Vulnerabilities in the plug and play protocol can allow attackers to remotely control devices such as IP cameras, routers, printers and smart TVs, according to security researchers

Networked devices vulnerable due to UPnP flaws

Nearly 23 million Internet Protocol addresses attached to devices such as networked printers, routers, IP cameras, media servers and smart TVs are exposed to Web-based attacks because of flaws in the UPnP (Universal Plug and Play) protocol of those devices, according to vulnerability testing firm Rapid7.

The Boston-based company said that of the 80 million unique IP addresses they requested in a test from June to November last year, Rapid7 security researchers found that nearly  20 per cent of the IP addresses were exposing the UPnP SOAP (Simple Object Access Protocol) service to the Internet. This service, the researchers said, can be used by cyber criminals to launch attacks behind the firewall.

The plug and play protocol allows network devices to identify each other and establish working configuration for such things as data sharing, media playback and streaming and other services. For instance as file sharing gap in a computer can order a router to open a special port and map it into the computer’s local network address to facilitate file sharing to other users.

The researchers also found that about a quarter of the UPnP were implemented using a library called Portable UPnP SDK, Eight remotely exploitable flaws have been identified with this specific library, said Rapid7.

The company said the vulnerabilities they had identified have been fixed, but it will take longer for application and device vendors to incorporate the patches into their products.

Read the whole story here

Related Download
IDC Analyst Connection - Unified Threat Management: Benefits of an Integrated Approach to Network Security Sponsor: Fortinet
IDC Analyst Connection – Unified Threat Management: Benefits of an Integrated Approach to Network Security
This IDC Analyst Connection looks at the the benefits of using a UTM platform integrated with network connectivity and how it will save the enterprise money, reduce the number of vendors' products needed to be purchased, improve the communications between devices, offer the opportunity for organizations to deploy more sophisticated capabilities, and vastly improve security.
Register Now
Share on LinkedIn Share with Google+ Comment on this article