Comments on: Hacking with UPnP (Universal Plug and Play) http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/ Information Security Think Tank Fri, 21 Nov 2008 20:10:46 +0000 http://wordpress.org/?v=2.6.3 By: LoRdRapTuReZ http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-124299 LoRdRapTuReZ Mon, 10 Nov 2008 02:43:25 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-124299 I have an universal plug and play server gateway. And its protected with the password which was set by pervously guy who work in my company.So, is there any other options that i can reset the server gateway or get the default I have an universal plug and play server gateway. And its protected with the password which was set by pervously guy who work in my company.So, is there any other options that i can reset the server gateway or get the default

]]> By: The Invisible Infection, Revisited | All That's Evil http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-123771 The Invisible Infection, Revisited | All That's Evil Thu, 18 Sep 2008 17:53:58 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-123771 [...] fine folks at GNUcitizen provided much of the information that I’m mentioning here, and they even have some carefully [...] [...] fine folks at GNUcitizen provided much of the information that I’m mentioning here, and they even have some carefully [...]

]]> By: More UPnP Hacking Fun with Google Media Server | GNUCITIZEN http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-122692 More UPnP Hacking Fun with Google Media Server | GNUCITIZEN Fri, 27 Jun 2008 09:31:46 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-122692 [...] our exploration in the fields of UPnP earlier this year with some smoking posts which covered some basic attacks and the advance flash attacks. Today I stumbled across Google Media Server, a desktop gadget which [...] [...] our exploration in the fields of UPnP earlier this year with some smoking posts which covered some basic attacks and the advance flash attacks. Today I stumbled across Google Media Server, a desktop gadget which [...]

]]> By: vino http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-120181 vino Mon, 28 Apr 2008 14:27:39 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-120181 Thats Greatt.., You guys Rock !!!! Thats Greatt.., You guys Rock !!!!

]]> By: Inseguridad en UPnP. » Vida Casi Digital http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-118649 Inseguridad en UPnP. » Vida Casi Digital Fri, 11 Apr 2008 20:11:31 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-118649 [...] Hacking with UPnP (Universal Plug and Play): http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/ [...] [...] Hacking with UPnP (Universal Plug and Play): http://www.gnucitizen.org/blog.....-and-play/ [...]

]]> By: Nick http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-117625 Nick Fri, 28 Mar 2008 07:17:48 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-117625 Alright. So I'm in an interesting situation. A desperate friend convinced me to help him try to get a friend's MSN and Gmail accounts back from a malicious ex-friend. I am now communicating with the malicious ex-friend's router via Flash SOAP requests and I would really like to change this person's DNS servers. Bad I know, but my friend claims her life is getting ruined. I am having trouble finding an API for SOAP communication with routers - specifically a 3COM OfficeConnect. For justice! Alright.

So I’m in an interesting situation. A desperate friend convinced me to help him try to get a friend’s MSN and Gmail accounts back from a malicious ex-friend. I am now communicating with the malicious ex-friend’s router via Flash SOAP requests and I would really like to change this person’s DNS servers. Bad I know, but my friend claims her life is getting ruined. I am having trouble finding an API for SOAP communication with routers - specifically a 3COM OfficeConnect.

For justice!

]]> By: WiFi Ownage | GNUCITIZEN http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-111214 WiFi Ownage | GNUCITIZEN Thu, 07 Feb 2008 11:00:18 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-111214 [...] router and changed the primary DNS server through many of the available methods in the wild, like UPnP hacking, [...] [...] router and changed the primary DNS server through many of the available methods in the wild, like UPnP hacking, [...]

]]> By: UPnP: The Saga Continues | GNUCITIZEN http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-101848 UPnP: The Saga Continues | GNUCITIZEN Sun, 20 Jan 2008 20:35:33 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-101848 [...] already covered what UPnP is and how it works in most basic form. We’ve also showed how it can be exploited [...] [...] already covered what UPnP is and how it works in most basic form. We’ve also showed how it can be exploited [...]

]]> By: And Go it Does: CSRF « Reasons to Fear the Matrix http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-101034 And Go it Does: CSRF « Reasons to Fear the Matrix Fri, 18 Jan 2008 20:16:30 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-101034 [...] a side note, the security issues raised by GnuCitizen about the use of UPnP (Universal Plug and Play) are quite more interesting. Of course, you have to be on the local [...] [...] a side note, the security issues raised by GnuCitizen about the use of UPnP (Universal Plug and Play) are quite more interesting. Of course, you have to be on the local [...]

]]> By: Pericoloso bug per Flash e Excel :: News Orebla.it http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-100205 Pericoloso bug per Flash e Excel :: News Orebla.it Wed, 16 Jan 2008 13:26:26 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-100205 [...] pubblicato dai due ricercatori (vedi articolo) si evince come il problema non sia localizzato in una mancanza di validazione da parte di Apple [...] [...] pubblicato dai due ricercatori (vedi articolo) si evince come il problema non sia localizzato in una mancanza di validazione da parte di Apple [...]

]]> By: סדקים » בעית האבטחה שמאיימת על ×›-ו-ל-ם http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-99908 סדקים » בעית האבטחה שמאיימת על ×›-ו-ל-ם Tue, 15 Jan 2008 18:32:04 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-99908 [...] כדי לזרז את הטיפול בנושא. בחודש האחרון הם חקרו ופרסמו מספר מאמרים העוסקים בנושא ×›×”×›× ×” לגילוי. הצמד גילה שניתן ליצור קבצי [...] [...] כדי לזרז את הטיפול בנושא. בחודש האחרון הם חקרו ופרסמו מספר מאמרים העוסקים בנושא ×›×”×›× ×” לגילוי. הצמד גילה שניתן ליצור קבצי [...]

]]> By: rizki http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-99787 rizki Tue, 15 Jan 2008 10:25:13 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-99787 how to hacking in the syistem how to hacking in the syistem

]]> By: G-Brain http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-99281 G-Brain Sun, 13 Jan 2008 11:47:58 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-99281 "Home Wirless". An excellent article nonetheless. “Home Wirless”. An excellent article nonetheless.

]]> By: Hacking The Interwebs | GNUCITIZEN http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-98890 Hacking The Interwebs | GNUCITIZEN Sat, 12 Jan 2008 12:57:28 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-98890 [...] the last week we’ve tried to prepare you for this very moment by exposing bits and pieces on how UPnP works and why it is so important to keep it in mind when testing and securing networks. [...] [...] the last week we’ve tried to prepare you for this very moment by exposing bits and pieces on how UPnP works and why it is so important to keep it in mind when testing and securing networks. [...]

]]> By: Adrian Pastor http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-98269 Adrian Pastor Fri, 11 Jan 2008 00:26:26 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-98269 @zmx - Plug-and-Play Tester - like other upnp tools - are very handy for reverse-engineering the protocol. make a config change with the tool while sniffing the traffic. once the SOAP request is captured is trivial to convert to XHR() for remote exploitation. @agent0x0 - you definitely made me want to test UPnP attacks on consoles. Nice idea as I'm sure they use UPnP stacks that can also be found on other devices besides gaming consoles. @zmx - Plug-and-Play Tester - like other upnp tools - are very handy for reverse-engineering the protocol. make a config change with the tool while sniffing the traffic. once the SOAP request is captured is trivial to convert to XHR() for remote exploitation.

@agent0×0 - you definitely made me want to test UPnP attacks on consoles. Nice idea as I’m sure they use UPnP stacks that can also be found on other devices besides gaming consoles.

]]> By: ambient » Some links from today http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-98207 ambient » Some links from today Thu, 10 Jan 2008 21:25:55 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-98207 [...] Hacking with UPNP [...] [...] Hacking with UPNP [...]

]]> By: pdp http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-98118 pdp Thu, 10 Jan 2008 16:25:16 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-98118 definitely a risk, I must say. we haven't done any research on UPnP enabled consoles although I am sure that there might be a lot of interesting stuff to play with. To give you a hint, certain printers allow you to do a lot more through UPnP then the Web interface ;) definitely a risk, I must say. we haven’t done any research on UPnP enabled consoles although I am sure that there might be a lot of interesting stuff to play with. To give you a hint, certain printers allow you to do a lot more through UPnP then the Web interface ;)

]]> By: agent0x0 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-98112 agent0x0 Thu, 10 Jan 2008 15:59:29 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-98112 Good stuff guys! I am concerned with all these "media server" devices and clients that auto enable UPnP...I know many people are sticking 360's and PS3's out on their Internet Gateway so they can play multiplayer games easier...perhaps video game consoles with UPnP enabled is a growing attack vector along with the devices you mentioned. Have you done any research with UPnP and consoles like the Xbox 360 or PS3? Good stuff guys! I am concerned with all these “media server” devices and clients that auto enable UPnP…I know many people are sticking 360’s and PS3’s out on their Internet Gateway so they can play multiplayer games easier…perhaps video game consoles with UPnP enabled is a growing attack vector along with the devices you mentioned. Have you done any research with UPnP and consoles like the Xbox 360 or PS3?

]]> By: pdp http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-98072 pdp Thu, 10 Jan 2008 14:54:52 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-98072 yes, Universal Plug-and-Play Tester is pretty good, but it has some limitations. <blockquote>How can you interrogate an UPnP device from the internet?</blockquote> first of all check <a href="http://www.gnucitizen.org/blog/bt-home-flub-pwnin-the-bt-home-hub-5" rel="nofollow">Adrian's post</a> on how to hack into BT Home Hub from outside with a combined attack: XSS + UPnP. It works flawlessly. The victim needs to visit a specially crafted webpage. Upon visit, the attacker will reconfigure their router with an UPnP SOAP message. At that moment the attacker can do pretty much whatever they like, including but not only: change the primary DNS server, reconfigure the local network, expose internal ports on the router's Internet facing side. The broadcast announcement is useful only if you don't know where to look for the UPnP service description. I lot of people believe that UPnP is useful only if you are inside a network. This is incorrect. If you manage to find a printer or an exposed router, or any other type of UPnP enabled device and you know where their description is located, you might be able to send arbitrary SOAP request to any of control points over the Internet. It is as simple as that. For example, if you enable the BT Home Hub router Web interface on the internet facing side, you will be able to reconfigure the device across the Internet even if the default admin password was changed. yes, Universal Plug-and-Play Tester is pretty good, but it has some limitations.

How can you interrogate an UPnP device from the internet?

first of all check Adrian’s post on how to hack into BT Home Hub from outside with a combined attack: XSS + UPnP. It works flawlessly. The victim needs to visit a specially crafted webpage. Upon visit, the attacker will reconfigure their router with an UPnP SOAP message. At that moment the attacker can do pretty much whatever they like, including but not only: change the primary DNS server, reconfigure the local network, expose internal ports on the router’s Internet facing side.

The broadcast announcement is useful only if you don’t know where to look for the UPnP service description. I lot of people believe that UPnP is useful only if you are inside a network. This is incorrect. If you manage to find a printer or an exposed router, or any other type of UPnP enabled device and you know where their description is located, you might be able to send arbitrary SOAP request to any of control points over the Internet. It is as simple as that.

For example, if you enable the BT Home Hub router Web interface on the internet facing side, you will be able to reconfigure the device across the Internet even if the default admin password was changed.

]]> By: zmx http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play/#comment-98069 zmx Thu, 10 Jan 2008 14:43:49 +0000 http://www.gnucitizen.org/blog/hacking-with-upnp-universal-plug-and-play#comment-98069 There is a nice application Universal Plug-and-Play Tester for playing with http://noeld.com/programs.asp?cat=dstools. However, you can play with UPnP only if you are inside the internal network. You need to see broadcast announcements to be able to interrogate and control an UPnP capable device. How can you interrogate an UPnP device from the internet? There is a nice application Universal Plug-and-Play Tester for playing with http://noeld.com/programs.asp?cat=dstools.

However, you can play with UPnP only if you are inside the internal network. You need to see broadcast announcements to be able to interrogate and control an UPnP capable device.

How can you interrogate an UPnP device from the internet?

]]>