Networked devices vulnerable due to UPnP flaws

Nearly 23 million Internet Protocol addresses attached to devices such as networked printers, routers, IP cameras, media servers and smart TVs are exposed to Web-based attacks because of flaws in the UPnP (Universal Plug and Play) protocol of those devices, according to vulnerability testing firm Rapid7.

The Boston-based company said that of the 80 million unique IP addresses they requested in a test from June to November last year, Rapid7 security researchers found that nearly  20 per cent of the IP addresses were exposing the UPnP SOAP (Simple Object Access Protocol) service to the Internet. This service, the researchers said, can be used by cyber criminals to launch attacks behind the firewall.

The plug and play protocol allows network devices to identify each other and establish working configuration for such things as data sharing, media playback and streaming and other services. For instance as file sharing gap in a computer can order a router to open a special port and map it into the computer’s local network address to facilitate file sharing to other users.

The researchers also found that about a quarter of the UPnP were implemented using a library called Portable UPnP SDK, Eight remotely exploitable flaws have been identified with this specific library, said Rapid7.

The company said the vulnerabilities they had identified have been fixed, but it will take longer for application and device vendors to incorporate the patches into their products.

Read the whole story here

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Article

ADaPT connects employers with highly skilled young workers

Help wanted. That’s what many tech companies across Canada are saying, and research shows that as the demand for skilled workers...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now