To prevent hacking, disable Universal Plug and Play now

Re:To prevent hacking, disable Universal Plug and Play now by jiggy2011 on Tuesday January 29, 2013 @10:36PM (#5137914)

Anyone know if dd-wrt is vulnerable to this?

I would happily disable UPnP but it would break a ton of stuff including online games etc.

[ Parent | on HN ]

Re:To prevent hacking, disable Universal Plug and Play now by vy8vWJlco on Tuesday January 29, 2013 @11:02PM (#5137996)

As of 2 years ago it was, so your's might be depending on the version, and the ticket doesn't look like it went anywhere so it might still be open:

http://svn.dd-wrt.com/ticket/1909

If you're concerned and can't merely disable the service, you should scan it from another system with something like Nessus.

Edit: UPnP uses UDP port 1900 and TCP port 2869, so you should be able to add something like the following (untested; assumes WAN interface = vlan1) to the startup script (Administration>Commands), atleast for IPv4 (and unless they clobber additional rules somehow during the course of normal operation):

iptables -I INPUT 1 -i vlan1 -p tcp --dport 2869 -j DROP

iptables -I INPUT 1 -i vlan1 -p udp --dport 1900 -j DROP

[ Parent | on HN ]