Hacker News Reader

Comment by chx | Hacker News Reader

Let me grab this occasion to ask: WTF is going on in general? I readily presume most people have a wifi router with these iot devices and while obviously those are not the best security wise (I presume again most don't run pfsense or openwrt) but still they are there, NATting away happily. How would a baby monitor appear on the open web...? I can't imagine the average user setting them up in DMZ or port forward or ... what is happening here? I am obviously missing some primarily home networking oriented protocol probably because I am configuring my own routers and I am simply unaware of some feature of the factory firmware that allows traffic inwards.

View on HN

I don't use those products, but I can imagine many of them automatically doing port forwards (https://en.wikipedia.org/wiki/Universal_Plug_and_Play#NAT_tr... ) and possibly even automatically registering in a dynamic DNS service, all for the "convenience" of the "I don't know what a port is and I don't want to know" user.

> Many routers and firewalls expose themselves as Internet Gateway Devices, allowing any local UPnP control point to perform a variety of actions, including retrieving the external IP address of the device, enumerate existing port mappings, and add or remove port mappings.

Are you bloody kidding me? Why do you even have a firewall, rudimentary as it is, then?

UPnP comes from the view that NAT is an unfortunate artifact of residential ISPs only giving out one IPv4 address per household, not a crucial security strategy.

If you really think of your NATing router as a security device, turn off UPnP. Though I'm not sure how much good that will do, as any device can still phone home or reverse tunnel.

Sure but port scanning and forming a massive botnet is impossible if they are not even capable of listening on an open port which NAT gives you for free. It's like the lemonade you could make when life you gives you lemons. Except now it's spoiled too.

On the other hand, UPnP is the only currently viable strategy for average people to run devices on their home networks and control them from the internet without looping in a third party server.

Not all home routers are allowing this by default. I don't have any hard numbers to offer, but my feeling is that only very old and today's very crappy ones do.

Reply on news.ycombinator.com