21–30 of 112 posts
How would this even be possible? Home routers have to NAT everything. Normally you have to set up reverse NAT to get ports forwarded to the LAN.
>It's not a novelty that allowing UDP port 1900 traffic from the Internet to your home printer or such is not a good idea. How would this even be possible? Home routers have to NAT everything. Normally you have to set up reverse NAT to get ports forwarded to the LAN.
Why is IP spoofing STILL an issue? Why?
To impose fixes upstream, you'd have to do DPI on all data; which is not allowed under some laws (i.e. net neutrality).
Pervasive IoT device deployment without in-the-wild security considerations and rapid updates is likely to add to DDoS bot farms.
Every single thread of this nature has a similar comment, and I really want to know (ie, I want to hear this fully fleshed out because I think your concerns are valid and worth exploring): is this demonstrative of a new (or in some way more valid) notion of the word "hacker" in "hacker news?"
My sense of that word, and of the culture that underlying it, is that a critical part of its critique is that obscurity, specifically in its implications for security (and thus, perhaps civility and peace and justice), is subject to deprecation in the information age, precisely in favor of styles of disclosure like this: where the pudding for the tasting is provided as the proof.
Have I missed something very important?
Earlier quoted context omitted.
Vulnerable by default? If a device is listening to UPnP on the WAN interface, the fault is not on UPnP but on whoever configured it to be open on the WAN. IMO, all of these zeroconf protocols should be limited to responding back only to the local segment and not allowed to traverse gateways.
One of the documented use cases for UPnP is IGD which expressly allows UPnP devices to configure fire wall rules and to set up NAT to map ports to the outside world. So a UPnP device that wishes to expose itself to the outside world is able to do so and this is by design, not by accident. Whether you agree with that or not is another matter.
>It's not a novelty that allowing UDP port 1900 traffic from the Internet to your home printer or such is not a good idea. How would this even be possible? Home routers have to NAT everything. Normally you have to set up reverse NAT to get ports forwarded to the LAN.
https://itunes.apple.com/us/app/ssdp-monitor/id1191370425?mt...
https://itunes.apple.com/be/app/ssdp-monitor/id1197048167?mt...
Ever since creating it and just checking on some networks, I'm surprised of how many devices are actually using it. I probably saw this in Wireshark before as well, but probably overlooked it because you're never really looking for it. I wonder if many other such protocols are often used but easily missed...
>It's not a novelty that allowing UDP port 1900 traffic from the Internet to your home printer or such is not a good idea. How would this even be possible? Home routers have to NAT everything. Normally you have to set up reverse NAT to get ports forwarded to the LAN.
Why is IP spoofing STILL an issue? Why?
Because UDP is fire and forget, you don't have to be able to respond to packets you send; this is why you can't do the same with TCP packages. To impose fixes upstream, you'd have to do DPI on all data; which is not allowed under some laws (i.e. net neutrality).
RFC2827, which should fix the problem where SSDP can be used for DDoS, was published in 2000: https://tools.ietf.org/html/rfc2827
Is ingress filtering on layer 3 considered DPI?
Why is IP spoofing STILL an issue? Why?
Because UDP is fire and forget, you don't have to be able to respond to packets you send; this is why you can't do the same with TCP packages. To impose fixes upstream, you'd have to do DPI on all data; which is not allowed under some laws (i.e. net neutrality).