Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My NAS exposes itself over the internet without permission

kn100.me

Post reply on HN
Print view View original

101–110 of 311 posts

Re: My NAS exposes itself over the internet without permission

#101

Post by kalleboo »

ryandrake wrote: post #86
kalleboo wrote: post #28

Earlier quoted context omitted.

There are 2 parts to UPnP. One is service discovery, in cooperation with zeroconf (aka bonjour/mDNS). This is handled 100% by devices themselves. The other is the port forwarding protocol, where devices can ask your router to open a port in the NAT to the wide internet forwarded to them. This is done in the router. It's also a potential massive security hole. If you disable UPnP on your router, you only disable the s…

The service discovery isn't really the security hole though, is it? I mean I have mDNS configured on my LAN. It's the port forwarding, and specifically, configuring it so that any rando device on the network can set up port forwarding, which is the security problem. If you really want the dubious convenience of UPnP port forwarding, at least limit it to the one or two devices on your LAN that need it.

Right, service discovery is fine.

It's just that two things with wildly different security profiles get referred to with the same name

Re: My NAS exposes itself over the internet without permission

#102

Post by daniellarusso »

ryandrake wrote: post #86
kalleboo wrote: post #28

Earlier quoted context omitted.

There are 2 parts to UPnP. One is service discovery, in cooperation with zeroconf (aka bonjour/mDNS). This is handled 100% by devices themselves. The other is the port forwarding protocol, where devices can ask your router to open a port in the NAT to the wide internet forwarded to them. This is done in the router. It's also a potential massive security hole. If you disable UPnP on your router, you only disable the s…

The service discovery isn't really the security hole though, is it? I mean I have mDNS configured on my LAN. It's the port forwarding, and specifically, configuring it so that any rando device on the network can set up port forwarding, which is the security problem. If you really want the dubious convenience of UPnP port forwarding, at least limit it to the one or two devices on your LAN that need it.

No, mDNS it is not really the issue.

Even most VPNs won’t, by default, allow mDNS packets across, without adding a relay server and some additional configuration.

But, yeah, letting any application basically go into ‘server’ mode on your home network at-will is not the most secure setup.

Re: My NAS exposes itself over the internet without permission

#103

Post by chefkoch »

ryandrake wrote: post #96
watermelon0 wrote: post #57

Earlier quoted context omitted.

Sure, UPnP can open ports to the outside world, but that's something that might be desired in some cases. However, devices should default to local access only, and offer an option to expose them to the world, with appropriate warning.

You could also configure your Internet router to only allow one or two trusted devices to invoke UPnP to open ports.

Not the ISP supplied ones i guess.

Re: My NAS exposes itself over the internet without permission

#104

Post by rubatuga »

my123 wrote: post #71
rubatuga wrote: post #58

Earlier quoted context omitted.

Yes, it’s a feature supported by many VOIP clients, and this comments section is filled with UPnP apologists

As I said, "without going through a relay". And TURN is one of those relays. (I host a STUN and TURN relay myself, because I had to for my personal VoIP server for enough people to be able to connect on it. Downside is more use of bandwidth.) edit: replaced STUN with TURN where appropriate, I did confuse both as they were provided as a single package.

STUN is not a relay.

Re: My NAS exposes itself over the internet without permission

#105

Post by netflixandkill »

takeda wrote: post #43
alias_neo wrote: post #2

> Unfortunately, disabling uPnP these days is too much of a hit to convenience, so I looked for other solutions. Don't do this, there is no good reason to run UPNP if you care about security, turn it off and learn to manage a firewall. If the author really cares, go one step further and replace the ISP owned router with something with more control. Finally, if one cares about the software one's NAS runs, build or buy…

I find it amusing that many people are convinced that IPv6 is less safe, because there is no NAT, and at the same time use UPnP. No, NAT isn't designed for security, the blocking of incoming traffic is just side effect, you should use a firewall for security.

This sort of thinking is endemic in industrial networks; they finally internalized basic ipv4 concepts in the late 00s and never considered maybe the stateful tracking required for UPNP and other NAT tricks also might exist without it.

I've set up several private v6 networks to deal with renewable energy projects in which the integrator used the same ipv4 address blocks on every single one, and the whole 6to4 translation explanation landed like they had just seen a devil sorcerer graft a goat head onto a human.

Re: My NAS exposes itself over the internet without permission

#106

Post by [deleted] »

my123 wrote: post #71
rubatuga wrote: post #58

Earlier quoted context omitted.

Yes, it’s a feature supported by many VOIP clients, and this comments section is filled with UPnP apologists

As I said, "without going through a relay". And TURN is one of those relays. (I host a STUN and TURN relay myself, because I had to for my personal VoIP server for enough people to be able to connect on it. Downside is more use of bandwidth.) edit: replaced STUN with TURN where appropriate, I did confuse both as they were provided as a single package.

[deleted]

Re: My NAS exposes itself over the internet without permission

#107

Post by kotsec »

You should NOT have any terramaster NAS internet facing right now. I disclosed a bug last month to Terramaster that still hasn't been fixed.

Go to http://NAS_IP/module/api.php?wap/ and it will give your admin password out as an md5crypt hash. Why? I assume it's some sort of backdoor/dev code but I don't know.

Re: My NAS exposes itself over the internet without permission

#108

Post by dasyatidprime »

rubatuga wrote: post #104
my123 wrote: post #71

Earlier quoted context omitted.

As I said, "without going through a relay". And TURN is one of those relays. (I host a STUN and TURN relay myself, because I had to for my personal VoIP server for enough people to be able to connect on it. Downside is more use of bandwidth.) edit: replaced STUN with TURN where appropriate, I did confuse both as they were provided as a single package.

STUN is not a relay.

STUN is not a relay, but TURN is, and STUN/TURN is a common combo for when STUN doesn't manage to holepunch reliably, falling back to the relay when the direct connection fails.

What's also true, and what I think the GP was trying to get at, is that STUN requires an external coordination server. UPnP (I think—I am far less familiar with it) does not, because in UPnP you're negotiating the holepunching with the local router directly, whereas STUN is sort of using a loophole.

Re: My NAS exposes itself over the internet without permission

#109

Post by stonesweep »

Zombieball wrote: post #100
KozmoNau7 wrote: post #56

Earlier quoted context omitted.

Forwarded ports are not always static, we're not in the world of just web servers and SSH. Different devices may need to use VoIP, P2P, games and other applications that cannot be strictly mapped to just one system or even just one port. UPnP handles dynamic mappings, so you don't have to update your port forwards every time.

What’s wrong with static IP assignments? Doesn’t this solve the issue?

Story time: It depends on the hardware at your disposal. I'm now on the new T-Mobile Home Internet service, the router+wifi device supplied (a Nokia 5G LTE based unit with a SIM on one side) firmware has basically no configuration - you cannot assign static DHCP, no bridge mode, no port forwarding - it has UPNP on or off, that's it. A truly sparse webUI, frustrating no-config device at 1.0 firmware level that doesn't even show you what the DHCP ranges in use are. My G-Shock watch has more configuration options than this thing does. :-/

Re: My NAS exposes itself over the internet without permission

#110

Post by waffle_ss »

rubatuga wrote: post #88
dijit wrote: post #80

Earlier quoted context omitted.

On the other hand, if you want to play games on your network you absolutely must have UPNP. Unless the game has a dedicated server infrastructure. But even then you risk higher latency on VOIP if it even works at all.

This is completely false. Almost all home networks use port-restricted NAT, which allows for STUN for NAT traversal. You do not need UPnP to play games, even those that have peer to peer multiplayer. Also STUN for VOIP does not increase latency. It tells you your external IP and port. Edit: Port symmetric —> port restricted

I get the feeling you’ve never ran n>1 Xbox Ones connecting to Xbox Live at the same time. Without UPnP only one will be able to connect.
Post reply on HN