Universal Plug and Play

decided to take.

And I think our customers trusted us on that and they noticed ours sound much better, but still we had a lot of problems because you need to address bugs, the UPnP protocol and other things, and you're connected to the network.

Everything changes from one year to the other.

But still, we focused first on two things that are nowadays very common, but back then it was not bit perfect.

software.

I mean, it has to be almost maddening to deal with, and I did a podcast on networking with an architect who deals in networking.

And I don't think people truly understand how much really goes into getting all these different things to talk to each other, whether it be Cobuzz Connect, Tidal Connect, UPnP, Rune.

You know, the list is endless.

The victim pool is typically boring stuff: consumer routers, IP cameras, gateways, DVRs, and other embedded Linux devices.

Two details that are kinda probably worth chewing on here, it uses UPnP to go ahead and punch its own port forwarding rules out on the victim's router, so NAT stops being a problem, and it resolves its command and control through an Ethereum named, uh, service.

No single flashy CVE or anything is behind it.

The reporting points to basically default weak credentials, exposed, uh, management interfaces, and unpatched firmware.

Uh, so there's, uh, really no evidence that, uh, any kind of public exploitation has been occurring as of the twenty-fourth of August here, but it has one of the eight CVEs in this version so far, uh, in two weeks, uh, for it to be fixed, bringing the total number there to, like, twelve.

So let's talk about, uh, Dysphoria first since that's kind of more aligned with our, our main topic today.

Um, weak credentials, UPnP, I, I think the UPnP part kinda bugs me the most 'cause I, I think since this technology really kind of showed up in two thousand twelve, I've kind of been hating on it, and, and I still am.

Uh, what are you guys' thoughts on that?

Network to limit access to other devices.

Disable UPNP.

Turn off universal plug and play on your router.

What the hell am I reading here? Just to watch TV, I have to become Bill Gates-level software genius? Knock it off, people.

Atlas 21's got it.

GamersNexus, together with Level 1 techs and three independent security researchers, says that it found LG TVs scanning home Wi-Fi networks through UPnP, identifying connected phones, computers, and smart devices.

According to the investigation, the group obtained audio from a TV microphone while the screen was dark and repeated the test after disconnecting the set from the internet.

In another test, a TV allegedly uploaded stored audio after reconnecting to the network.

Generate something with your password manager and put that in there.

I would disable a lot of features that can make your device a lot less secure, like UPnP and this old technology called WPS for setting it up.

Hopefully nothing has that anymore, but if it does, I would disable that.

And any sort of remote or WAN side administration, turn all that off.

So, If you're a Cox customer, or it's not only Cox, some of the smaller ISPs also use these same routers.

So if your router is branded either GS5239XG, so very memorable, or Gigaspire 7U10TXG, which sounds slightly better, Either of those two brands on your router, you need to disable UPnP by going to the settings interface, going advanced security and then UPnP and turning it off because there is no patch.

All you can do is disable the feature with the bug that allows anyone on the internet to bypass your NAT, and instead of your router being a one-way valve, they can just talk directly to everything on your network from the public internet.

Jeez.

So I feel, I'm not sure my memory's correct on this, but I think turning off UPnP was maybe the very, very, very first thing I can remember you ever telling us to do.

Yeah, because it's problematic anyway.

Usually the problem with UPnP is triggered within your LAN, where you visit a malicious, say a malicious piece of JavaScript or something, and it reprograms your router over UPnP through some sort of a silly bug in your router.

and then your browser effectively hacks your router.