5

I am facing a serious conundrum (to me at least). Whether or not to disable UPnP on my network. I understand the risk, an infected computer could punch a hole in my firewall, and more infections can follow. I would disable UPnP, but the people who are on my network are not really savvy enough to go to the router IP, and set up a forwarded port so their stuff will work. But they has pretty safe browsing habits. No clicking on weird links, or "You won" buttons. (uBlock has really helped this, except on phones). Antivirus on all Mac/Windows devices, android and chromebook everywhere else. I am not always able to do network stuff for lengths of time for a variety of reasons.

So as the title says, just how much of a risk would I be put on this network by leaving UPnP on? (This is not a business network, running servers that connect to the outside world, just a simple network for a few people in a building.

Bonus: I just realized UPnP has been running on my router for at least five years, and nothing has happened yet. I know that nothing in the past does not mean nothing in the future, but I thought I would mention it.

  • "..and nothing has happened yet" - what do you mean by that? do you have any way to determine, when you have been hacked, your network penetrated? or just because network is up you asume? you know, as long as you don't see a doctor, you can believe you are healthy... – rsm Aug 18 '17 at 15:59
2

UPnP's authentication model is, for the most part, "did I get a UPnP packet? yes? cool, I'll do whatever it says". The reason that this is generally considered acceptable (at least in home environments) is that the UPnP server only listens on the internal network, which is considered trusted.

Problems with UPnP arise if your threat model includes an attacker who has access to your network. Many routing devices support a wide range of configuration via UPnP, including DNS settings and routing tables, which may enable man-in-the-middle attacks against your traffic if maliciously configured.

A common place you'll see dangerous UPnP configurations is small hotels and businesses offering free WiFi. The routers are often consumer devices left in their default state, with UPnP enabled, so anyone can configure them because, by business requirement, untrusted people have access to the network.

For the large part it makes sense to just turn UPnP off if you're not expecting to have lots of unknown programs needing dynamic port forwarding. You should also verify that UPnP is actually switched off when you disable it on a settings page; there are numerous cases of consumer routers where the UPnP disable functionality either does not work at all, or only alters the boot config to not launch UPnP on next boot without stopping the existing UPnP daemon.

If you're concerned about UPnP but do require it for administration, find a way to move the UPnP listener onto an administrative VLAN rather than the primary VLAN.

  • Acceptable (at least in home environments). So is it ok to leave UPnP on for a home network? – user173724 Aug 18 '17 at 21:19
  • @user173724 Yes, assuming you trust all devices on that network. – Polynomial Aug 18 '17 at 21:36
0

The risk is totally dependent on your risk appetite and your convinence vs security trade off.

Leaving it open does increase risk, its safer to have it closed, as you have identified. But the convience is lost, which you have also identified. Only you and your client can assess which is more important.

If you want more security definitely turn it off. I always turn it off by default, which is opposite to most manufacturers. If I find someone who needs it, I enable it and explain the risk. I have found many networks, certainly small office ones, work fine without it

  • How big a risk am I looking at? Are UPnP based attacks pretty common? That is the main detail I am looking for. – user173724 Aug 18 '17 at 6:07
  • The problem with that is how likely are the clients to be a target. Yes UPNP attacks can occur, and it's trivial for an attacker to make use of once on the network. But how likely your client will be attacked is dependent on many variables. As I said I would always disable it, or any service, that wasn't known to be needed. – ISMSDEV Aug 18 '17 at 6:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.