What is UPnP? Should UPnP Be Enabled or Disabled?

What is UPnP?

Universal Plug and Play(UPnP) is a group of open format(not OS specific)) protocols designed to make network connectivity easier. It allows networked printers, cameras, storage devices, etc, to easily communicate their location and available services to other compatible network devices such as your computer using a protocol call Simple Service Discovery Protocol(SSDP). Once these services are announced a device can send control messages to use the listed services on the broadcasting device. It also allows applications, websites, etc to access these controls in XML using Simple Object Access Protocol(SOAP). This allows programmers to easily integrate hardware access into their website and software designs.

The downside of UPnP comes in it’s own internal security. It’s authentication protocol isn’t usually turned on by default. This means that when commands are received by a network device their legitimacy is not verified. Shady websites can use this vulnerability to take control of network devices and compromise the security of the entire network. The security holes that these attacks cause can let in other malicious data, such as viruses, spyware, worms, root-kits.

Should it be enabled?

While Universal Plug and Play technology may offer some greater integration of network device control, it is not necessary to use. Most network devices come with built in web interfaces and easy to obtain drivers. It may require the smallest amount of extra work on your part, but is is well worth the additional security. Any group of protocols that has such utter lack of security must be updated before wide-spread use by the public should occur. Use of this technology by laymen is gambling with disaster, and frankly not a smart choice. I think the motto, ‘Never buy the first model’, is very relevant in this situation. Unless you are a trained professional leave UPnP disabled and wait around for it’s successor.