A UPnP vulnerability hides bad traffic in a new way

Botnets and advanced persistent threats can exploit misconfigured Universal Plug and Play services in home routers to proxy bad traffic and hide their locations.

According to a report from Akamai this week, nearly 400 models of home routers, across 73 brands, are susceptible to the UPnP vulnerability. The report found that attackers are misusing the UPnP protocol for Network Address Translation (NAT) injections. While UPnP has had security issues in the past, this one has new aspects.

"The UPnProxy vulnerability, like many of the problems we've seen recently, was caused by unauthenticated services being exposed to the public internet in ways they were never meant to be," the report states. "Attackers have taken several aspects of known issues with UPnP and combined them to create a powerful proxy network to hide their traffic. While this is neither a remote exploit that allows the attacker to take over a computer nor a new reflection vector for DDoS, it is still a significant concern because of how it allows the origin of traffic to be hidden."

The original UPnP vulnerability was discovered in 2006, according to Akamai, by Armijn Hemel who found that UPnP wasn't "properly handling network segmentation across the WAN and LAN interfaces." In 2011, another researcher, Daniel Garcia, released a tool set that enabled a remote user to perform NAT injection into a remote device over the WAN. In 2013, Rapid7 found that there were 80 million devices from over 1,500 vendors that were still susceptible to the UPnP vulnerability.

Akamai's research found that some devices that support UPnP and are currently in use are being actively abused in the wild.

"The simple explanation of the vulnerability that lead[s] to NAT injections, is that these devices expose services on their WAN interface that are privileged and meant to only be used by trusted devices on a LAN," the report explained. "Using these exposed services, an attacker is able to inject NAT entries into the remote device, and in some cases, expose machines behind the router while in other cases inject internet-routable hosts into the NAT table, which causes the router to act as a proxy server."

According to Akamai's findings, this UPnP vulnerability has been used to create a proxy botnet that attackers use to bypass anticensorship, antispam and antiphishing efforts, carry out click fraud, take over accounts and perform credit card fraud, launch DDoS attacks, distribute malware and hide attackers' locations for C2 communications.

"End users will not be able to detect a vulnerability like this on their own, and it's possible an investigation could wrongly assign blame to an innocent party because traffic is exiting through their router," Akamai said. "Manufacturers need to stop enabling protocols like UPnP on external interfaces; after more than a decade since this issue was discovered, it continues to plague consumer devices. Carriers and ISPs also need to examine whether they should be allowing protocols that are meant for trusted LAN usage to be traversing their networks."

Akamai noted that the best way to know if a device is susceptible to this UPnP vulnerability is to scan the endpoint and audit the NAT table entries.

If a router is affected, the options to fix it are limited to replacing it with a different, unaffected device or disabling UPnP services, which can negatively impact other areas of the network.

However, according to Akamai, "there is no reason for these problems to exist where basic security models are being followed."