whats secure_mode (miniupnpd.conf)

Question

I am trying to set miniupnpd (UPnP server), but please point out if you understand miniupnpd.conf secure_mode.

When set to secure_mode = yes, miniupnpd will assign the IP address of the local network to the client.

that's ok?

secure_mode

There is a comment in miniupnpd.conf as follows:

https://github.com/miniupnp/miniupnp/blob/master/miniupnpd/miniupnpd.conf

# Secure Mode, UPnP clients can only add mappings to their own IP
#secure_mode=yes
secure_mode=no

I understood that secure_mode is the one that assigns the local IP address to the client.

background

Why did I ask a question like this, Google search for secure_mode hit information about vulnerability.

CVE-2016-10185

An issue was discovered on the D-Link DWR-932B router. A secure_mode=no line exists in /var/miniupnpd.conf.

Although it seems to be a D-Link limited router vulnerability, the setting secure_mode = no is the default setting in miniupnpd.conf.

I read the reproduction code. this vulnerability seems to be "access restriction by IP address is not done and secure_mode = no".

Access restrictions are as follows.

allow 1024-65535 192.168.0.0/24 1024-65535
deny 0-65535 0.0.0.0/0 0-65535

question

CVE-2016-10185 is written only as "Do not write secure_mode = no", but it is not so, as it is not restricting access.

That is, if secure_mode = yes, miniupnpd will assign the IP address of the local network to the client. Therefore, I understanding that you can restrict access even if secure_mode = no is set. that's ok?

Answer 1

miniupnpd will assign the IP address of the local network to the client.

No, UPnP doesn't assign IP addresses (DHCP does that). UPnP in this context adds mappings, firewall rules that allows connections through NAT. This in general is a dangerous idea, whether it's in secure_mode or not:

• Chris Hoffman, Is UPnP a Security Risk?
• Andy Green, What is UPnP & Why is it Dangerous?

# Secure Mode, UPnP clients can only add mappings to their own IP

While the access restrictions disallows connections to low ports (system or well-known ports, <1024) on the local network, it doesn't protect anything listening on other ports. The secure_mode = yes checks that the client is requesting a firewall rule for itself.

Scenario with secure_mode = no:

1. Someone orders a Smart Dishwasher from China, embedded with a malware. It's connected to your company network using WiFi and has DHCP assigned IP address 192.168.0.196.
2. You have an internal web server on alternative HTTP port 8080, http://192.168.0.20:8080/.
3. The dishwasher requests your miniupnpd to allow access to 192.168.0.20:8080.
4. Everyone has access to your internal web server.

With secure_mode = yes the diswasher has to do something more active, e.g. perform as a reverse proxy or actually steal the data and send it away. The dishwasher could also be any BYOD device!