19

In today's world, on equipment that is properly updated to the latest software/firmware, is UPnP still insecure, or have its vulnerabilities been fixed?

  • 3
    Since there is no such thing as 100% security, this question is not well posed. Perhaps you could consider mentioning the vulnerabilities that you have in mind? – Brent Kirkpatrick Mar 29 '16 at 19:08
  • "insecure" is the correct term – schroeder Mar 29 '16 at 19:51
  • 1
    @BrentKirkpatrick the question seems clear that the question is about the known vulnerabilities being fixed – schroeder Mar 29 '16 at 19:55
  • @schroeder It seems clear that the only answer is "no, it is not possible to fix vulnerabilities that are potentially unknown." So the question is not clear. It should be reworded to ask whether known vulnerabilities have been fixed. It is even more clear if the person asks specifically about the vulnerabilities that they want to know about. – Brent Kirkpatrick Mar 29 '16 at 21:50
  • 1
16

Yes, UPnP is by design insecure.

UPnP is a protocol designed to automatically open ports in a firewall to allow an outsider to access a hosted server on a local machine that is protected by said firewall.

UPnP is like mounting a lock on a door and then leaving the key in the keyhole. What's the point of mounting a lock then?

It goes without explanation to say why this is a bad protocol from the beginning, to aid "newbies" who can't even go to 192.168.0.1/192.168.1.1 and forward a simple port if that's required.

UPnP effectively makes the firewall useless. Any trojan could then set up a listening IRC server, RAT server or anything other suspicious and then ask the firewall to open the port for them.

If you have a router which supports UPnP, disable the protocol immediately. I haven't yet stumbled upon a router which does not permit disabling UPnP, so in all routers it should be possible. It might be some ISP locked down router that has customer administration completely disabled, but then you should be able to ask your ISPs customer service to have UPnP disabled.

  • 7
    but it iirc isnt leaving the key on the outside but on the inside because UPNP iirc has to be opened from the inside. – My1 Aug 9 '16 at 9:38
  • 8
    I dislike this answer as uPnP is not a firewall technology, it is a NAT technology. Using your NAT/PAT for security is like using the lift in an apartment building for security. It sort of works, if someone finds the stairs, you are screwed. The aim of UPnP is to make the NAT more transparent. – Aron Sep 7 '16 at 4:33
  • @Aron Yeah, I know that NAT is initially not meant as firewalls, but they serve good as that purpose, and a well done NAT will leave no backdoor, no "stairs" as you say. NAT is already enough transparent, provided that the end user goes into the web interface and opens required ports for required services - like required with a "standard" firewall. If the end user does not know how to do that because the end user is too n00b, then that user shouldn't be near computers to begin with. – sebastian nielsen Sep 7 '16 at 17:01
  • 3
    @sebastiannielsen that is the same kind of thinking that is pushing back on the IPv6 rollout. A properly configured NAT does leave backdoors which many p2p programs exploit, such as Skype. Read up on TCP hole punching. – Aron Sep 8 '16 at 4:38
  • 4
    It's a teensy bit more complex than just user inability to configure port forwarding. If you have, say a family of 3 with iPhones and they want to use a service like Facetime, UPnP or NAT PMP is practically a necessity. Yes, there are products like Skype that work really hard to get around router security and work even with UPnP shut off. The bigger issue is routers that respond and open ports, then never close them, combined with badly designed IoT devices that are insecure by design. Your best bet is to put those IoT devices on a separate VLAN, isolated from your more sensitive devices. – Craig Oct 25 '16 at 19:10
15

Why is/was UPnP insecure anyway?

UPnP's bad name comes from implementation issues found in 2011-2013. It's like saying email is insecure and should be disabled because someone found a common issue in multiple email clients some years ago.

I always disabled UPnP because everyone said so. Now that I looked into it, it turns out to be silly. When UPnP was new, some devices were found to allow configuration from the Internet. Anyone could open any port on it. Since then, router vendors had plenty of time to fix their software. Security is a much bigger thing now than it was in 2011 (that's about the time when the first iPad was released), so vendors are more aware of security issues. For older routers, if they were vulnerable in the first place, a firmware update has probably been released long ago.

What is the purpose of UPnP?

UPnP is a solution to an issue that is created by having too few IP addresses. Because not everyone can have their own, we need to share them. The way we do this is by Network Address Translation (NAT): your consumer router translates between your local network (for example 192.168.x.x) and your public IP address (for example 278.14.1.48). Peer to peer applications such as file sharing, calling or video calling, distributing updates (Windows, Google Play), anonymity networks, resilient mesh networks, etc. all cannot function through NAT, so we have to either disable it for specific applications (using port forwarding), or find workarounds (such as UDP/TCP hole punching, STUN, etc.). The UPnP protocol is what an application uses to tell the router that it would like to disable NAT for an application. It's basically automatic port forwarding.

Not enabling UPnP means we need workarounds instead of being able to have peer to peer communication. Software developers that hope to make a profit off of you will spend money on running servers to keep those workarounds functional for you, but free software often does not have such luxuries and cannot function without either UPnP, or you forwarding the port manually.

Then why are the others saying "Yes, it's insecure by design"?

(Spoiler: they are wrong.)

Because NAT is ubiquitous in IPv4, many people started to rely on it for security: because you cannot reach individual hosts inside the network, vulnerabilities cannot be exploited from the outside, and people started turning off security measures inside their LAN. They neglected doing security updates and opened file shares without passwords (because nobody ever takes their laptop outside their LAN, right?), so now you need a firewall that is outside of your laptop, for example in your router. Combine this with the idea that UPnP can open ports, and you get misinformed answers such as the currently top-voted answer.

Ask yourself: what makes that UPnP request to your router to open a port? It has to be something inside your network. For example, malware could tell the router to open it. How terrible! But wait, if you have malware running on your network, and your laptop is not secure... then you are already screwed right? Yes, indeed.

Malware does not need UPnP to reach your local devices: for it to be able to do UPnP, it already needs to be on your device, or inside your network, so it can reach the internal devices by itself without using UPnP.

Or what if a friend brings their smartphone that is infected with malware? It could tell the router to do UPnP to your other devices and expose them. True enough, but again: the malware is already inside your network and can already reach your local devices directly.

Conclusion

UPnP is fine to enable if your router is not ancient, or if you installed firmware updates for it (or if it was never vulnerable in the first place).

Even if your router is known to be vulnerable (and you either refuse to install the update or the vendor did not release an update), then it's still not an issue if all devices inside your network have their security updates installed. You should be doing that anyway, as every website that you visit can attack local devices through JavaScript in your browser (particularly if the local device can be exploited via blind HTTP requests), and everyone with access to your WiFi (e.g. through password cracking) could hack them as well. Beware: this includes printers, IP cameras, and other embedded computers that are often forgotten.

  • 1
    It’s irrelevant that UPnP as a protocol is safe; the concept is not. UPnP permits devices with serious vulnerabilities to silently expose themselves. The Mirai botnet was built on a hundred thousand IP cameras that had opened their own holes in firewalls using UPnP. Despite your claims, very few IoT devices have the capability to patch their own firmware, and they will remain vulnerable forever. Put another way, if the only fix for a vulnerable device is to throw it away, how many people will actually toss out an otherwise-working $100 camera? Disabling UPnP will protect those networks. – John Deters Dec 7 '18 at 16:49
  • @JohnDeters Yes, if an insecure device opens a port to itself, it will get pwned. So I disable UPnP, now what? Now I will manually port forward to get to its interface, so it still gets pwned. If I take the device outside of my trusted LAN, others can pwn it. If someone brings an untrusted device (friend's smartphone might have malware) into my LAN, my vulnerable device might get pwned. If I visit a malicious website, it might get pwned through JavaScript. There are a million ways this can go wrong that is not UPnP, so just patch the device. – Luc Dec 7 '18 at 17:05
  • The only scenario in which it helps to disable UPnP is if you want to use the device only from inside your LAN, not from the internet, and never take it outside of your LAN. Still, someone could bring malware into your network, but that does not scale as well so the risk is much lower. Most of those IP cameras, though, are specifically meant to be looked at when their owners are not at home. – Luc Dec 7 '18 at 17:07
  • 1
    No, Luc, the inherent insecurity of UPnP is it's lack of authentication/authorization of the configuration. If you manually set up the port forwarding for one known application that needs it, you have an authentic configuration. You're correct that if this known service is vulnerable you've now exposed it, but that's not the point. Rather it's that any arbitrary listening malware that gets installed will be able to do its own router configuration to open itself to the internet. This application is not exploiting an implementation flaw in UPnP but using the protocol exactly as (mis)designed. – ckg Jan 3 at 3:21
  • @ckg "listening malware that gets installed will be able to do" ... anything it wants, with or without upnp. You have malware on your machine, what more would you ask for?! I understand that I'm basically saying "common advice is wrong" and that I'm going against a lot of previously held beliefs, but your argument makes no sense to me. If I have malware, ohmygosh it can do things on the internet? Who'd have thought! – Luc Jan 3 at 8:33
5

I think I should expand a bit and clarify what sebastian nielsen said.

UPnP is as secure as the operating systems of the devices behind the firewall or router NAT/PAT.

If you have a linux, BSD, or unix box behind the router and you have a standard user setup where you do not use root to do any user activities then your chances of running afoul of a trojon capable of using UPnP to compromise your network is low.

If you are running windows or have an android device where you download apps that are not vetted by the Play store then you are very vulnerable.

Most routers have options for directing external ports to internal ports so you can setup a port or a range of ports to talk to the machine where you need a port opened. For security sake it is wise to not open a redirected port in the 0-1024 range as these are common ports that will be a likely target for scanning by hackers.

  • The point is that the protocol UPnP is completely useless. It serve no purpose at all. Basically, if a person can't even go to 192.168.1.1 or 192.168.0.1 and set up a simple port forwarding rule, then that person shouldn't be near computers to begin with. – sebastian nielsen Aug 21 '16 at 12:25
  • 9
    That just isn't true. There are plenty of cases where you have, as just one example, multiple iPhones, iPads or Mac computers on a network and people would like to use Facetime. It's ridiculous to require manual port-forwarding for each device. Protocols like Skype work without UPnP because Skype works really, really hard at getting around your router security any way it can. And when IPv6 becomes ubiquitous, every devices is going to have a direct connection to the net with its own IP address. UPnP isn't the issue. Basic device security is. – Craig Oct 25 '16 at 19:25
  • 6
    David, it simply isn't true that remotely current Windows machines are especially vulnerable to external attack. The real problem on those machines is dumb (or uninformed) users who are susceptible to phishing attacks. On the other hand, most IoT devices are running Linux, and a great many of those are configured in non-secure ways, making them an absolute security nightmare. I don't believe that superlatives and blanket generalizations help the debate. ;-) – Craig Oct 25 '16 at 19:28
2

UPnP just opens connectivity from a device within your network to another outside it, on the device request. So basically the security of that just comes down to if that request was made by a well intended software or a malware.

UPnP isn't the weak point, but the security of the apps installed on the device. Firewalls, manual port forwarding, antivirus and app stores are just workarounds for that, but not the real solution.

The real solution is using software which source code is available to inspect, installed from a software center, and frequently patched for security vulnerabilities. Namely Linux.

-1

It depends on the firewall settings of the device you are worried about getting maliciously accessed from the internet. If that firewall easily allows outgoing long-polling and websockets, then there is no added security in disabling UPnP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.