Homeland Security: Disable UPnP as tens of millions at risk

Homeland Security: Disable UPnP as tens of millions at risk

Summary: The US government is warning to disable a common networking feature after bugs left tens of millions of hardware devices vulnerable to attacks by hackers and malware.

SHARE:
TOPICS: Security, Networking
89

The US Department of Homeland Security is next in line to warn of a serious threat to networking devices, such as scanners, printers, computers, and routers.

2010-10-15-dhs
(Credit: US Department of Homeland Security)

It comes only a few hours after a white paper was released by security researchers at Rapid7, which claimed that approximately 40 to 50 million devices worldwide are vulnerable to infiltration by hackers as a result of a flaw in a networking protocol.

UPnP, or Universal Plug and Play, allows devices that connect to networks to communicate seamlessly with one another and discover each other's presence. Devices can then connect over a network to share files, print documents, and access other shared resources.

But now, Homeland Security is concerned that the vulnerability could impact millions of machines, and warns users to update their software or disable UPnP altogether.

The trouble is for many, operating system makers--such as Apple and Microsoft--must create hotfixes or patches. The researchers already noted that over 1,500 vendors and 6,900 products identified were vulnerable to at least one of the flaws, including from vendors such as Belkin, D-Link, Linksys, and Netgear. 

"Multiple vulnerabilities have been announced in libupnp, the open source portable SDK for UPnP devices. Libupnp is employed by hundreds of vendors for UPnP-enabled devices," the US Computer Emergency Readiness Team (US-CERT) said in a note published today.

"US-CERT recommends that affected UPnP device vendors and developers obtain and employ libupnp version 1.6.18, which addresses these vulnerabilities."

It is understood from Rapid7's findings that there are numerous bugs with the protocol, which could ultimately put at risk tens of millions of networked devices--especially those connected directly to the Internet.

It then warns to "disable UPnP (if possible)", along with restricting networking protocols and ports, including Simple Service Discovery Protocol (SSDP) and Simple Object Access Protocol (SOPA SOAP) services from untrusted networks, including the Internet.

The risk is that hackers could "execute arbitrary code on the device or cause a denial of service," or in other words: install malware on your computer and/or run it as part of a botnet.

Along with this, hackers could access confidential documents, steal usernames and passwords, take over PCs, and remotely access networked devices, such as webcams, printers, televisions, security systems, and other devices plugged in or wirelessly connected to networks.

Most networking devices use UPnP, including computers running Windows, Apple's OS X, and Linux. Many mobile devices also use UPnP to print to wireless or networked printers.

It's rare for the US government to actively warn to disable software or a feature. That said, it comes only a fortnight after Homeland Security actively warned users to disable Java software as a serious vulnerability was found that could have allowed hackers or malware writers to remotely execute code if a rigged Web site was visited.

Topics: Security, Networking

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Talkback

89 comments
Log in or register to join the discussion
  • Total scare tactic

    How about we just stop accessing the internet at all and crawl under a rock.
    RobertMoore12@...
    • Bis Sis

      How about DHS and the rest of the Obama Brown Shirts get a real job and let the tech world take care of itself.
      danny70000
      • Nice

        Alluding to Nazis in a one sentence comment! You lose. Just like you lost the election.
        quipage
        • Actually, no, you lost. You just don't know it yet.

          And the poster above you is correct about Obama and his henchmen.

          However, I don't know that, relating the UPnP problem is the correct analysis.
          adornoe
          • Obama? Henchmen?

            Boy. You are lost beyond reclaimation.

            You hate your own country and its people. Good for you. Its FOOLS like you that prevent America from being what it could be.

            Hater.
            Cayble
          • Americans, gotta love them

            America may have given the rest of the world the financial crisis but I suppose you atleast you get a good laugh watching them making fools of themselves...
            ZorroZA
          • Financial crisis?

            Fact is that, any country that spends money it doesn't have, creates its own financial crisis, and the U.S. has absolutely nothing to do with the messes in countries such as Greece and Spain and Italy and France and Japan. If anything, too many of those insolvent countries, have become too dependent upon the U.S. to bail them out of the messes they created all by themselves.
            adornoe
          • re: Obama? Henchmen?

            Which is what, precisely? A bigger, badder North Korea or Zimbabwe?
            rocket ride
          • Settle down

            Children, children, get a life and get on topic.....
            Jeez
            michael56555@...
          • Get lost, fool! Speaking one's mind, in defense of his country,

            is not about being childish.
            adornoe
          • North Korea? Zimbabwe? Perhaps, because, the way we're going

            with Obama, that's exactly where we're headed.

            In fact, we might be closer than you think, because, the U.S. is paying its bills with borrowed money and with money we don't have, and it's getting worse by the second.
            adornoe
          • Truth hurts, doesn't int Cayble?

            Fact is that, it's people like me, who know that Obama and his henchmen are destroying this country.

            You are too blind or too ignorant, or both, to understand that.

            It is people like me, who, because we love this country so much, that we aren't afraid to call it as it is.
            adornoe
      • How about know nothing jerk offs like you...

        ...get a life and education and a something somewhat less than REDNECK mindless drivel point of view based on reality as opposed to whatever it is you have been smoking that keeps you in the dark about having some compassion for your fellow countrymen.

        Your insulting remarks are only twice as bad as anything I could ever bring myself to say to the low life likes of you.

        Hater.
        Cayble
        • You...

          ...are quite simply ignorant beyond measure. Educate yourself, about both your adversaries and your world. If you are indeed able.
          JustTruthPhD
          • We are.

            And we can ask the same question of you in return.

            ;)
            HypnoToad72
          • When a question is asked out of ignorance, then, it's a question which

            deserves an answer, in order to educate that person. You need to be educated.

            When a question is asked just for the rhetorical effect of it, then, it's a sure sign that, the questioner is looking to be argumentative without any true value to their question. That still leaves you with a need to get educated.
            adornoe
      • Bis Sis

        You know if you don't like our president you can leave the country and find a place where they cater it idiots like you.
        khallacy@...
        • *My* nation...

          ...is built upon the foundation provided by the U.S. Constitution. It's your ilk who need to go elsewhere if you disagree with our nation's philosophy, which was penned quite eloquently more than 200 years ago. Our nation's philosophy and goals are not going to change. If you'd like to create a country that is radically different than the one provided for by our founding documents, *you* are free to move and start a new nation.
          JustTruthPhD
          • re: *My* Nation...

            They don't really even need to do that much once they've left. There are plenty of nations that are already the kind of place they'd turn this one into. I hear Zimbabwe is nice (for suitable values of "nice") this time of year. Or maybe North Korea.
            rocket ride
          • Which constitution is that?

            The one with the second amendment that reads "well-regulated" in terms of guns?

            The fourth amendment that was trashed by Obama's predecessor?

            What is America's foundation, anyhow? Using cheap and/or slave labor while making brilliant comments such as "a penny saved is a penny earned"? Do tell us more, since your comment isn't very specific, and leads to much possible misinterpretation.
            HypnoToad72