I read that [LAN access from remote] to UPnP ports can be an attacker looking for vulnerabilities, and is usually nothing to worry about. However I'm concerned seeing this activity in a log so close to the target machine powering up, considering there were others on the network that were not targeted.

This activity happened before I even logged into the target machine, it makes me suspect the incoming traffic was somehow triggered by it announcing itself to the sender.

[LAN access from remote] from to, Monday, October 30,2017 13:25:21
[LAN access from remote] from to, Monday, October 30,2017 13:25:16
[LAN access from remote] from to, Monday, October 30,2017 13:25:11
[LAN access from remote] from to, Monday, October 30,2017 13:25:06
[DHCP IP: (] to MAC address [munged], Monday, October 30,2017 13:14:52

Maybe there's a perfectly reasonable explanation that doesn't involve the machine being compromised?

PS - Yes, I disabled UPnP on the router after seeing this.

  • Is there something like Chrome browser with opened tab, logged in to router, which stays turned on once you log-out? – Aleksandar Pavić Nov 1 '17 at 13:13
  • This machine came up from a cold boot - I wasn't simply logged out. – PJ7 Nov 1 '17 at 13:27

UPnP allows for portforwards through a NAT (your router does that), such that people from outside your NAT can connect to devices behind the NAT. This is access to the LAN from the internet, but only to a specific port on a specific client.

The thing is: such a port forward would only be created by the NAT after being configured so by a client on the LAN via UPnP. Simply disabling UPnP on the router might not do the trick here, because the forward has been requested from this machine that - as you said - came from a cold boot.

So unless you for example do file sharing or something alike that does need UPnP port forwards (and yes, game installers often are file sharing systems, the battle.net installer for example does peer to peer distribution of updates), you seem to have malware on your machine that requested the port to be opened in the first place.

This is most likely either absolutely fine and what you want (for file sharing to work, but manual port forwards would be better than UPnP) or an already infected machine trying to establish communication with an attacker. The probability that this is an attacker searching for vulnerabilities is almost zero; your sources seem to mix up things.

The IP seems to belong to Ericsson North America Managed Services, what seems to be a wireless ISP of some sort. This doesn’t narrow down the options. If would be best to

  1. Make sure it’s not a program you run willingly, without you knowing that it’s doing this,
  2. sniff the traffic and see what’s going on
  3. Find out what causes the traffic and the open port.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.