UPnP security issues

This morning we released a whitepaper entitled Security Flaws in Universal Plug and Play. This paper is the result of a research project spanning the second half of 2012 that measured the global exposure of UPnP-enabled network devices. The results were shocking to the say the least. Over 80 million unique IPs were identified that responded to UPnP discovery requests from the internet. Somewhere between 40 and 50 million IPs are vulnerable to at least one of three attacks outlined in this paper. The two most commonly used UPnP software libraries both contained remotely exploitable vulnerabilities. In the case of the Portable UPnP SDK, over 23 million IPs are vulnerable to remote code execution through a single UDP packet. All told, we were able to identify over 6,900 product versions that were vulnerable through UPnP. This list encompasses over 1,500 vendors and only took into account devices that exposed the UPnP SOAP service to the internet, a serious vulnerability in of itself.

The vulnerabilities we identified in the Portable UPnP SDK have been fixed as of version 1.6.18 (released today), but it will take a long time before each of the application and device vendors incorporate this patch into their products. In most cases, network equipment that is "no longer shipping" will not be updated at all, exposing these users to remote compromise until UPnP is disabled or the product is swapped for something new.

Security Flaws in Universal Plug and Play: Unplug, Don't Play (via TechSpot).

I've never had any luck with UPnP on my now rather ancient router, which is certainly "no longer shipping", but it was enabled. I've disabled it as advised.

Static IP address in Gnome on Debian Wheezy

DHCP makes connecting to a router easy, but it does have drawbacks. I have the router set up with port forwarding for Transmission, Amule and now Skype, which I recently installed. I was trying to connect with Skype the other day but couldn't. Later I remembered that my brother had visited recently and used his iPhone and laptop on the network, and my computer's IP address had changed. I don't know for sure if this is why Skype didn't work, but I think it might be.

My printer has had a static IP address for a while now, so I thought it was time to move the wired laptop connection to a static IP address. Network Manager makes it easy: change the connection method to manual and enter the address, netmask and gateway (the router address). The static IP address has to be outside the DHCP "pool". (The pool range and netmask address should be available by accessing the router configuration page.)

I made the changes, and Network Manager established a new connection, using the existing DNS address, previously forwarded to Network Manager by DHCP: 8.8.8.8- the Google DNS server.

Everything  seemed to work fine. I could view web pages. But then web pages stopped loaded with a "Looking up..." notification, which suggested a DNS problem to me. Rebooting the router fixed the problem for a few minutes, then it started again.

In the end I found a solution, as visible in the screenshot above: I set the DNS address to the router address, and DNS requests are handled by the router. I have no idea why DNS server addresses in Network Manager don't work for me, or rather why they work for a short time, then stop working. I've been looking for an answer all day, but haven't found one, so maybe a kind reader (if I have one) who knows the reason will leave a comment.

No DSL Internet in Ubuntu?

This seems to be a fairly common issue for Ubuntu users, perhaps because many people have their broadband service installed by a technician, or insert a Windows CD from their ISP to walk them through the process. Faced with a router, a cable or two, and a fresh installation of Ubuntu (or other Linux distribution), getting a DSL Internet connection seems an impossible task.
In fact, it's quite simple- if your modem has an Ethernet cable. (USB modems are the work of the devil as far as Ubuntu is concerned- they all require proprietary drivers, which Ubuntu doesn't supply. They can be got to work, but it's a tricky job even for somebody familiar with Ubuntu. Other Linux distributions may work "out of the box" with a USB modem, but that's not the subject of this post- anyway, an Ethernet connection is faster, doesn't require any extra software of firmware, and leaves a USB port free.) If your modem has a choice of USB and Ethernet connection, use the Ethernet cable.
Plug in the modem (phone line, Ethernet and power), open a web browser on the computer and type in the modem/router's IP address- this should be four numbers separated by dots, something like this: 192.168.1.1, 192.168.0.1, according to the manufacturer- If it's not in the documentation, Google the make of you modem/router and you should find the address quite easily.
If you can see the set-up screen of the modem/router, it's just a question of making sure the router has the right settings. (If you're unlucky enough to find that your router is not configured via a web browser, have a look at this Ubuntu guide.)
If a computer has been connected to the modem/router before, then the modem/router will probably have been set up to connect to an ISP service, and the modem/router may assign your computer an IP address so your computer can access the internet via the router/modem. (If there's no connection, try enabling DHCP (a service which automatically assigns an IP address to connecting computers), otherwise you will have to tell Ubuntu to use a static IP address. DHCP is the easiest method.)
If you're connecting for the first time, or changing ISP, you will have to tell the modem/router how to connect to your ISP service. Typically this involves entering your username and password, and settings for Protocol, VPI, VCI and Encapsulation. These details for most ISP's in the world can be found here.
This should be enough to get you connected to just about any ISP in the world with many makes and models of Ethernet modem/router. Got a USB modem/router? Well, connection may be possible, but help is beyond the scope of this post. Try this Ubuntu guide, or the Ubuntu Forums- also a good source of advice for connection problems not covered in this (very basic) guide.

I am alive

A symptom of malware infection is often browser redirects- that's when the page you see isn't the page you asked for. It's usually something subtle- a page that looks just like your Internet banking page, but is actually an attempt to steal your password, or a Google search which displays injected malicious links.
Here's an example of an unexpected and mysterious redirect from the Ubuntu forum. The redirected page reads simply "I am alive", apparently the result of a router DNS hijack.
Is it a joke? Perhaps not. Could it possibly be the result of an error on the cyber villains' proxy server, which sits between you and the web site you intended to visit- "I am alive" is a message sent between routers on a network. My best guess is that the victim was never intended to see this message and has received an internal network message in place of a phoney web page.
The moral of the story is: when investigating possible browser redirects, don't neglect to check the router, and all other computers on the network.