Jomsviking
join:2007-12-28
| reply to swhx7
Re: UPnP strikes again
Due to the many questions and wrong interpretations of their discoveries, GNUCitizen has added an FAQ about this topic:
»www.gnucitizen.org/blog/flash-up···tack-faq
Interesting to note that Petkov himself, in the discussion following the FAQ, states:
"Many of you say that it is ok to turn UPnP off. Well, I am not sure about that. As a security guy I recommend turning UPnP off. Though, I can clearly see how this can turn into a problem. People does use it. Go explain to our grandma how to add a portforward through the admin interface so that she is secure when using whatever program she might have in mind. She would rather leave that decision to the computer, I guess. So let’s not be ignorant."
UPnP takes a blow, that is for sure, but most people won't even know about this problem. And even for those who know, fixing a static IP and doing port forwarding manually may be difficult and pose a number of problems. Instant Messaging/VOIP functionality going to hell, for example.
[Skype does NAT-traversality, but not specifically through an UPnP implementation, so it will, in principle, still work if you disable UPnP in your router]
Those who think that they can disable flash (ex: use of the NoScript add-on for Firefox) and keep UPnP on will have two problems at least:
- this hack might prove doable with Java or other web technologies. Just a matter of time, probably.
- Even if we block flash by default, we always have to allow it sometime in some sites we see as trusted; but those sites can be compromised without our knowledge and then...
And more and more sites are requiring this [crap] dynamical content to be displayed in order to function properly.
Either coders of web content plattforms start becoming security conscious [no way in hell that will happen] or UPnP implementation is changed to provide strong authentication measures, which will not be happening anytime soon....
So meanwhile we have a problem in our hands of convenience x security, which is not necessarily trivial. |
