Check for UPNP computer threat

[Stanley]

This new threat is a defect in routers that allows bad guys to exploit the UPNP function to invade a home network. Fortunately, you can turn off UPNP in your router if you know how to do it. Apple routers do not use UPNP and therefore do not have this problem.

This site will check to see if you threatened by the UPNP problems:

https://www.grc.com/su/UPnP-Rejected.htm

Further test on your computer's vulnerability can be found here using the Shields UP! website:

https://www.grc.com/x/ne.dll?bh0bkyd2

 

[Animorph]

I'm negative, but I had to start from the beginning to get the correct IP address for my router loaded into the site. Click on ShieldsUp! under the Services tab near the top left.

 

[GrayHare]

No worky here: clicking the Proceed button for all tests merely returns to the Greetings! page.

 

[MichaelB]

Here's a link to a Kaspersky Labs write up of the UPnP issues. 50 Million Potentially Vulnerable to UPnP Flaws | threatpost

UPnP is, according to Rapid 7, a protocol standard, often enabled by default, that allows computers and various other network connected devices to communicate with one another and simplifies the discovery and control of network devices. Devices with UPnP enabled by default include smart TVs, IP cameras, printers, media servers and routers to name a few. It is enabled by default on Mac OS X, Microsoft Windows, and a number of Linux distros. Different devices have different capabilities but some common functions include incoming port mapping on home routers, identification of network printers, and managing media services.

Rapid7 is encouraging that users disable UPnP on all Internet facing systems and replace any systems that do not offer the ability to disable the protocol. Some of these vulnerabilities, such as the Portable UPnP SDK and MiniUPnP, have been patched, but as Moore notes, it takes time for the various device makers and application developers to implement the patch into their products. In the meantime, users will remain vulnerable. He also explains that a number of products are “no longer shipping,” meaning that users of that equipment will not receive patches and will remain vulnerable until they remove or replace the products in question.

 

[smileydog]

FYI...

The guy who runs this web site also has a very good security podcast called Security Now on the TWIT network - I have been listening to for years. If you are geeky enough - you probably already know of Steve Gibson and his Spinrite software for hard drives. If you are somewhat technical you might find it of interest for his up to date network security info.

Home | TWiT.TV

 

[rbmrtn]

Never open ports on your router unless absolutely needed, and even then think twice about it. UPNP has been a problem since it was introduced. Generally anything that makes it easy for you does the same for hackers.


HTG Explains: Is UPnP a Security Risk?

 

[Felix Mulier]

Further test on your computer's vulnerability can be found here using the Shields UP! website:

https://www.grc.com/x/ne.dll?bh0bkyd2

Thanks (I think!) My system checked out fine

My experience with computers goes back to graduate school in the 80's. In order to get a PC (vs. a terminal) to use at w#*k, I had to put it together myself! (It was somehow cheaper that way!?)

Anyway, having been in IT for over 25 years, a lot has changed. This site was like a stroll down memory lane! Spent over an hour reading (and understanding even!) and running tests. I even found ye olde Usenet Groups! It's good to feel geeky again!

 

[ls99]

Done, all closed and not responding to outside stimuli.