Re. buggy KCode in routers

[Dror Harari]

It is worth mentioning in the podcast that for the many people who get NAT'ed ('shared') internet service, even if their 20005 port is open, it will still show as closed or stealth with @Steve's ShieldsUp - and thus even though their router is problematic, they would still be safe. Still, if they go on a direct connection, they might again be exposed.

 

[MichaelRSorg]

Pretty much everyone has NAT'ed Internet service. The open port is on the router, so it will show as open when using Shields Up. I think you are confusing an open port on a computer with one on the router. In this case, a direct connection to a modem would be safer than using a vulnerable router.

 

[Lob]

at the moment, the only thing that seems likely to happen if 20005 is open to the Internet (which in the buggy code, it's bound to all IPs so.......) is that the router will crash

BUT

one might assume that there are more flaws to be discovered and people are looking at this now. It's whether it can be weaponised against SoHo users is the bigger question.....especially if you have default username/password at your perimeter on these boxes....

 

[Dror Harari]

Pretty much everyone has NAT'ed Internet service. The open port is on the router, so it will show as open when using Shields Up. I think you are confusing an open port on a computer with one on the router. In this case, a direct connection to a modem would be safer than using a vulnerable router.

Michael, Lob - I think both of you mis-read me, which likely means I did not explain myself correctly - if you think I'm wrong let me know.

When I'm saying "many people who get NAT'ed ('shared') internet service" I mean that they connect to an ISP but they get an IP address behind a NAT at the ISP. That is the common case today due to the crunch on IPv4 addresses (to get a non-ISP-NAT'ted address we have to pay few bucks more per month). Thus, there is no way for ShieldsUp! to get at my home router at port 200005 directly as there needs to be an outgoing connection from my router on that port for anything to get to it. What ShieldUp! see is the big NAT router of the ISP which I am pretty sure does not have port 20005 open.

 

[EdwinG]

Michael, Lob - I think both of you mis-read me, which likely means I did not explain myself correctly - if you think I'm wrong let me know.

When I'm saying "many people who get NAT'ed ('shared') internet service" I mean that they connect to an ISP but they get an IP address behind a NAT at the ISP. That is the common case today due to the crunch on IPv4 addresses (to get a non-ISP-NAT'ted address we have to pay few bucks more per month). Thus, there is no way for ShieldsUp! to get at my home router at port 200005 directly as there needs to be an outgoing connection from my router on that port for anything to get to it. What ShieldUp! see is the big NAT router of the ISP which I am pretty sure does not have port 20005 open.

For everyone's clarity sake, you're referring to CG-NAT (or Carrier-Grade Network Address Translation).