UNIVERSAL MEDIA SERVER PORT FORWARDING SERIES
UNIVERSAL MEDIA SERVER PORT FORWARDING FREE

What does UPnP have to do with Pinkslipbot? In effect, the entire Web is their playing field! It means that it’s almost impossible to maintain a list of known domains or addresses to filter out. The Pinkslipbot infrastructure therefore doesn’t have a fixed domain for their C2 servers.

Middle-malware: C2 servers can be anywhere! It has introduced, for lack of a better term, middle-malware, which infects computers, but not to take user credentials! Instead, the middle-malware installs a proxy C2 server that relays HTTPS to the real C2 servers. Of course, it becomes a cat-and-mouse game with the hackers as they find new dark spots on the Web to set up their servers as old ones are filtered out by corporate security teams.Īnd that’s where Pinkslipbot has added a significant innovation. The right defense against this is to block the domains of known C2 hideouts. After all, to an admin or technician watching the network it would just appear that the user is web browsing - even though the RAT is receiving embedded commands to log keystrokes or search for PII, and exfiltrating passwords, credit card numbers, etc. This is a stealthy approach in post-exploitation because it makes it very difficult for IT security to spot any abnormalities.

UNIVERSAL MEDIA SERVER PORT FORWARDING SERIES

When we wrote our first series on pen testing, we described how remote access trojans (RATs) residing on the victims’ computers are sent commands remotely from the hackers’ servers over an HTTP or HTTPS connection. Hackers have now found an even more diabolical use of UPnP with the banking trojan Pinkslipbot, also known as QakBot or QBot.Īround since 2000, QakBot infects computers, installs a key logger, and then sends banking credentials to remote Command and Control (C2) servers. In the case of Mirai, it allowed them to scan for these ports, and then hack into the device at the other end. However, this convenience factor provides an opening for hackers.

Unfortunately, with this convenience have come multiple vulnerabilities and large-scale attacks which have exploited UPnP. This is extremely convenient from a consumer perspective as it greatly decreases the complexity of setting up new devices. Via the Internet Gateway Device Protocol, a UPnP client can obtain the external IP address of for your network and add new port forwarding mappings as part of its setup process. UPnP is a convenient way of allowing gadgets to find other devices on your network and if necessary modify your router to allow for device access from outside of your network.

UNIVERSAL MEDIA SERVER PORT FORWARDING FREE

Discover the Top 5 Remote Security Threats to your workforce with our free whitepaper

Universal media server port forwarding