If you are using a home router and various other pieces of network gear from the likes of Belkin, D-Link, Linksys, and Netgear (among others), you could be leaving yourself vulnerable to attacks.
Security researchers at Zscaler report a new vulnerability in the Universal Plug and Play (UPnP) standard. UPnP is meant to enable networks to communicate with devices in an easy to set-up manner.
Researchers have discovered 3 different vulnerabilities, all which can allow a hacker to take over a users PC. Once accessed, the attacker can steal files, grab password,s and gain remote access to webcams, printers, and scanners.
Security researcher Michael Sutton, VP of Security Research at Zscaler ThreatLabZ, explains the attack:
“This highlights the significant security gaps that exist for hardware vendors, and the challenge faced by industry to shrink this gap.”
Sutton adds:
“Hardware vendors tend to strive for ease of use in their products– often to the detriment of security. For this reason, protocols such as UPNP, which ease deployment, tend to be enabled by default and often without forcing overall authentication to be enabled. Moreover, many of the devices identified are consumer grade and being deployed by users that lack the know-how to understand the risk of exposing such devices to the Internet. When security vulnerabilities are found in hardware devices, a single flaw tends to repeat itself across multiple vendors as products are often rebranded versions of another product, or leverage the same underlying firmware. Finally, when vulnerabilities are discovered, they often remain indefinitely, as hardware devices are less likely to have firmware update mechanisms and consumers are generally unaware of the need to periodically update firmware for security purposes.”
Sadly, this is not the first time major threats in the UPnP protocol have been discovered; Zscaler recently reported on HP printer and scanner issues found via the protocol.
In general, network users are always reminded to install firewalls on their systems and password protect their individual networks. Even with proper security, though, some vulnerabilities still leave your system open to attack.
