Imagine using My Network Places to browse for switches, routers, printers, digital cameras, and other peripheral devices. Now think about how convenient it would be if these devices were attached to the network and available for use without installing device drivers or performing a complicated setup routine. Does this sound too good to be true? It’s not.
The first version of Universal Plug and Play (UPnP) was included in Windows Me, and although it was far from perfect, it was a solid first step. Windows XP includes a revision of UPnP and with it, you can install network printers, Internet gateways, and various electronic devices, such as digital cameras and video recorders. I’ll cover here what an IT support professional should know about UPnP.
First things first: Secure your network
UPnP may make it easier to install and configure your network devices and peripherals, but it also has a couple of very serious security flaws that, if not patched, could give a malicious hacker the opportunity to gain control of your computer. If you haven’t already installed the patch to correct this problem, read this section, download the new code, and immediately install it. After securing your machines, you may then read on.
Buffer overruns have become one of the tricks of the trade with which hackers perform their devious actions. In the case of UPnP, a hacker can send to the machine a malicious Notify message, which will imitate the UPnP service and give the hacker system-level privileges on the Windows XP machine. This will effectively give the hacker total control over the system.
Another popular hacker trick that can be exploited through the UPnP service is the denial of service (DoS) attack. Someone can manipulate this flaw and cause a DoS attack through two possible methods. The first occurs when a device’s description is stored on a third-party server. In this scenario, a hacker could send a nefarious Notify request to a machine asking for its description. While this seems like a harmless task, it isn’t regulated in the Windows XP UPnP service. If the server has the echo service running on a certain IP port, it’s possible that the requesting system could be put into an endless cycle of downloading the description and clogging up the network with useless messages.
The second DoS attack method occurs if enough computers responded to the Notify request and flood the server with description requests. Again, the network would be brought to its knees by the overflow of useless messages.
The possibility of these types of attacks occurring relies on several circumstances being present, such as the UPnP service being installed. However, as more and more people begin to use UPnP, the chances of it occurring become greater. So, before you read any further, I recommend following this link to download the patch to fix this flaw.
Technical overview of Universal Plug and Play
Before I discuss some of the more technical aspects of UPnP, you should be familiar with some basic terms that are associated with this new technology:
- · Action: A command that causes a service to perform a specific function
- · Service: A function of a device that is controlled by the UPnP control point
- · Device: A container holding one or more services that are available for use
- · Control Point: UPnP client software responsible for sending and receiving actions and retrieving service and device descriptions
- · Subscription: The relationship that is formed between the UPnP service and a control point
- · Event: Messages that are sent from a device to a control point to provide continual information about the status of the device
Now that you understand some of the terminology that’s associated with UPnP, let’s look at how this technology works. UPnP is comprised of five components:
- · Discovery: When you connect a device or control point on the network, it advertises its presence using Simple Service Discovery Protocol (SSDP). The messages that are exchanged among devices and control points include information such as the device type, the kinds of services that are offered, a simple identifier, and a description URL that points to a location containing more detailed information about the device.
- · Description: Once a control point locates a device, it must obtain more detailed information about the device. During the Description process, the control point uses the URL description that was provided during Discovery. The URL points to an XML document that includes such things as the device make, model, serial number, manufacturer name, and other URLs to vendor-specific Web sites.
- · Control: After the control point has received the detailed device description, the Control component begins to gather the information that it needs to use the device. The control point sends control messages to the control URL for the service. This message, which is transmitted using the Simple Object Access Protocol (SOAP), contains additional XML-based information that determines how the device will respond.
- · Eventing: Now that the control point has subscribed to the service, it requires occasional event messages that announce any changes in the device status. This process is called Eventing. During this process, the update messages sent are established using the General Event Notification Architecture (GENA). These messages are XML-based and are sent using HTTP.
- · Presentation: The final component of the UPnP networking architecture is Presentation. If the UPnP device provides a Presentation URL, it will be used for browser-based management of the device. The control point is used to determine the presentation URL from the XML-based description document, load the page into the browser, and allow you to manage the device.
Activating and using UPnP
UPnP is, by default, not activated when Windows XP is installed. This is good in light of the security flaws discussed earlier. Installing UPnP is an easy process that takes just a few mouse clicks.
To begin the installation, select the Add Or Remove Programs icon from Control Panel. In the Add/Remove Programs dialog box, click the Add/Remove Windows Components button, as shown in Figure A.
The Windows Components Wizard dialog box will be displayed, as shown in Figure B. To reach the UPnP settings, select the Networking Services option and then click Details.
To install UPnP, check the Universal Plug And Play option, as shown in Figure C.
That’s it. UPnP has now been installed on your computer, and you’re ready to use it. To access UPnP devices on your network, open My Network Places. They will be displayed here, and you can use them by double-clicking on the appropriate icon.
How Universal Plug and Play benefits the IT professional
At first glance, UPnP might appear to be yet another security flaw in Windows XP that needs patching and constant vigilance. But under the appropriate circumstances, UPnP can provide both users and IT professionals with substantial benefits. For example, UPnP technology can be used to manage UPnP-enabled network devices such as switches and routers. In addition, UPnP will make asset tracking and inventory much easier, without additional software to install and configure.
The increased functionality for users will definitely benefit the help desk and support staff. For example, when users need to use a different printer, they’ll be able to locate the printer through My Network Places and print to it. There will be no more need to have the help desk staff configure the printer software because UPnP will handle those tasks. This will result in a more efficient use of the user’s time and fewer issues for the help desk and support staff.
Even though Windows XP is the second Microsoft operating system to include UPnP, some bugs obviously need to be worked out. With all software, the early versions can be rough around the edges. UPnP is a wonderful idea to help make peripheral device installation and use as easy for the everyday user as it is for the sophisticated technician and to simplify the IT pro’s work. It’s very early in the game, but the outlook appears promising, despite the security flaws found. For now, IT professionals will find UPnP useful for device management and the increased flexibility that it provides.