Misconfigured Routers Could Be Used for Botnets, Espionage

A recent white paper released by Akamai finds that thousands of misconfigured routers using older UPnP protocols could be turned into malicious botnets or used for espionage.

Universal Plug and Play -- UPnP -- is an older protocol aimed at easing device and service discovery and a way to configure devices and networks. The idea behind it was to let devices on a LAN automatically expose their services and functionality to other devices that were located on the devices local network.
Now, however,
the content delivery network Akamai
has found it can be used to create proxies that hide the location of the originating traffic.
And thats really useful for malicious botnets, as well as for espionage.
UPnP has been known to be insecure for over a decade. In 2006, problems with how certain implementations handled network segmentation across the WAN -- external Internet -- and LAN were first brought to light. The first toolkit to exploit these showed up around 2011.
(Source:
Akamai
)
Akamai was investigating some attacks on its networks when it found that some routers would expose UPnP services that were meant for inter-device discovery through its WAN interface. Researchers later figured out that these routers were misconfigured.
In its white paper, Akamai explained that by using these exposed services, an attacker would be able to inject network address translation (NAT) entries into the remote device, and could expose machines behind the router. In other cases, attackers could inject Internet-routable hosts into the NAT table -- rules that control how IPs and ports from the routers internal network are mapped to the network above it -- which would cause the router to act as a proxy server.
It starts with the Simple Service Discovery Protocol (SSDP) probe response. From the location header, the attacker can communicate with the TCP-enabled UPnP daemon by changing the URL to use a public-facing address.
If the device is vulnerable to injection, a simple SOAP/XML payload can be crafted by the attacker which will inject a malicious NAT entry.
This may allow bypassing of the routers firewall to gain access to the admin interface. A brute force attack may work since no rate limiting or alerting is usually present on the login dialog.
The fundamentals of network security are being redefined -- dont get left in the dark by a DDoS attack! Join us in Austin from May 14-16 at the fifth annual
Big Communications Event
. Theres still time to register and communications service providers get in free!
Akamai found 765,000 -- 16% of the total 4.8 million scanned -- of the devices were confirmed to expose their vulnerable TCP implementations. Over 65,000 -- 9% of vulnerable, 1.3% of total -- of these vulnerable devices were discovered to have active NAT injections. The most-identified IP injected was found over 18.8 million times across 23,286 devices.
The second-most-injected IP showed up over 11 million times across 59,943 devices. A majority of the injections were found to target TCP ports 53 (15.9 million for DNS), 80 (9.5 million for HTTP), and 443 (155,000 for HTTPS)
The actual purpose of this proxy network is unclear. It could be used to avoid censorship. It could also be a way to hide spamming or click fraud. A botnet using this technique could carry out a distributed denial of service (DDoS) attack as well. Whatever the attackers do with it, this flaw allows them to hide the traffic that they cause.
End users will not be able to detect a vulnerability like this on their own. Disabling UPnP to stop future infections may affect the network in areas such as gaming or media streaming.
Akamai gives a list of known affected routers in its posting. There may be more the company has not enumerated. It may well be that the only way out in this case is to replace the affected routers with one that has been hardened. Consumers may not be happy at all to hear that.
Related posts:
IoT Malware-on-the-Fly Expected to Rise
FCC Cites National Security Concerns to Withhold Federal Contracts
DDoS Today: No Safety Inside the Perimeter
RouteX Hijacks Netgear Routers
— Larry Loeb has written for many of the last centurys major dead tree computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Last News
▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Misconfigured Routers Could Be Used for Botnets, Espionage