If evil.x can control your router, safeguards or info on your system devices (storage, computers, etc)are irrelevant to the biggest danger… your router becomes capable of being an agent in DOS attacks, anonomous-routing of terrorist net traffic, becoming an apparent server for child-porn, any number of which could put YOU in JAIL, with no way of defending yourself, because you left your system available for evil.x to use for their purposes. If nothing else, you immediately become the suspect in a high level investigation that BEGINS with confiscation of all of your equipment that could have been hooked up to that system(computers, servers, digital cameras…)

I just read of one open source developer who works off his laptop, snagged a discarded laptop from the trash, then when rebuilding that drive while connected to his working laptop he found it contained child porn. His working laptop (not just the drive) was confiscated by the police so forensics could find out if the files had originated from HIS computer, even though he was the one who turn in the complaint… he was unable to maintain his open-source software for several MONTHS until he could get re-imbursed for his system and get another one.

Leaving the router open to flash-uPnP attack is sort of like leaving your keys in your car, with it running, while you go into the bank, which just happens to be held up and then they snag your car for the getaway, running someone over on their way out… now prove you were not part of that robbery and murder.

As long as you can set the router to forward port 10001 to x.x.x.1 and can set the client to listen on port 10001, then it will work just fine when you configure it manually. You just have to make the router and client match. Depending on the application though, it may or may not be easy/possible to configure which port it listens on. I have yet to hear of a router that supports UPnP port-forwarding and not manual port-forwarding (though I’m sure some cheapo model out there touts that as a feature). Also, the number of ports the app uses will directly relate to the annoying factor - it’s not a big deal to forward 1 port for 5 clients, but when each copy wants to use 20 ports it will get really annoying.

Also, port forwarding can be quite bad as well. In some cases you can port forward the router’s own Web interface in which case you are making it public for attackers. Combine that with the fact that some models allow you to reset the admin credentials through UPnP, then you have a real issue. Opening port forwards to your own machine is interesting but as you said might not be valuable.

Exposing your router on the Internet is immense security problem. Changing DNS is also a huge security problem. Some routers even allow you to do more stuff.

I can see that the Flash UPnP attack works as described, but I can’t see how an attacker could leverage it to take over my PC.

The scenario where an attacker changes your DNS server is touted as the worst - it lets him force you into visiting his site (e.g. for browser exploit) via the bad DNS. But he must have *already* been able to dupe you into visiting his site in order to view the SWF in the first place!

As for adding port forwarding rules - big deal. I can see how it would make me vulnerable e.g. if I was running a file server or something. But most home users (i.e. Windows) won’t be running such services themselves, and the out-of-the-box system services (e.g. port 445) will be protected by the host’s own firewall (ICF and maybe others).

I’m happy to be corrected, as always!

Of course, I don’t trust little black boxes; I have an IPtables firewall on a Linux box and use dnsmasq on another Linux box for caching DNS - my router is just shifting packets back and forth. Trusting your network security to a closed-source device seems short-sighted to me.

I see your point. The thing with the Flash UPnP attack is that it is not obvious. This means that even if you get hacked, you won’t see it. Some UPnP settings are not visible from the Web Interface, therefore, we cannot provide with a good explanation on how to detect whether you have been hacked.

I am personally not aware of anyone using the attack vector at the moment. But this does not mean that we should not take care of it or even treated as a serious risk. Maybe, there are already some individual cases but it will take weeks if not months for the real criminals to start taking advantage of it. I wont be surprised if it gets included into MPACK, WebAttacker, or Storm.

What’s the risk on this? I’m a home user with nothing interesting on my machine (apart from some creative pr0n, but what’s the intahwebb without creative pr0n, eh?) and i don’t blaze a trail of downloads and blogs and stuff, so i wouldn’t consider myself “visible” as such - how many cases are you aware of where this has happened?

I see lots of posts regarding problems with the fix but not one post about problems regarding actually suffering from this exploit - is it common ground that will be splashed about as easily as Sub-7 or B.O. or is it something that would require plenty of skill and knowledge and, therefore, just wouldn’t be worth the effort unless the programmer was just broken in the head.

On that note, advertisers using flash banners/ads are surely responsible for the content of them ads as they are distributing them, right?

It’s not our problem guys and unless it starts hitting the net like a plague, whilst i admire your research (the amount of stuff that has gone completely over my head is testament to your dedication and understanding of the situation), this is an exploit that should be addressed by Adobe, should cause concerns for ad-companies and domain providers and we shouldn’t have to concern ourselves with it at all, unless we’re making ourselves a target for this kind of mal-ware.

Cheers for the info though, top work on that

A

There are lots of home routers which can only handle one instance of the same UPNP application if you use the manual port forwarding method.
(And some manufacturers even suggest to put the client pc or console in the DMZ and that also limits it to just one.)

So, with a few kids that have some MSN, some consoles etc, there is not just the burden of doing the manual port forwarding administration once, but you would have to agree to schedule who can play which game or who can MSN etc. at what time and then change the manual port forwarding correspondingly.