Internet Accessible Ubiquiti Device Discovery Service

Verification

To establish if a host has an Internet accessible service, simple utility programs or tools included with the standard Linux/Ubuntu distribution can be utilised. The test should not be run on the host itself or from the local network, instead it should be run from a different node on the Internet.

Nmap - (Network Mapper) - (https://nmap.org)

To confirm an Internet accessible Ubiquiti Device Discovery Service, the 'Nmap' open source network scanner utility program can be utilised.

Nmap is used to discover hosts and services on a computer network by sending packets and analysing the responses.

Insert the IP address of the host you wish to check for an Internet accessible Ubiquiti Device Discovery Service when invoking the 'Nmap' open source network scanner utility program together with the options included in the following example.

$ sudo nmap -sU -p10001-oG - xxx.xxx.xxx.xxx

An Internet accessible Ubiquiti Device Discovery service listening on port 10001/UDP will return information similar to that shown below:

$ sudo nmap -sU -p10001 -oG - xxx.xxx.xxx.xxx

# Nmap 7.80 scan initiated Fri Aug 13 12:21:20 2021 as: nmap -sU -p10001 -oG - xxx.xxx.xxx.xxx

Host: xxx.xxx.xxx.xxx ()	Status: Up

Host: xxx.xxx.xxx.xxx ()	Ports: 10001/open|filtered/udp//scp-config///

# Nmap done at Fri Aug 13 12:21:22 2021 -- 1 IP address (1 host up) scanned in 1.52 seconds

Options

sudo   :Elevated privileges are required to access raw sockets.

-sU    :UDP Scan.

-p     :Only scan specified port.

-oG    :Grepable Output - This output places all results for a single host on a single line.

-      :Hyphen Symbol - Shortcut to send grepable output to STDOUT rather than to a file.

socat - (https://copyconstruct.medium.com/socat-29453e9fc8a6)

To establish a connection to an Internet Accessible Ubiquiti Device Discovery Service, and elicit a response from the Ubiquiti device, the 'socat' (socket cat) command line based utility for data transfer between two addresses can be used.

Insert the IP address of the host that has an internet accessible Ubiquiti Device Discovery service, together with the port number 10001/UDP.

An Internet accessible Ubiquiti Device Discovery service listening on port 10001/UDP will return information similar to that shown below:

$ echo -ne "\x01\x00\x00\x00" | socat -t 1 udp:xxx.xxx.xxx.xxx:10001 - | hexdump -C

00000000  01 00 00 9a 02 00 0a 24  a4 3c 93 a9 ff b9 1f 60  |.......$.<.....`|

00000010  63 02 00 0a 24 a4 3c 92  a9 ff c0 a8 01 01 01 00  |c...$.<.........|

00000020  06 24 a4 3c 92 a9 ff 0a  00 04 00 0e 7a 93 0b 00  |.$.<........z...|

00000030  2a 48 41 43 4b 45 44 2d  52 4f 55 54 45 52 2d 48  |*HACKED-ROUTER-H|

00000040  45 4c 50 2d 53 4f 53 2d  57 41 53 2d 4d 46 57 4f  |ELP-SOS-WAS-MFWO|

00000050  52 4d 2d 49 4e 46 45 43  54 45 44 0c 00 03 4c 41  |RM-INFECTED...LA|

00000060  50 0d 00 0c 41 69 72 77  61 76 65 5f 57 69 66 69  |P...Airwave_Wifi|

00000070  0e 00 01 03 03 00 22 58  4d 2e 61 72 37 32 34 30  |......"XM.ar7240|

00000080  2e 76 35 2e 35 2e 36 2e  31 37 37 36 32 2e 31 33  |.v5.5.6.17752.13|

00000090  30 35 32 38 2e 31 37 35  35 10 00 02 e4 a2        |0528.1744.......|

0000009e

Options

echo                  :Command that outputs the string it is being passed as arguments.

-n                    :Option - Do not output the trailing newline.

-e                    :Option - Enable interpretation of backslash escapes.

"\x01\x00\x00\x00"    :Binary Payload Data.

|                     :Pipe Character - Connects the STDOUT of the first process to the STDIN of the second process.

socat                 :socat command line utility.

-t                    :Timeout [timeval] seconds.

xxx.xxx.xxx.xxx:10001 :Socket Address - Transport protocol:IP Address:Port Number.

-                     :Hyphen Symbol - Shortcut to read in the STDIN and process it.

|                     :Pipe Character - Connects the STDOUT of the first process to the STDIN of the second process.

Hexdump               :Hexdump utility displays the contents of binary file in hexadecimal, decimal, octal or ASCII.

-C                    :Option - Canonical hex+ASCII display.

Solution

If the Ubiquiti Device Discovery Service is not required, disable it.

If the Ubiquiti Device Discovery Service is required, restrict access to trusted clients or specific IP addresses by blocking incoming connections to port 10001/UDP on the firewall.

Supplementary Information