Misconfigured Routers Could Be Used for Botnets, Espionage

Universal Plug and Play -- UPnP -- is an older protocol aimed at easing device and service discovery and a way to configure devices and networks. The idea behind it was to let devices on a LAN automatically expose their services and functionality to other devices that were located on the device's local network.

Now, however, the content delivery network Akamai has found it can be used to create proxies that hide the location of the originating traffic.

And that's really useful for malicious botnets, as well as for espionage.

UPnP has been known to be insecure for over a decade. In 2006, problems with how certain implementations handled network segmentation across the WAN -- external Internet -- and LAN were first brought to light. The first toolkit to exploit these showed up around 2011.

(Source: Akamai)

Akamai was investigating some attacks on its networks when it found that some routers would expose UPnP services that were meant for inter-device discovery through its WAN interface. Researchers later figured out that these routers were misconfigured.

In its white paper, Akamai explained that by using these exposed services, an attacker would be able to inject network address translation (NAT) entries into the remote device, and could expose machines behind the router. In other cases, attackers could inject Internet-routable hosts into the NAT table -- rules that control how IPs and ports from the router's internal network are mapped to the network above it -- which would cause the router to act as a proxy server.

It starts with the Simple Service Discovery Protocol (SSDP) probe response. From the location header, the attacker can communicate with the TCP-enabled UPnP daemon by changing the URL to use a public-facing address.

If the device is vulnerable to injection, a simple SOAP/XML payload can be crafted by the attacker which will inject a malicious NAT entry.

This may allow bypassing of the router's firewall to gain access to the admin interface. A brute force attack may work since no rate limiting or alerting is usually present on the login dialog.

The fundamentals of network security are being redefined -- don't get left in the dark by a DDoS attack! Join us in Austin from May 14-16 at the fifth annual Big Communications Event. There's still time to register and communications service providers get in free!

Akamai found 765,000 -- 16% of the total 4.8 million scanned -- of the devices were confirmed to expose their vulnerable TCP implementations. Over 65,000 -- 9% of vulnerable, 1.3% of total -- of these vulnerable devices were discovered to have active NAT injections. The most-identified IP injected was found over 18.8 million times across 23,286 devices.

The second-most-injected IP showed up over 11 million times across 59,943 devices. A majority of the injections were found to target TCP ports 53 (15.9 million for DNS), 80 (9.5 million for HTTP), and 443 (155,000 for HTTPS)

The actual purpose of this proxy network is unclear. It could be used to avoid censorship. It could also be a way to hide spamming or click fraud. A botnet using this technique could carry out a distributed denial of service (DDoS) attack as well. Whatever the attackers do with it, this flaw allows them to hide the traffic that they cause.

End users will not be able to detect a vulnerability like this on their own. Disabling UPnP to stop future infections may affect the network in areas such as gaming or media streaming.

Akamai gives a list of known affected routers in its posting. There may be more the company has not enumerated. It may well be that the only way out in this case is to replace the affected routers with one that has been hardened. Consumers may not be happy at all to hear that.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.