type dropdown menu to select "Disabled"
apply