Last Updated: 2013-01-30 12:42:08 UTC
by Johannes Ullrich (Version: 1)
Rapid7 conducted a widely quoted study, scanning the Internet on port 1900/udp to find devices that expose UPnP . Universal Plug and Play (UPnP) is a protocol frequently supported by home gateways to automate firewall configurations. For example, an IP based security camera may use the protocol to instruct a firewall to open a port and redirect incoming traffic to it, allowing the user to monitor the camera from outside the own network. Online games use it in similar fashion to allow game servers to reach the host participating in the game. While UPnP itself is not exactly a "secure" protocol, in addition, implementations suffer from various flaws as the paper by Rapid 7 points out.
Rapid7 does offer a free Windows tool to scan your network. In addition, you could use nmap to find hosts supporting UPNP, but you will need a NSE script that sends an "M-SEARCH" request to trigger a response . A UPnP listener will not respond to a typical "empty" nmap UDP scan.
Here is a sample nmap scan using this NSE script:
sudo nmap --script upnp-info.nse -p 1900 -sU 192.0.2.1 Nmap scan report for somehost.mynet (192.0.2.1) Host is up (0.067s latency). PORT STATE SERVICE 1900/udp open upnp | upnp-info: | 188.8.131.52 | Server: Custom/1.0 UPnP/1.0 Proc/Ver | Location: http://192.168.1.1:5431/dyndev/uuid:3872c05b-c117-17c1-5bc0-12345 | Webserver: LINUX/2.4 UPnP/1.0 BRCM400/1.0 | Name: Broadcom ADSL Router | Manufacturer: Comtrend | Model Descr: (null) | Model Name: AR-5381u | Model Version: 1.0 | Name: WANDevice.1 | Manufacturer: Comtrend | Model Descr: (null) | Model Name: AR-5381u | Model Version: 1.0 | Name: WanConnectionDevice.1 | Manufacturer: Comtrend | Model Descr: (null) | Model Name: AR-5381u |_ Model Version: 1.0
Or you could try to scan on port 5431/tcp if you don't want to install the NSE script, or don't have root permission:
nmap -sV -p 5431 192.0.2.1 Starting Nmap 6.01 ( http://nmap.org ) at 2013-01-30 07:37 EST Nmap scan report for myhost.mynet (192.0.2.1) Host is up (0.008s latency). PORT STATE SERVICE VERSION 5431/tcp open upnp Belkin/Linksys wireless router UPnP (Linux 2.4; UPnP 1.0; BRCM400 1.0) Service Info: OS: Linux; Device: router; CPE: cpe:/o:linux:kernel
The difficult part is that the most vulnerable devices are the once with UPnP exposed on the external interface. In many cases these are ISP supplied routers and the end user may not be able to turn off UPnP.