UPnP vulnerabilities - Revision history

SHotes at 13:08, 18 December 2024

2024-12-18T13:08:30Z

← Older revision		Revision as of 13:08, 18 December 2024
Line 1:		Line 1:
	== Summary ==		== Summary ==

	This article is about how UPnP works and what vulnerabilities it has, especially highlightening ~~callstranger~~ and ~~flash attack~~.		This article is about how UPnP works and what vulnerabilities it has, especially highlightening CallStranger, Flash Attack, Mirai Botnet and the UPnP Device Exposure on the Internet by Rapid7.

	== UPnP ==		== UPnP ==
Line 10:		Line 10:
	[[File:UPnP Protocol Stack.png]]<ref name="Protocol Stack"/>		[[File:UPnP Protocol Stack.png]]<ref name="Protocol Stack"/>

	# Addressing <br />As soon as a device is connected to the network, it searches for a DHCP server for an IP address; if none is found, it assigns itself one by means of Auto-IP.<br /><br />		# Addressing <br />As soon as a device is connected to the network, it searches for a DHCP server for an IP address; if none is found, it assigns itself one by means of Auto-IP using ARP to check if assigned IP is available<br /><br />
	# Discovery <br />After an address has been obtained, the device must announce its presence to the network. This is done via a advertisement, which uses HTTPMU on the address 239.255.255.250:1900, with the method NOTIFY, setting the NTS header field to ssdp:alive. In addition, devices can also search specifically for devices or services by means of a discovery request, using the method M-SEARCH. A device responds to a discovery request with an HTTP 200 message.<br /><br />		# Discovery <br />After an address has been obtained, the device must announce its presence to the network. This is done via a advertisement, which uses HTTPMU on the address 239.255.255.250:1900, with the method NOTIFY, setting the NTS header field to ssdp:alive. In addition, devices can also search specifically for devices or services by means of a discovery request, using the method M-SEARCH. A device responds to a discovery request with an HTTP 200 message.<br /><br />
	# Description <br />In the Discovery Response is a Location header field that contains the URL of the UPnP Device Description, which contains merchant-specific information and a list of all services and their service description URLs. The Service Description describes the actions offered by the device, its arguments, status variables and event characteristics. Documents must conform to the UPnP template language, an XML syntax defined by the UPnP Forum.<br /><br />		# Description <br />In the Discovery Response is a Location header field that contains the URL of the UPnP Device Description, which contains merchant-specific information and a list of all services and their service description URLs. The Service Description describes the actions offered by the device, its arguments, status variables and event characteristics. Documents must conform to the UPnP template language, an XML syntax defined by the UPnP Forum.<br /><br />
Line 19:		Line 19:
	== Security in UPnP ==		== Security in UPnP ==
	There are many known vulnerabilities and security risks when talking about the UPnP		There are many known vulnerabilities and security risks when talking about the UPnP
	Standard. On the Common Vulnerability and Exposure (CVE) website ~~130~~ different		Standard. On the Common Vulnerability and Exposure (CVE) website 149 different
	known vulnerabilities with the keyword ~~̈UPnPcan~~ be found. Also, some known state		known vulnerabilities with the keyword ̈UPnP can be found. Also, some known state
	institutions, like the FBI have publicly recommended to disable UPnP in general. The		institutions, like the FBI have publicly recommended to disable UPnP in general. The
	reason, according to the FBI Webpage, is that there are UPnP exploits which allow		reason, according to the FBI Webpage, is that there are UPnP exploits which allow
Line 72:		Line 72:

	[[File:Mirai-botnet-diagram.png]]<ref name="mirai"/>		[[File:Mirai-botnet-diagram.png]]<ref name="mirai"/>

			== UPnP Device Exposure on the Internet ==
			In 2013 a Team from Rapid7 under the direction of H. D. Moore published a large-scale study revealing that over 81 million UPnP devices were accessible from the public internet due to poor configuration. Many devices exposed the Simple Service Discovery Protocol (SSDP) on the WAN interface making it accessible to the internet. These vulnerabilities could be exploited by corresponding functions. Thereby attackers where able to bypass NAT firewalls exposing devices inside the private network.

	== Enhancing UPnP Security ==		== Enhancing UPnP Security ==

NKirnbauer: fixed link

2024-09-25T10:01:21Z

fixed link

← Older revision		Revision as of 10:01, 25 September 2024
Line 88:		Line 88:
	== Courses ==		== Courses ==

	* [[Ausgewählte Kapitel der IT Security]] (2021)		* [[Ausgewählte Kapitel der IT-Security]] (2021)

	== References ==		== References ==

SKominek: /* UPnP */

2024-01-07T16:06:28Z

UPnP

← Older revision		Revision as of 16:06, 7 January 2024
Line 4:		Line 4:

	== UPnP ==		== UPnP ==
			The Universal Plug and Play (UPnP) Device Architecture, formerly known as the DCP Framework, provides a comprehensive set of protocols for seamless communication between controllers, known as control points, and devices within a networked environment. These protocols include essential functions such as device discovery, description, control, event notification, and presentation.
	Universal Plug and Play is a protocol stack of known protocols, which is managed since 2016 by the Open Connectivity Forum, in order to automatically offer services in the network without configuration by the user. These services can range from editing port mappings on a router to switching a heater on/off. In order for a device to be a complete UPnP device it must go through a number of steps.		UPnP is a protocol stack of known protocols, which is managed since 2016 by the Open Connectivity Forum, in order to automatically offer services in the network without configuration by the user. These services can range from editing port mappings on a router to switching a heater on/off. In order for a device to be a complete UPnP device it must go through a number of steps.<ref name="UPnP">https://openconnectivity.org/upnp-specs/
			UPnP-arch-DeviceArchitecture-v2.0-20200417.pdf</ref>

	[[File:UPnP Protocol Stack.png]]<ref name="Protocol Stack"/>		[[File:UPnP Protocol Stack.png]]<ref name="Protocol Stack"/>

SKominek: /* NAT-Port Mapping Protocol (NAT-PMP) */

2024-01-07T16:00:34Z

NAT-Port Mapping Protocol (NAT-PMP)

← Older revision		Revision as of 16:00, 7 January 2024
Line 79:		Line 79:

	=== NAT-Port Mapping Protocol (NAT-PMP) ===		=== NAT-Port Mapping Protocol (NAT-PMP) ===
	Developed by Apple, NAT-PMP is used on Apple devices and some routers. ~~It allows automatic port forwarding~~ on NAT ~~devices~~, ~~aiding in~~ peer-to-peer applications and online gaming.<ref name="NAT-PMP>https://www.rfc-editor.org/info/rfc6886</ref>		Developed by Apple, NAT-PMP is used on Apple devices and some routers. The NAT Port Mapping Protocol empowers client hosts to request the creation of inbound mappings, providing them with enhanced connectivity similar to devices connected directly to the open public Internet, thereby facilitating their accessibility to peers on the web. The client sends a request to the NAT device to create a port mapping, and the NAT device responds with the external IP address and port that can be used to access the internal device or service from the Internet. NAT-PMP is primarily used for peer-to-peer applications and online gaming on Apple devices and uses UDP messages to communicate between the client device and the NAT device. It simplifies the process of setting up port forwarding by automating the configuration on the NAT device.<ref name="NAT-PMP>https://www.rfc-editor.org/info/rfc6886</ref>

	=== Port Control Protocol (PCP) ===		=== Port Control Protocol (PCP) ===

SKominek: /* Port Control Protocol (PCP) */

2024-01-07T15:59:10Z

Port Control Protocol (PCP)

← Older revision		Revision as of 15:59, 7 January 2024
Line 82:		Line 82:

	=== Port Control Protocol (PCP) ===		=== Port Control Protocol (PCP) ===
	The IETF-standardized PCP is a versatile protocol supporting dynamic port allocation and management of multiple external IP addresses. It's a general-purpose protocol for various applications requiring port mapping and NAT traversal.<ref name="PCP">https://www.rfc-editor.org/info/rfc6887</ref>		The IETF-standardized PCP is a versatile protocol supporting dynamic port allocation and management of multiple external IP addresses. It's a general-purpose protocol for various applications requiring port mapping and NAT traversal.PCP allows applications to establish mappings from external IP addresses, protocols, and ports to internal counterparts, which are essential for successful inbound
			communications to devices behind NAT or firewalls. Eventhough PCP creates these mappings, it doesn’t handle the communication of IP addresses, protocols, and ports to remote computers, which remains application-specific. PCP also assists in reducing the need for frequent NAT keepalive messages sent by many NAT-friendly applications, helping to conserve bandwidth, server traffic, and battery usage on mobile devices. Lastly, PCP discourages the use of Application Layer Gateways (ALGs) within NATs by allowing applications to create their own mappings, thereby facilitating protocol evolution.<ref name="PCP">https://www.rfc-editor.org/info/rfc6887</ref>

	== Courses ==		== Courses ==

SKominek: edited references

2024-01-07T15:55:44Z

edited references

← Older revision		Revision as of 15:55, 7 January 2024
Line 60:		Line 60:
	An example would be adding a port mapping to an external IP to an Internet gateway device to give a malicious actor access to the local network.		An example would be adding a port mapping to an external IP to an Internet gateway device to give a malicious actor access to the local network.

	Adobe Flash's URLRequest method can be exploited in UPnP environments, leading to Flash attacks. These attacks are further exacerbated by Cross-Site Request Forgery (CSRF) vulnerabilities. CSRF exploits can trick a user's browser into executing unwanted actions in a different website where they're logged in. In the context of UPnP, this could lead to unauthorized network changes or device manipulations without the user's knowledge, making CSRF a significant threat in conjunction with Flash-based UPnP attacks.<ref name="CSRF"/>		Adobe Flash's URLRequest method can be exploited in UPnP environments, leading to Flash attacks. These attacks are further exacerbated by Cross-Site Request Forgery (CSRF) vulnerabilities. CSRF exploits can trick a user's browser into executing unwanted actions in a different website where they're logged in. In the context of UPnP, this could lead to unauthorized network changes or device manipulations without the user's knowledge, making CSRF a significant threat in conjunction with Flash-based UPnP attacks.<ref name="CSRF">https://owasp.org/www-community/attacks/csrf</ref>

	[[File:CSRF-Attack.png\|700px]]<ref name="CSRF-img"/>		[[File:CSRF-Attack.png\|700px]]<ref name="CSRF-img">https://www.okta.com/au/identity-101/csrf-attack/</ref>

	== Mirai Botnet ==		== Mirai Botnet ==
Line 79:		Line 79:

	=== NAT-Port Mapping Protocol (NAT-PMP) ===		=== NAT-Port Mapping Protocol (NAT-PMP) ===
	Developed by Apple, NAT-PMP is used on Apple devices and some routers. It allows automatic port forwarding on NAT devices, aiding in peer-to-peer applications and online gaming.<ref name="NAT-PMP"/>		Developed by Apple, NAT-PMP is used on Apple devices and some routers. It allows automatic port forwarding on NAT devices, aiding in peer-to-peer applications and online gaming.<ref name="NAT-PMP>https://www.rfc-editor.org/info/rfc6886</ref>

	=== Port Control Protocol (PCP) ===		=== Port Control Protocol (PCP) ===
	The IETF-standardized PCP is a versatile protocol supporting dynamic port allocation and management of multiple external IP addresses. It's a general-purpose protocol for various applications requiring port mapping and NAT traversal.<ref name="PCP"/>		The IETF-standardized PCP is a versatile protocol supporting dynamic port allocation and management of multiple external IP addresses. It's a general-purpose protocol for various applications requiring port mapping and NAT traversal.<ref name="PCP">https://www.rfc-editor.org/info/rfc6887</ref>

	== Courses ==		== Courses ==
Line 100:		Line 100:
	* An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020		* An Overview of UPnP-based IoT Security: Threats, Vulnerabilities, and Prospective Solutions; Golam Kayas, Mahmud Hossain, Jamie Payton, S. M. Riazul Islam; 2020
	* https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp		* https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=upnp
	~~<ref name="CSRF">https://owasp.org/www-community/attacks/csrf</ref>~~
	~~<ref name="NAT-PMP>https://www.rfc-editor.org/info/rfc6886</ref>~~
	~~<ref name="PCP">https://www.rfc-editor.org/info/rfc6887</ref>~~
	<ref name="Protocol Stack">https://de.wikipedia.org/wiki/Universal_Plug_and_Play/</ref>		<ref name="Protocol Stack">https://de.wikipedia.org/wiki/Universal_Plug_and_Play/</ref>
	<ref name="callstranger">https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/</ref>		<ref name="callstranger">https://www.helpnetsecurity.com/2020/06/09/cve-2020-12695/</ref>
	<ref name="mirai">https://www.imperva.com/blog/how-to-identify-a-mirai-style-ddos-attack/</ref>		<ref name="mirai">https://www.imperva.com/blog/how-to-identify-a-mirai-style-ddos-attack/</ref>
	~~<ref name="CSRF-img">https://www.okta.com/au/identity-101/csrf-attack/</ref>~~

SKominek: /* UPnP Flash Attack */

2024-01-07T15:51:45Z

UPnP Flash Attack

← Older revision		Revision as of 15:51, 7 January 2024
Line 62:		Line 62:
	Adobe Flash's URLRequest method can be exploited in UPnP environments, leading to Flash attacks. These attacks are further exacerbated by Cross-Site Request Forgery (CSRF) vulnerabilities. CSRF exploits can trick a user's browser into executing unwanted actions in a different website where they're logged in. In the context of UPnP, this could lead to unauthorized network changes or device manipulations without the user's knowledge, making CSRF a significant threat in conjunction with Flash-based UPnP attacks.<ref name="CSRF"/>		Adobe Flash's URLRequest method can be exploited in UPnP environments, leading to Flash attacks. These attacks are further exacerbated by Cross-Site Request Forgery (CSRF) vulnerabilities. CSRF exploits can trick a user's browser into executing unwanted actions in a different website where they're logged in. In the context of UPnP, this could lead to unauthorized network changes or device manipulations without the user's knowledge, making CSRF a significant threat in conjunction with Flash-based UPnP attacks.<ref name="CSRF"/>

	[[File:CSRF-Attack.png\|~~500px~~]]<ref name="CSRF-img"/>		[[File:CSRF-Attack.png\|700px]]<ref name="CSRF-img"/>

	== Mirai Botnet ==		== Mirai Botnet ==

SKominek: /* UPnP Flash Attack */

2024-01-07T15:51:33Z

UPnP Flash Attack

← Older revision		Revision as of 15:51, 7 January 2024
Line 62:		Line 62:
	Adobe Flash's URLRequest method can be exploited in UPnP environments, leading to Flash attacks. These attacks are further exacerbated by Cross-Site Request Forgery (CSRF) vulnerabilities. CSRF exploits can trick a user's browser into executing unwanted actions in a different website where they're logged in. In the context of UPnP, this could lead to unauthorized network changes or device manipulations without the user's knowledge, making CSRF a significant threat in conjunction with Flash-based UPnP attacks.<ref name="CSRF"/>		Adobe Flash's URLRequest method can be exploited in UPnP environments, leading to Flash attacks. These attacks are further exacerbated by Cross-Site Request Forgery (CSRF) vulnerabilities. CSRF exploits can trick a user's browser into executing unwanted actions in a different website where they're logged in. In the context of UPnP, this could lead to unauthorized network changes or device manipulations without the user's knowledge, making CSRF a significant threat in conjunction with Flash-based UPnP attacks.<ref name="CSRF"/>

	[[File:CSRF-Attack.png\|~~upright=0.5~~]]<ref name="CSRF-img"/>		[[File:CSRF-Attack.png\|500px]]<ref name="CSRF-img"/>

	== Mirai Botnet ==		== Mirai Botnet ==

SKominek: /* UPnP Flash Attack */

2024-01-07T15:51:18Z

UPnP Flash Attack

← Older revision		Revision as of 15:51, 7 January 2024
Line 62:		Line 62:
	Adobe Flash's URLRequest method can be exploited in UPnP environments, leading to Flash attacks. These attacks are further exacerbated by Cross-Site Request Forgery (CSRF) vulnerabilities. CSRF exploits can trick a user's browser into executing unwanted actions in a different website where they're logged in. In the context of UPnP, this could lead to unauthorized network changes or device manipulations without the user's knowledge, making CSRF a significant threat in conjunction with Flash-based UPnP attacks.<ref name="CSRF"/>		Adobe Flash's URLRequest method can be exploited in UPnP environments, leading to Flash attacks. These attacks are further exacerbated by Cross-Site Request Forgery (CSRF) vulnerabilities. CSRF exploits can trick a user's browser into executing unwanted actions in a different website where they're logged in. In the context of UPnP, this could lead to unauthorized network changes or device manipulations without the user's knowledge, making CSRF a significant threat in conjunction with Flash-based UPnP attacks.<ref name="CSRF"/>

	[[File:CSRF-Attack.png\|~~300px~~]]<ref name="CSRF-img"/>		[[File:CSRF-Attack.png\|upright=0.5]]<ref name="CSRF-img"/>

	== Mirai Botnet ==		== Mirai Botnet ==

SKominek: /* UPnP Flash Attack */

2024-01-07T15:50:51Z

UPnP Flash Attack

← Older revision		Revision as of 15:50, 7 January 2024
Line 62:		Line 62:
	Adobe Flash's URLRequest method can be exploited in UPnP environments, leading to Flash attacks. These attacks are further exacerbated by Cross-Site Request Forgery (CSRF) vulnerabilities. CSRF exploits can trick a user's browser into executing unwanted actions in a different website where they're logged in. In the context of UPnP, this could lead to unauthorized network changes or device manipulations without the user's knowledge, making CSRF a significant threat in conjunction with Flash-based UPnP attacks.<ref name="CSRF"/>		Adobe Flash's URLRequest method can be exploited in UPnP environments, leading to Flash attacks. These attacks are further exacerbated by Cross-Site Request Forgery (CSRF) vulnerabilities. CSRF exploits can trick a user's browser into executing unwanted actions in a different website where they're logged in. In the context of UPnP, this could lead to unauthorized network changes or device manipulations without the user's knowledge, making CSRF a significant threat in conjunction with Flash-based UPnP attacks.<ref name="CSRF"/>

	[[File:CSRF-Attack.png\|~~{300}px~~]]<ref name="CSRF-img"/>		[[File:CSRF-Attack.png\|300px]]<ref name="CSRF-img"/>

	== Mirai Botnet ==		== Mirai Botnet ==