Today we're going to do a 3-minute low-down on the
CallStranger vulnerability that came out earlier
in June of this year. Much respect to the
Turkish cyber researcher Yunus Çadırcı
for the discovery. This vulnerability affects
the universal plug and play, or UPnP protocol,
affecting potentially billions of devices,
and maybe even the ones on your home network.
So what is universal plug and play? It's a
protocol that allows devices like printers,
Xboxes, computers, cameras, TVs, and other
gadgets to automatically discover one another
and open up ports on your router to be accessible
from the public Internet.
Super convenient right?
Well, it sounds great until you realize that
UPnP itself is wide open for abuse, helping
attackers discover and hack devices around
the world. Last year, we saw the first large-scale
attack from the Mirai botnet scanning hundreds
of thousands of routers, searching for exposed
telnet ports that probably got added by UPnP
when users installed new IoT devices that
needed these ports open. The attackers later
brute forced the default credentials to these
devices, many of them IP cameras and added
them to the botnet.
This time, rather than universal plug and
play helping punch holes into your home network,
it's the very hole itself. CallStranger works
by letting the attacker send special
UPnP SUBSCRIBE requests to elicit callbacks to
the device itself, directed anywhere. Here's
three ways this is can be really bad
First, attackers can use the vulnerability
to port scan devices sitting BEHIND your router
on your internal network. Not just the outside.
They can discover more UPnP-enabled devices
or map out vulnerabilities on these endpoints.
It's like a burglar who used to only have
Google Street view of your home, but now has
Google Indoor view on the inside of your house too.
With potentially billions of local network
devices around the world, attackers can also
create reflected or amplified DDoS attacks.
By sending these requests to millions of Internet-facing
devices vulnerable to CallStranger, attackers
can trigger a storm of web requests pointed
at a single target, taking down websites and
servers from the overload of traffic.
A third potential abuse is using these devices
as mules to exfiltrate data from an organization's
network. Once an attacker hacks into your network,
he can have a universal plug and play device
like a printer
forward any stolen data out of the network
to a command and control server.
So what should you do about this
in the meantime?
If you have a home network with universal
plug and play enabled on devices, make sure
your home router isn't port forwarding to
them so they aren't exposed to the Internet.
Otherwise, the device could be used as a participant
in DDoS attacks. You could also do everyone
a favor and disable universal plug and play
on your home router through its administration
portal and learn how to manually configure
your networked devices at home.
If you're an IT administrator or cyber analyst
at work, you should close UPnP ports and Internet-facing
devices if there's no business need. Then
block HTTP traffic containing the SUBSCRIBE
or NOTIFY commands with a web proxy or application
firewall as an extra measure. If you do need
UPnP for some devices, check their Internet
access and monitor your network logs to see
if adversaries have used CallStranger against you.
Yunus set up a great website at callstranger.com
that gives you more information about this
vulnerability. He's also written a Python
tool on Github that lets you check to see
if devices on your network are vulnerable
to this UPnP flaw. In this case, the tool
didn’t find any verified devices vulnerable
to CallStranger for me, but it’s definitely
worth checking your network if that’s really the case.
So that's it for this cyberspatial news update,
thanks so much for watching, and I'll see
you soon!