Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I found port forwarding entries in home router that I haven't manually configured. Is that because of UPnP?

Are applications simply able to tell the router to forward ports on their own? Are there any security implications with enabling UPnP?

share|improve this question
2  
I don't believe this question is off-topic. True, it might seem as if it's about "about general computing hardware and software", but it's really intrinsically a security question. UPnP and default configurations is an important security aspect in networking and modern routers. –  Adnan Jul 9 '13 at 8:14
    
Sure, there are security aspects to UPnP, but that's not what the question was about. It's like saying a question "how to connect my webapp to a database" is not offtopic because there are security implications. –  AviD Jul 9 '13 at 8:18
    
@AviD I completely disagree. Please reread the question (at least the last two lines). The OP isn't at all asking how to do stuff. Revised the question, btw. –  Adnan Jul 9 '13 at 8:22
    
Perhaps the question could be reworked, to focus on the security aspect. As it stands now, though, its not really a security q. –  AviD Jul 9 '13 at 8:24
    
@Adnan Thank you for the revision - I think that more accurately expresses what I was asking. With the revision does it still need reworking? –  Kvass Jul 9 '13 at 14:04
show 1 more comment

2 Answers

up vote 9 down vote accepted

Many modern home routers usually come with a feature called Universal Plug and Play (UPnP) to allow NAT traversal using the IGD Protocol. What that means is that an application can ask the router "Hey, could you please let external computers speak to me on port xxxx", then the router creates a port map for the requested port.

UPnP has a variety of security problems, the main of which is that it doesn't have any built-in authentication. One example is PoC by Petko D. Petkov where he demonstrated how Flash can be used to send UPnP commands to a local router when visiting a malicious page. UPnP also makes it much easier for malware on your computer to open ports and listen for commands from a C&C Sever.

Despite not being around for a long time, UPnP has a long list of security issues mainly due to poor implementation. Researchers at Rapid7 have shown that nearly 81-million IP addresses have responded to their UPnP requests (mind you, those requests are coming from external networks), and many of these devices had vulnerabilities that can lead to complete takeover.

So my advice is this: If you want port-forwarding, you probably want it for a reason for a specific program, so disable UPnP and map the ports yourself. It's not something you'll be doing everyday.

share|improve this answer
1  
I think this might warrant its own question, but is there a good way I can see these vulnerabilities for myself? I want to forward a port to a service and then try connecting to my port from the outside (simulating an attempted attack) basically trying to see these vulnerabilities firsthand. I fear most of my understanding of IT security is lacking because I am defending against a boogeyman - I don't know how exactly the attacks work so I'm just relying on what other ppl say I should do in order to protect myself. –  Kvass Jul 9 '13 at 15:23
    
@Kvass Well that's a different story. You need to start your own journey of searching for vulnerabilities, reading papers, reading books, and so on. –  Adnan Jul 9 '13 at 15:27
    
Any good resources you know? –  Kvass Jul 9 '13 at 15:32
add comment

Most likely Universal Plug and Play is activated in your router which allows devices to ask for forwarded ports without the need for further router configuration.

Obviously this also implies some security risks.

share|improve this answer
1  
Can you elaborate on the security risks, other than that people can connect to the services listening on those ports? Are there risks to my machine beyond the scope of those services? –  Kvass Jul 9 '13 at 14:41
    
Also yes, UPnP was enabled, so I disabled it. I think that was the issue. –  Kvass Jul 9 '13 at 14:41
    
@Kvass The risks start where programs you don't want to open ports to the outside do so. –  mkl Jul 9 '13 at 15:09
1  
Wow, that's great, there is a question, one answers, then suddenly the question is completely changed and one's answer looks inappropriate... <sigh> –  mkl Jul 10 '13 at 7:06
1  
Yeah sorry about that. I upvoted your answer, but the question apparently had to be reworked for it to be acceptable here - I'm still not super familiar with the guidelines for all the different CS areas on Stack Exchange. I actually was unsure about changing the accepted answer, so I had to ask about what I should do here on meta.stackoverflow.com –  Kvass Jul 10 '13 at 13:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.