Akamai: "UPnProxy: Blackhat Proxies via NAT Injections"

[XIII]

According to this Akamai whitepaper many ASUS routers (and many other brands) have a vulnerable UPnP implementation:

https://www.akamai.com/us/en/multim...at-proxies-via-nat-injections-white-paper.pdf

Did they not test the AC86U? Or is that device really not affected?

Did ASUS fix this in a recent firmware update? Or will they? Can they?

 

[RMerlin]

Until proven otherwise, I call BS on their list of vulnerable routers, considering that Asuswrt does not expose UPnP to the WAN, and also that it refuses to forward ports to an IP different from the one that issued the forward request.

 

[ColinTaylor]

This is old news that was discussed months ago.

 

[XIII]

This is old news that was discussed months ago.

Indeed:

https://www.snbforums.com/threads/n...xy-blackhat-proxies-via-nat-injections.46011/

I apologize for bringing it up again. No idea why this appeared in my RSS feed today...

 

[RMerlin]

Indeed:

https://www.snbforums.com/threads/n...xy-blackhat-proxies-via-nat-injections.46011/

I apologize for bringing it up again. No idea why this appeared in my RSS feed today...

I believe that's because it got Slashdotted, for some reason.

 

[Embattle]

I tend to disable UPnP any way, not sure I've had any issues with not having it enabled yet.

 

[sfx2000]

Until proven otherwise, I call BS on their list of vulnerable routers, considering that Asuswrt does not expose UPnP to the WAN, and also that it refuses to forward ports to an IP different from the one that issued the forward request.

One must be careful, as the source IP can be spoofed - I'm seeing the private IP ranges as source recently on my WAN interface - likely looking to explore what might happen...

 

[RMerlin]

One must be careful, as the source IP can be spoofed - I'm seeing the private IP ranges as source recently on my WAN interface - likely looking to explore what might happen...

Would still require UPnP/SSDP to be open to the WAN.

 

[sfx2000]

Would still require UPnP/SSDP to be open to the WAN.

Probably more for other devices other than AsusWRT... Seeing a big spike there on activity on all ports

Still find it interesting that the "cloud" is working on the private IP ranges, along with Link-Local and Multicast from the WAN...