How would an external attacker utilise universal plug and play to bypass a firewall?

Question

I'm wondering what strategies and techniques are used to bypass firewalls which have universal plug and play. I'm aware of security issues regarding UPNP in the past but I've also heard that there are some persistent vulnerabilities with UPNP that have not been patched, presumably because it would negatively effect the usability of UPNP.

In this scenario, I am examining how an Internet of Things embedded device might be insecure despite of being placed behind a home firewall. Assuming the device had FTP enabled and no further controls on it, so that a simple FTP cracking attack would suffice, how would these UPNP firewall bypassing techniques be used to establish an unfiltered connection between the IoT device and said attacker?

Answer 1

UPNP opens ports on the router without user intervention. This means in your example the FTP server would (could) be exposed on the internet by the IoT itself.

This means if there was a vulnerability within the FTP server or poor programming/setup by the IoT company, then an attacker could attempt access just as if you had manually port forwarded the port to the device.

My advise in this example with UPNP is if you do not need it at all, turn it off at the router. If you need UPNP for a device then

• make sure the device is patched with latest firmware
• make sure the device doesn't have default username and password
• make sure (if possible) any services that the device has running are disabled if not being used
• ideally run the IOT devices on a different network to your main home internet (such as phones and laptops) - that way if the device is compromised the hop to other devices on your network is mitigated