38

I found port forwarding entries in home router that I haven't manually configured. Is that because of UPnP?

Are applications simply able to tell the router to forward ports on their own? Are there any security implications with enabling UPnP?

Improve this question
7
  • 8
    I don't believe this question is off-topic. True, it might seem as if it's about "about general computing hardware and software", but it's really intrinsically a security question. UPnP and default configurations is an important security aspect in networking and modern routers.
    – Adi
    Jul 9, 2013 at 8:14
  • Sure, there are security aspects to UPnP, but that's not what the question was about. It's like saying a question "how to connect my webapp to a database" is not offtopic because there are security implications.
    – AviD ♦
    Jul 9, 2013 at 8:18
  • 2
    @AviD I completely disagree. Please reread the question (at least the last two lines). The OP isn't at all asking how to do stuff. Revised the question, btw.
    – Adi
    Jul 9, 2013 at 8:22
  • Perhaps the question could be reworked, to focus on the security aspect. As it stands now, though, its not really a security q.
    – AviD ♦
    Jul 9, 2013 at 8:24
  • 2
    @Adnan Thank you for the revision - I think that more accurately expresses what I was asking. With the revision does it still need reworking?
    – Kvass
    Jul 9, 2013 at 14:04

2 Answers 2

Reset to default
44

Many modern home routers usually come with a feature called Universal Plug and Play (UPnP) to allow NAT traversal using the IGD Protocol. What that means is that an application can ask the router "Hey, could you please let external computers speak to me on port xxxx", then the router creates a port map for the requested port.

UPnP has a variety of security problems, the main of which is that it doesn't have any built-in authentication. One example is PoC by Petko D. Petkov where he demonstrated how Flash can be used to send UPnP commands to a local router when visiting a malicious page. UPnP also makes it much easier for malware on your computer to open ports and listen for commands from a C&C Sever.

Despite not being around for a long time, UPnP has a long list of security issues mainly due to poor implementation. Researchers at Rapid7 have shown that nearly 81-million IP addresses have responded to their UPnP requests (mind you, those requests are coming from external networks), and many of these devices had vulnerabilities that can lead to complete takeover.

So my advice is this: If you want port-forwarding, you probably want it for a reason for a specific program, so disable UPnP and map the ports yourself. It's not something you'll be doing everyday.

Improve this answer
8
  • 1
    I think this might warrant its own question, but is there a good way I can see these vulnerabilities for myself? I want to forward a port to a service and then try connecting to my port from the outside (simulating an attempted attack) basically trying to see these vulnerabilities firsthand. I fear most of my understanding of IT security is lacking because I am defending against a boogeyman - I don't know how exactly the attacks work so I'm just relying on what other ppl say I should do in order to protect myself.
    – Kvass
    Jul 9, 2013 at 15:23
  • 1
    @Kvass Well that's a different story. You need to start your own journey of searching for vulnerabilities, reading papers, reading books, and so on.
    – Adi
    Jul 9, 2013 at 15:27
  • 1
    Any good resources you know?
    – Kvass
    Jul 9, 2013 at 15:32
  • 1
    How many of your friends have STUN proxies set up at their house? What if you're over there, or they're over at your place, and want to talk to the grandkids using FaceTime (FaceTime is just one example)? Sure, FaceTime needs specific incoming ports, and NAT in a typical consumer router maps a port to an IP address--to just one specific phone. And don't forget that you have to set up a static DHCP lease for that device. I really feel like the attention needs to be paid to the security of the devices, and that untrusted devices (i.e. IoT) should be kept isolated in their own VLAN.
    – Craig Tullis
    Oct 26, 2016 at 0:24
  • 1
    @Craig I recommend that you check the first few Google results when you search for "STUN NAT". You don't run a "STUN proxy" at your house. That's now how it works.
    – Adi
    Oct 26, 2016 at 13:13
10

Most likely Universal Plug and Play is activated in your router which allows devices to ask for forwarded ports without the need for further router configuration.

Obviously this also implies some security risks.

Improve this answer
5
  • 1
    Can you elaborate on the security risks, other than that people can connect to the services listening on those ports? Are there risks to my machine beyond the scope of those services?
    – Kvass
    Jul 9, 2013 at 14:41
  • Also yes, UPnP was enabled, so I disabled it. I think that was the issue.
    – Kvass
    Jul 9, 2013 at 14:41
  • @Kvass The risks start where programs you don't want to open ports to the outside do so.
    – mkl
    Jul 9, 2013 at 15:09
  • 7
    Wow, that's great, there is a question, one answers, then suddenly the question is completely changed and one's answer looks inappropriate... <sigh>
    – mkl
    Jul 10, 2013 at 7:06
  • 1
    Yeah sorry about that. I upvoted your answer, but the question apparently had to be reworked for it to be acceptable here - I'm still not super familiar with the guidelines for all the different CS areas on Stack Exchange. I actually was unsure about changing the accepted answer, so I had to ask about what I should do here on meta.stackoverflow.com
    – Kvass
    Jul 10, 2013 at 13:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .