Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My NAS exposes itself over the internet without permission

kn100.me

Post reply on HN
Print view View original

301–310 of 311 posts

Re: My NAS exposes itself over the internet without permission

#301

Post by voxic11 »

nullify88 wrote: post #290
batch12 wrote: post #284

Earlier quoted context omitted.

The source port would be random and conmunication would ride on that established connection. An exposed port is not necessary for client initiated communication.

Yes, you're talking about a device behind NAT which initiates a connection to an external service. However, we're talking about a service listening behind NAT (in this case Call of Duty on an Xbox at home) that needs to be listening for connections initiated by other Xboxes to establish a P2P connection. This is what port forwarding enables and this is what uPnP automates.

Why wouldn't they use a solution like https://samy.pl/pwnat/ this is a long solved problem that doesn't require uPnP.

Re: My NAS exposes itself over the internet without permission

#302

Post by [deleted] »

daveoc64 wrote: post #184
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

People make blanket statements like this without thinking of how it is used by popular consumer devices. As others have said it's really necessary for some consumer devices to work properly - especially if you have more than one of the same device. Games consoles are the best example. If you have one console only, then you can usually forward ports manually, but if you have two or more of the same console, and want t…

[deleted]

Re: My NAS exposes itself over the internet without permission

#303

Post by LeanderK »

kalleboo wrote: post #28
LeanderK wrote: post #22

I use a lot of software/devices which I think is using UPnP (airplay, airdrop, pioneer dj pro link, maybe the printer etc.). There's talk here about disabling UPnP but does that mean that the devices wouldn't be able to find each other? I don't want to babysit my router. Or aren't they using UPnP? Quick googling wasn't successful. I thought most of those autodiscover-services use UPnP.

There are 2 parts to UPnP. One is service discovery, in cooperation with zeroconf (aka bonjour/mDNS). This is handled 100% by devices themselves. The other is the port forwarding protocol, where devices can ask your router to open a port in the NAT to the wide internet forwarded to them. This is done in the router. It's also a potential massive security hole. If you disable UPnP on your router, you only disable the s…

thanks, yeah i was only thinking about service discovery

Re: My NAS exposes itself over the internet without permission

#304

Post by oriolid »

voxic11 wrote: post #301
nullify88 wrote: post #290

Earlier quoted context omitted.

Yes, you're talking about a device behind NAT which initiates a connection to an external service. However, we're talking about a service listening behind NAT (in this case Call of Duty on an Xbox at home) that needs to be listening for connections initiated by other Xboxes to establish a P2P connection. This is what port forwarding enables and this is what uPnP automates.

Why wouldn't they use a solution like https://samy.pl/pwnat/ this is a long solved problem that doesn't require uPnP.

Is it somehow better than uPnP?

Re: My NAS exposes itself over the internet without permission

#305

Post by benlivengood »

nobody9999 wrote: post #191
benlivengood wrote: post #90

Earlier quoted context omitted.

> Not sure why this should be an issue in 2021, except for users' trained-in helplessness. Kids hosting games on random ports (terraria, etc.) benefit from UPnP. I'd rather enable it than manually enter firewall rules for each game or give them admin access to the firewall. UPnP is only an additional risk if you have malware inside your network already and then it mostly allows malware to host services in a simpler w…

>UPnP is only an additional risk if you have malware inside your network already I'm not sure where you get that idea. Once a hole is poked (depending on the perimeter device/software in use), it stays poked and you've expanded your attack surface. I make sure that there's no dynamically defined external access to my network. Can you guarantee that no software in use on your network is free of vulnerabilities? I'm no…

> If you think the answer is no, then why don't you share your network details with us and let's have a go? Then we'll see how much of an extra risk upnp might be.

The cheap and fast attacks are DDoS and they're trivial to aim at a cable modem. Avoiding becoming a target is at least 50% of security posture. There were already 4286 ssh login attempts today so I don't really need more attempts than the automated botnet scans provide.

It's a risk/convenience tradeoff. I could probably package up a vpn.exe and force the kids' friends to run it before playing games, or force them to host games remotely. It's just not worth it.

I'm also reasonably sure that there are plenty of 0-days in all networks, given their relatively frequent discovery. So, again, don't be more of a target than necessary, and keep offline backups current and tested.

Re: My NAS exposes itself over the internet without permission

#306

Post by fogihujy »

BlueTemplar wrote: post #279
fogihujy wrote: post #273

Earlier quoted context omitted.

Alas, many ISP's don't offer it yet. Give it a few decades more and we might get that.

At some point the governments should forbid them from calling themselves "I"SPs. This has already started with the 5G.

While there's always demand for more bandwidth, IPv6 isn't really something that people care about in the larger scheme of things. Many ISP's and carriers solved the IPv4 congestion issue with CGNAT and that'll keep things going until we run completely out of IPv4 addresses.

Once that happens, there will be government action. Not before.

Re: My NAS exposes itself over the internet without permission

#307

Post by BlueTemplar »

fogihujy wrote: post #306
BlueTemplar wrote: post #279

Earlier quoted context omitted.

At some point the governments should forbid them from calling themselves "I"SPs. This has already started with the 5G.

While there's always demand for more bandwidth, IPv6 isn't really something that people care about in the larger scheme of things. Many ISP's and carriers solved the IPv4 congestion issue with CGNAT and that'll keep things going until we run completely out of IPv4 addresses. Once that happens, there will be government action. Not before.

We'll never completely run out of IPv4 addresses.

Meanwhile the top agencies distributing IPv4 blocks have ran out of them a decade ago. Recently it was the time for a lower level agency to run out - for Europe.

There's a lot of things that people don't care about until it's too late. Governments are supposed to be able to plan decades in advance. And they do, for things like digital TV. (And I already gave an example of governments acting to push IPv6.)

CGNAT is causing issues in that some protocols simply don't work properly through them. IPv6 also allows for simpler networking, since you don't have to add the extra abstraction layer that is NAT.

Re: My NAS exposes itself over the internet without permission

#308

Post by kn100 »

alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

https://kn100.me/turning-upnp-off/ I've written a follow up, which you may find interesting.

Re: My NAS exposes itself over the internet without permission

#309

Post by fogihujy »

BlueTemplar wrote: post #307
fogihujy wrote: post #306

Earlier quoted context omitted.

While there's always demand for more bandwidth, IPv6 isn't really something that people care about in the larger scheme of things. Many ISP's and carriers solved the IPv4 congestion issue with CGNAT and that'll keep things going until we run completely out of IPv4 addresses. Once that happens, there will be government action. Not before.

We'll never completely run out of IPv4 addresses. Meanwhile the top agencies distributing IPv4 blocks have ran out of them a decade ago. Recently it was the time for a lower level agency to run out - for Europe. There's a lot of things that people don't care about until it's too late. Governments are supposed to be able to plan decades in advance. And they do, for things like digital TV. (And I already gave an exampl…

Politicians in Europe expects the market to take care of it. Businesses won't hurt their profit margins unless they have to (because IPv6 does mean additional costs).

We need something that increases consumer demand for IPv6 if we wantbthis to be dealt with now.

Re: My NAS exposes itself over the internet without permission

#310

Post by terramaster »

kotsec wrote: post #107

You should NOT have any terramaster NAS internet facing right now. I disclosed a bug last month to Terramaster that still hasn't been fixed. Go to http://NAS_IP/module/api.php?wap/ and it will give your admin password out as an md5crypt hash. Why? I assume it's some sort of backdoor/dev code but I don't know.

Hi friend, Could you please send a description of the specific problem to our email：support@terra-master.com? TerraMaster will do our best to serve every customer.
Post reply on HN