Routers are again becoming a source of cyberthreats as a new batch of security vulnerabilities in UPnP were publicized earlier this month. UPnP is a set of networking protocols widely used in home routers. Its purpose is to automatically discover devices on a network and interact with them.<\/p>\n
New vulnerabilities are reported to allow for an attack that takes less than 20 seconds; any router running UPnP is at risk, researchers said<\/a>.<\/p>\n Filet-o-Firewall<\/strong><\/p>\n The new set of flaws received a somewhat funny name \u201cFilet-o-Firewall\u201d. What it allows is not\u00a0funny: according to Threatpost<\/a>, \u201cit combines a number of vulnerabilities and weaknesses in routing protocols and browsers, conspiring to expose networked devices behind a firewall to the open Internet.\u201d<\/p>\n Essentially, the attack requires a specially crafted website that may cause a user who is running Chrome or Firefox browsers with JavaScript enabled to make arbitrary UPnP requests to their firewall, exposing any or even all devices behind a user\u2019s firewall directly to the Internet. It would, however, require additional effort to \u201cexcavate\u201d any data of interest to the hacker, but in case he or she is experienced enough, it\u2019s not rocket science to do that.<\/p>\n Making users with a JavaScript-enabled browser visit an attacker\u2019s website is a relatively easy endeavor, too.<\/p>\n It is important to mention that the vulnerability is reported to be \u201clogic-based\u201d: \u201cIt does not reside in a specific piece of code. It is a result of many different attacks combined into one and designed to target the UPnP service on home routers\u201d.<\/p>\n