ZyXEL Communications P-335WT Manual de usuario descargar pdf (Pagina 11)

Internet Gateway Device speciﬁcation!), but for some reason these changes never

made it upstream to Broadcom, or were never incorporated by Broadcom.

Broadcom was notiﬁed of the problem on March 3, but no reply was given before

the deadline for this paper expired.

4.3 Using UPnP to create random chaos

Aside from adding a portmapping other actions can be performed on an Internet

Gateway Device, including deleting portmappings. Deleting existing portmappings

can disrupt the correct working of programs.

In this paper the focus is on the Internet Gateway Device proﬁle in general and the

WANIPConnection and WANPPPConnection proﬁles in particular. There are probably

a lot of other opportunities for malice with the other standard proﬁles, but I have

not tried to hack them, because of lack of devices.

Hacks that come to mind are abusing the LANDevice proﬁle and especially the

LANHostConfigManagement subproﬁle to shutdown routers or inject false router

or DNS information or adding bogus printers. Devices that implement these de-

vices seem to be a bit rarer than devices that implement the WANIPConnection or

WANPPPConnection proﬁles. Even though both subproﬁles are both part of the In-

ternet Gateway Device proﬁle, not all the subproﬁles of the LANDevice subproﬁle not

have to be implemented, whereas it is mandatory to implement WANIPConnection

or WANIPConnection.

More spectacular hacks would be to abuse HVAC controls with UPnP (these devices

are rarely ever seen in the wild, although there is a UPnP proﬁle for), or remotely

control IP cameras, of which some seem to be using the UPnP AV proﬁle.

5 Other UPnP hacks

UPnP has been in the news a few times in the context of hacking ([10], [11], [14],

mainly in December 2001 when several worms took advantage of the UPnP ports on

Windows client machines via a buﬀer overﬂow[12]. The advice for countering this

threat was to turn oﬀ UPnP services on the client machines. Another hack was a

Denial of Service Attack on a machine, which would be swamped with notiﬁcation

messages if other machines sent out tons of fake discovery messages[13].

6 The UPnP Device Security proﬁle

Even though by default there is no security in UPnP that doesn’t mean that it

was completely ignored by the UPnP forum. In fact, a security mechanism, that

devices can implement was developed. There are two proﬁles, SecurityConsole

and DeviceSecurity. A device that implements the SecurityConsole serves as

some sort of central hub were other devices can request a security policy. The

system is based on PKI.

None of the devices that were tested implement the standard security proﬁle that is

available in the UPnP speciﬁcations, or at least, don’t enable it. The sourcecode for

some of the Asus machines (such as the WL500g) actually contains some code for

the DeviceSecurity proﬁle, but it doesn’t seem to be used. An extensive search

on the Internet also didn’t come up with any devices that use any of these proﬁles.

1 2 ... 6 7 8 9 10 11 12 13 14 15 16 17 18

Sin comentarios

ZyXEL Communications P-335WT Manual de usuario Pagina 11