UPnP Security Exploits

[aardvaark]

This just came out today and I thought I'd pass it along as a public service to the MM community...

http://nakedsecurity.sophos.com/2013/02 ... 2Bsecurity

[mcow]

One thing about this that I have not seen stressed enough: UPnP is not dangerous within your local network. I guess there are some routers that open the UPnP ports to the internet by default, but even if you have that, it doesn't mean you have to shut UPnP down; but you really should close those ports.

That does mean: if you're out of the house, you won't be able to stream your library to your phone. UPnP wasn't intended for the public internet, it's designed as a LAN service.

You can check your exposure using the ShieldsUp tool at GRC Labs.

[Lowlander]

I wonder if UPnP (the DLNA kind allowing media sharing) is the same as UPnP (auto-port configuration in router kind). I doubt it, in other words disabling UPnP (which is the topic of the article) in the router won't affect UPnP Media Sharing.