by Martin Zeiser
Universal Plug and Play (UPnP) is one of the most widely deployed protocols, being part of just about every embedded system nowadays, included in routers, smart TVs, printers, projectors, gaming consoles, NAS and many more. By design and intention, UPnP is intended as a hands-off approach to autoconfiguration. It allows operating systems to communicate with supported devices, detect their abilities and interfaces and read as well as modify settings or execute functions. The lack of security on the one hand combined with a plethora of different features implemented by thousands of vendors makes for a rich attack surface. While mostly aimed at home networks, many UPnP enabled devices made it into office networks and provide their services on the internal networks, sometimes even the Internet, without anyone being aware.

свернуть