Topic 'Common Router Security Flaw - You Want to Check This!' in forum 'Verizon Fiber Optics' - dslreports.com http://www.dslreports.com/forum/Common-Router-Security-Flaw-You-Want-to-Check-This-28003014 en Sat, 18 May 2013 10:44:22 EDT Sat, 18 May 2013 10:44:22 EDT Re: Common Router Security Flaw - You Want to Check This! http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28008870
For FiOS MI424wr:

Go to Firewall Settings on the top bar then to "Advanced filtering". On the "Inbound" area (the top table), click "Add" to the right of Broadband Connection. It's either Ethernet or Coax, choose whichever your internet is hooked up to.

Click the drop down "Protocol", and pick on "User Defined". Add server ports, "protocol" is UDP, "source" is "Any" and destination is single range port 1500. Click apply and repeat the previous step for TCP 5000. Name the service something, I call it "Upnp-flaw", then click apply.

It should bring you back to the "Add Advanced Filter" page. Make sure operation is "Drop Packets" then click Apply. Your page should now look like this:

[att=1]

Just to demonstrate that it works, I enabled logging for the rule and ran the test again at GRC. Here's what I got after two passed tests:

[att=2]

I looked up who that packet belonged to and it did originate from the GRC test:

[att=3]

This rule should be added if you use UPnP. It will only drop the packets coming in from the WAN side and will have no effects on the normal use of UPnP.
Click for full size
UPNP Filter
Click for full size
It works!
Click for full size
Blocked packet belongs to GRC.
]]> http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28008870 Wed, 13 Feb 2013 22:43:23 EDT Re: Common Router Security Flaw - You Want to Check This! http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28008845 said by birdfeedr:

Does FiOS MDU ONTs using VDSL do this? Maybe.

Nope. I'm on one... My router has its own public WAN address. Also, I don't use PPPoE... My modem provides an ethernet connection that the router plugs into. The router just uses DHCP to get its IP address, no PPPoE.]]> http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28008845 Wed, 13 Feb 2013 22:33:44 EDT Re: Common Router Security Flaw - You Want to Check This! http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28008733
Just did the other one, had to find via the menu the other test, to find ... its no issue ...

As I said, this is a security forum topic, nothing to do with FIOS]]> http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28008733 Wed, 13 Feb 2013 21:59:35 EDT Re: Common Router Security Flaw - You Want to Check This! http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28008695 said by birdfeedr:

said by guppy_fish:

Also that page doesn't work right, it reports my router at IP 10.1.1.1 is responding to UPNP ... lol ( is a non routeable IP and can't be accessed from the WAN )
The details say I'm on a linux server that is at 192.168.0.1 , nothing in my network uses that IP

Did you click this link, which is an example of exposed UPnP vulnerability result? »www.grc.com/su/UPnP-Exposed.htm

or did you click this link, then click Services/ShieldsUP!, then run the UPnP test? »www.grc.com/intro.htm

;)]]> http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28008695 Wed, 13 Feb 2013 21:48:52 EDT Re: Common Router Security Flaw - You Want to Check This! http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28008553 said by guppy_fish:

Also that page doesn't work right, it reports my router at IP 10.1.1.1 is responding to UPNP ... lol ( is a non routeable IP and can't be accessed from the WAN )
The details say I'm on a linux server that is at 192.168.0.1 , nothing in my network uses that IP

Did you click this link, which is an example of exposed UPnP vulnerability result? »www.grc.com/su/UPnP-Exposed.htm

or did you click this link, then click Services/ShieldsUP!, then run the UPnP test? »www.grc.com/intro.htm

The first link displays example results exactly like you reported. Use the second link. Your Actiontec primary router will not show the vulnerability. DD-WRT on my Asus doesn't either.

Also, some broadband system routers using PPPoE present non-routable WAN addresses because they are aggregated further upstream (if I'm using the correct terminology). Does FiOS MDU ONTs using VDSL do this? Maybe.]]> http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28008553 Wed, 13 Feb 2013 21:09:12 EDT Re: Common Router Security Flaw - You Want to Check This! http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28008188


Verizon investigated a wide range of equipment, which covers the vast majority of our FiOS and DSL customers. None of the devices investigated were identified as being vulnerable. Verizon will continue its investigation to ensure all potentially vulnerable devices are identified.



Additional customer information is available to the customer at www.verizon.com/virushelp. Verizon will update this website with additional information as it becomes available."]]> http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28008188 Wed, 13 Feb 2013 18:57:21 EDT Re: Common Router Security Flaw - You Want to Check This! http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28008100 http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28008100 Wed, 13 Feb 2013 18:21:16 EDT Re: Common Router Security Flaw - You Want to Check This! http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28006920
(EDIT TO CORRECT: Yes, turning LAN UPnP off will apparently disable the WAN bug if you have it - didn't mean to leave the impression it wouldn't)]]> http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28006920 Wed, 13 Feb 2013 13:08:25 EDT Re: Common Router Security Flaw - You Want to Check This! http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28006903
For the record, I leave UPnP off anyway.]]> http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28006903 Wed, 13 Feb 2013 13:04:40 EDT Re: Common Router Security Flaw - You Want to Check This! http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28006902
As this is specifically about FiOS routers, it seems appropriate here. The flaw is router specific.]]> http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28006902 Wed, 13 Feb 2013 13:04:37 EDT Re: Common Router Security Flaw - You Want to Check This! http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28006855
Also that page doesn't work right, it reports my router at IP 10.1.1.1 is responding to UPNP ... lol ( is a non routeable IP and can't be accessed from the WAN )

The details say I'm on a linux server that is at 192.168.0.1 , nothing in my network uses that IP

Complete waste of a test]]> http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28006855 Wed, 13 Feb 2013 12:54:59 EDT Re: Common Router Security Flaw - You Want to Check This! http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28006851 http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28006851 Wed, 13 Feb 2013 12:53:23 EDT Re: Common Router Security Flaw - You Want to Check This! http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28003150
There is also the WPS exploit. Which the Actiontech's don't support either (so no worries there).

»www.grc.com/sn/sn-335.txt]]> http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28003150 Tue, 12 Feb 2013 11:49:49 EDT Re: Common Router Security Flaw - You Want to Check This! http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28003035
]]> http://www.dslreports.com/forum/Re-Common-Router-Security-Flaw-You-Want-to-Check-This-28003035 Tue, 12 Feb 2013 11:23:46 EDT Common Router Security Flaw - You Want to Check This! http://www.dslreports.com/forum/Common-Router-Security-Flaw-You-Want-to-Check-This-28003014 to check this quick test to see if you are exposing your
network to a common UPnP implementation bug that
is incredibly common.

The bug is that UPnP is unnecessarily exposed on the WAN
side of the router, when it only really makes sense on the
LAN side. Hopefully the Actiontec doesn't have this issue,
but curious as many routers have this flaw. It should never
be available for negotiate on the WAN side, but it is on
many routers. Hope this isn't an issue with the ActionTec,
but if it is on any model, please report! Verizon will want
to know that. Hopefully not...

Here are the details about it:

There is an entire TechGuy Podcast about it would explains
the flaw. But a quick explaination can be found here:

»www.grc.com/su/UPnP-Exposed.htm

Steve Gibson, Security expert wrote this quick test.

Quick Test:

Click ShieldsUp!, then scroll down to "UPnP Exposure Test!"
and then "Proceed" and you want to run the UPnP Exposure Test

»www.grc.com/intro.htm]]> http://www.dslreports.com/forum/Common-Router-Security-Flaw-You-Want-to-Check-This-28003014 Tue, 12 Feb 2013 11:14:43 EDT