SECURITY ALERT: Universal Plug and Play Vulnerability

I'm a faithful reader of your Geekly Updates and appreciate the useful information. I ran the Rapid7 Security Router test, thankfully, my router was safe.

Also, I turned off Windows UPnP services, so hopefully, I will be safer when surfing the internet. Thanks for helping us mere mortals, like myself, feel more confident when using our computer. :)

What does this Rapid7 message mean?

{green tick] Congratulations! Your router did not respond to a UPnP discovery request.

EDITOR'S NOTE: That means your router is not vulnerable, which is good!

Just checked my ZyXel P-660HW-T1 v2 Router and found the UPnP default setting is set to off. You had me worried for a moment.

I clicked on the link for Metasploit but it appears that Metasploit is only available for Windows and Linux.

Does this issue affect DSL Modem devices?
My Westell 7500 Router is not in the device list.

Thanks, Bob! I ran the ScanNow for UPnP and I had no vulnerabilities!

What's next now? Maybe we should just turn off our computers and go to the next level of technology, but wait, that will probably be comprised if even sooner than it took for our present technology to take place...sigh!

If I stop the Windows SSDP Discovery, Then I bet the USB devices I constantly plug and unplug would create more of a problem?

I use kindle and android as well as lots of external USB drives!
This would be interesting if I needed to start and stop the service for local PnP devices.

There's a catch 22 with the UnPNP scanner. It requires Java and Java itself poses almost as much a threat as UnPNP. The online checker works fine. You might want to mention this to your readers. My boss (Leo Notenboom) suggests staying away even from patched versions of Java as problems keep coming up.

EDITOR'S NOTE: I addressed the Java issue in a special note on the page. Apparently people are not noticing it, since I got this same comment from several readers. Look for the yellow boxed note.

Disabled UPnP in services as shown. Immediately was told that my Win 7 needed to be registered within two days!!! The regular Windows "pop-up" appeared - register now or later! I went back and turned SSDP back to manual, and no more "registering" needed!

EDITOR'S NOTE: That's odd. Are you using an unregistered version of Windows? (If so, that's a problem.)

Thank you so much for always alerting us and looking out for us when things like this happen! I really appreciate the fact that you realize there are us "newbies" out here and explain exactly how to do something. You're the best Bob!

Hi,
I ran the Rapid 7 router security check and apparently have no problems with UPnP. However, it did install a large number of files on my system in the process. Inctrl5 shows 129 files added in various directories. It also showed quite a few registry entries added to my system.

For many, many years (probably 15 or more) Steve Gibson of Gibson Research Corporation has warned about the dangers of UPnP and has even provided a free simple program to turn it "off" or "on" at
http://www.grc.com/UnPnP/UnPnP.htm
That webpage has a very thorough discussion of the problem.

EDITOR'S NOTE: I'm aware of that page. However, it was written in 2001, and includes no mention of the greater problem, which is the router vulnerability.

Thanks for the tip off Bob. I installed JAVA to run the checks then uninstalled it.I'm running WinXP SP3 on a fairly old machine with a 3 year old router so was pleasantly surprised to pass the tests!

I passed the Router test, but I'm not going to install Java RTE to get ScanNow for UPnP to work. Perhaps there is another way?

EDITOR'S NOTE: Maybe Metasploit. I have not tried it to see if it needs Java.

Unlike some, Rapid 7's router scanner completed sucessfully in about a minute when I ran it. And thankfully, it said Congratulations...... :-)

Thanks for this great article, Bob. Ran both tests with no difficulty and no problems found, so good news there. Can't believe someone would think you would advise your readers to use a program containing malware of any kind. Always find your info useful and reliable. Much appreciated.

Hi Bob. Thanks for the heads-up on this one, once again proving the value of your newsletter.

I Got the congrat's message from the 'Router Scanner' so that looked OK? But the scanNow result showed "Exploitable" (Red cross) '0' and "Identified" (Green tick) '5'. The result details listed all networked equipment; Three PC's, Laptop, printer and the "Router/Hub". All of these were listed by IP address with a red 'X' and '0' under the heading 'Exploitable', and under 'Status' each IP address (including the "Router/Hub") has a Green Tick followed by the word 'Identified'.

In your post you state " If it shows zeros under both Exploitable and Identified, you're in good shape"?

So under Status; what does the 'Green Tick followed by the word 'Identified' indicate? If the lack of a zero here means all is not well, then it would appear that the two Rapid7 checks are giving contradictory results. Your advice would be gratefully appreciated, Bob.

EDITOR'S NOTE: I should have said that if none are Exploitable, you're okay.

No problem whatsoever with Rapid7 Router Security Check: "Congratulations..." received. No problem with ScanNow for UPnP, but it identified one vulnerability. Just contacted my ISP and got directed to their webpage whereby I can access the "ins" and "outs" of my settings. Found UPnP with no problem. Your directions for all this and for the "UPnP Device Host" service were easy to follow and execute. Thanks again for your help!

Thanks Bob for this timely warning. I have run both tests, and I did have to temporarily enable JAVA, and I got good reports. Is this security check something I should run regularly, or after adding any new peripheral, or is this one check sufficient?

EDITOR'S NOTE: If your router is okay, I wouldn't worry further about it.

Rapid7 secouity router check would not work on my new WD Mynet1300ac router. After 5 min of that gear turning I cancelled the test.
Now What???