{"id":672,"date":"2018-05-16T08:22:09","date_gmt":"2018-05-16T08:22:09","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/upnp-joins-the-just-turn-it-off-on-consumer-devices-already-club\/"},"modified":"2018-05-16T08:22:09","modified_gmt":"2018-05-16T08:22:09","slug":"upnp-joins-the-just-turn-it-off-on-consumer-devices-already-club","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/upnp-joins-the-just-turn-it-off-on-consumer-devices-already-club\/","title":{"rendered":"UPnP joins the ‘just turn it off on consumer devices, already’ club"},"content":{"rendered":"

Universal Plug ‘n’ Play, that eternal feast of the black-hat, has been identified as helping to amplify denial-of-service attacks.<\/p>\n

Researchers at Imperva looked into misbehaving UPnP implementations after spotting odd attack traffic while analysing a Simple Service Discovery Protocol (SSDP, an Internet proposal absorbed into UPnP) amplification attack during April 2018.<\/p>\n

\"A<\/p>\n

It’s 2017, and UPnP is helping black-hats run banking malware<\/h2>\n

READ MORE<\/span><\/a><\/div>\n

The company’s Avishay Zawoznik, Johnathan Azaria, and Igal Zeifman wrote<\/a> that while some of the attack packets came from familiar UDP ports, others were randomised.<\/p>\n

In trying to replicate the behaviour, the three researchers concluded that attackers were using UPnP on badly-secured devices like routers (turn it off, people), and tried to replicate the attack.<\/p>\n

It’s not particularly difficult, particularly with Shodan to help. The required steps are:<\/p>\n