2

I have an Actiontec V1000H router/modem. I have been having virus issues recently so I done a factory reset on all but 1 of the computers on the network. I went to add in a Port Forwarding exception so my son can run a Minecraft server, and the port forwarding rules list had about 50 entries on there. I know in the past when I went in there, there were no rules, but all of a sudden there are something like 50. So I did a factory reset on the router. Within 1 hour, new rules were already added, and less than 24 hrs later there is at least 50 open ports (or ranges of ports). Should this be happening? It seems every device on the network is adding rules to the list. Is this because the virus I had is still coming from the one system that wasn't wiped? It's really wierd though because even my son's IPOD, and my wifes Android phone have added open ports. Should I be concerned? Is there anything you can suggest that would stop this? Please advise. Thanks.

4

If UPnP (Universal Plug 'n' Play) is enabled on the router, these port forwarding rules may have been added in response to UPnP requests from the devices. UPnP is designed to allow devices to make these kind of reconfiguration requests of NAT devices. Particularly services like video games and peer-to-peer file sharing applications use this technology to allow incoming connections from other users.

4

Much like David suggested, it could be UPnP. It will automatically insert rules so your network devices can interact with other LAN devices or specific multicast/unicast destinations, etc.

If not, and it is Telus branded, when was the last time you upgraded your firmware? The Actiontec had a backdoor in it for hardcoded username and password that would allow anyone with access to the login page to gain access. Example, http://support.unblock-us.com/customer/portal/questions/2553873-setting-up-actiontec-v1-hwith-telus-firmware?b_id=530

In short, there are hardcoded credentials that restore when you restart the device:

username: root
password: Thr33scr33n!
0

As it suggested above, it really sounds like it is UPnP.

If you are parano or believe this might be a security threat, you can consider the following : Someone got admin privileges to change the settings of your router. Exploit-db, security focus, and some other website might reveal an exploit for this router. Try not to leave a insecure protocol enabled if you make no use of it (telnet/ftp/old version of ssh).

For instance someone coud try to exploit / brute force / or dictionary attack a telnet access to your router to gain control.

To fix this, as the previous posts suggest :

  • Make sure the firmware is up to date

  • Disable UPnP

  • change and choose a truly RANDOM and secure(long/digits/upper,lower/SpecChar) password for the router admin

If you notice the issue remains... Try an other router (same story, new, up to date, and secure). Monitoring the traffic and looking at debug/verbose network logs might help you identify what is going on. Setting up a nids can help too but............... I thing this is just UPnP, I dunno why I wrote such a long post.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.