UPnP flaw exposes millions of network devices to attacks over the Internet

Unsafe for more than a decade, universal plug and play strikes again.

A cartoon demonstrates a household using multiple internet devices.

Enlarge (credit: US GAO / Flickr)

Millions of routers, printers, and other devices can be remotely commandeered by a new attack that exploits a security flaw in the Universal Plug and Play network protocol, a researcher said.

CallStranger, as the exploit has been named, is most useful for forcing large numbers of devices to participate in distributed denial of service—or DDoS—attacks that overwhelm third-party targets with junk traffic. CallStranger can also be used to exfiltrate data inside networks even when they’re protected by data loss prevention tools that are designed to prevent such attacks. The exploit also allows attackers to scan internal ports which would otherwise be invisible because they’re not exposed to the Internet.

Billions of routers and other so-called Internet-of-things devices are susceptible to CallStranger, Yunus Çadırcı, a Turkish researcher who discovered the vulnerability and the wrote the proof-of-concept attack code that exploits it, wrote over the weekend. For the exploit to actually work, however, a vulnerable device must have UPnP, as the protocol is known, exposed on the Internet. That constraint means only a fraction of vulnerable devices are actually exploitable.

Read 10 remaining paragraphs | Comments

Antibody testing suggests immune response post-COVID is very variable

And many of the tests available to the public produced variable results.

Image of a woman finishing a blood donation.

Enlarge / Melissa Cruz elevates her arm after donating COVID-19 convalescent plasma as phlebotomist Jenee Wilson shuts down a machine. (credit: Karen Ducey / Getty Images)

How much of an immune response does a SARS-CoV-2 infection produce? It's a critical question for all sorts of reasons. To begin with, long-lasting immunity, either through an infection or a vaccine, is critical for any hope of returning the world to something that resembles its pre-pandemic state. It's also essential to understanding how safe people who have recovered from infections are and how they can behave in the face of continued outbreaks and spread.

But there are also more subtle public policy issues. Since testing wasn't generally available at the time of many outbreaks, we'll need antibody tests to figure out who was actually exposed. And the accuracy of those tests—which has been called into question—can have a big influence on studies of the pandemic's progression.

A bunch of recent draft papers have looked at the sort of immune response we're seeing in patients who have cleared the virus after testing positive for it. And the results suggest that it's very variable—as is the quality of the tests that detect it. (We'll remind you that pre-publication documents carry some quality risks.)

Read 13 remaining paragraphs | Comments

Diskriminierung: KI ist nur so fair wie die Menschen, die sie programmieren

Angesichts weltweiter Proteste gegen Rassismus trennt sich etwa IBM von künstlicher Intelligenz, die Diskriminierung verfestigen kann. Das Problem liegt aber nicht in der Software, sondern in den Entwicklereams. Ein Bericht von Miriam Binner (Diskrimin…

Angesichts weltweiter Proteste gegen Rassismus trennt sich etwa IBM von künstlicher Intelligenz, die Diskriminierung verfestigen kann. Das Problem liegt aber nicht in der Software, sondern in den Entwicklereams. Ein Bericht von Miriam Binner (Diskriminierung, IBM)