Risks Associated With Connections to Public URLs on Firewall Consoles

Why I prefer admin consoles that limit internet connections

⚙️ Check out my series on [*Automating Cybersecurity Metrics](https://medium.com/cloud-security/automating-cybersecurity-metrics-890dfabb6198). The [Code](https://github.com/tradichel).*

🔒 Related Stories: [*Unif](https://medium.com/cloud-security/ubiquiti-dream-machine-pro-b9a4f68c254d)i* | [*Dream Machine Pro](https://medium.com/cloud-security/ubiquiti-dream-machine-pro-b9a4f68c254d) | [Ubiquiti](https://medium.com/cloud-security/ubiquiti-dream-machine-pro-b9a4f68c254d) | [Network Security](https://medium.com/cloud-security/network-security-68e1f26db9df)*

💻 Free Content on* [Jobs in Cybersecurity](https://medium.com/cloud-security/cybersecurity-careers-and-jobs-69c05616d2b4) | *✉️ Sign up for the [*Email List](https://2ndsightlab.medium.com/subscribe)*

There are a lot of cool things you can do with the information in your security appliances and firewalls to glean information about your applications and users. That’s all really cool.

But there’s a catch — depending on how you do it you may be leaking information that gives attackers information on what to target — either by providing information about the location of a device or an administrator.

Let me show you want I mean.

The Ubiquiti UDM Pro has a couple of nifty features that I like — but they come with a privacy leak cost.

Note: Ubiquiti told me they are planning to make some changes to the features mentioned in this post. Keep an eye out for those updates!

The first one is the ability to tell what applications are most in use on your network. This is really handy. If you see something unexpected you can look into it and figure out why it’s there. If you see an overabundance of a certain type of traffic maybe your kids aren’t really doing their homework…

And other cool stuff like that. 😁

You can get to this page called “insights” by clicking the balloon-like icon on the left.

I really dig this page but I wish they would change one thing. It’s reaching out to the public internet to get the icons.

At first I thought it was related to this pop up:

But actually the url is going to something like this:

https://static.ui.com/dpi/Web_Wikipedia_1270.png

I wish those icons were bundled with the firmware update instead.

Why do I care? Well, when I open a browser, it’s reaching out from my browser through the UDM to get these images. That means that anyone looking at the traffic in transit probably knows there’s some kind of Ubiquiti device on the edge of that particular network. Then if there’s any sort of new zero day out and they have a database of all the Ubiquiti devices they can quickly figure out which IPs to target with that attack.

Of course, they could probably figure out which devices are Ubiquiti devices if people have auto-update turned on as well right? Every time the device updates, then they can see that traffic and know there’s a Ubiquiti device at that location. To get around that you could possibly update the device offline or only do updates at very specific times and reduce the amount of traffic to the ubiquiti servers.

[embed]Supply chain security: Updating and verifying firmware offline Updating UDM Pro Firmware offline prior to connecting to the Internetmedium.com

But here’s the other thing. Not only do they know that there’s a Ubiquiti device on that network, they know when an administrator is logged in and using that device because it is requesting those images. That might make it easier to hide malicious traffic and make it appear as if an administrator is sending the traffic when they are not.

The other thing that does is opens up the device to real time code injection as I wrote about here:

[embed]Real-time third-party code injection The risk associated with inclusion of externally-hosted code on websites and how to mitigate itmedium.com

I use image tags all the time in XSS attacks.

“Well, Ubiquiti would never do that!” you say.

OK well what if your DNS cache gets poisoned or someone gets onto your system through some vulnerability and adds a bad /etc/hosts record, just to name a few potential ways to exploit this. What if they can perform some kind of cache poisoning on the system were the images come from?

Putting them in the firmware eliminates those risks. Or allow customers to update those icons separately otherwise display a generic icon if they don’t want to download the images. Or give them the option to push a button to connect and download all the images one time.

But here’s the other problem. If I must have Internet access from the laptop using the admin console to function properly, then I can’t set up the admin console on a separate port with no internet access as I did here for my pfSense.

[embed]Configure a Separate Admin Interface on pfSense Create an admin-only interface for managing your firewallmedium.com

Here’s something else that’s reaching out to the internet — the map functionality.

This is really cool, but once again you’ve got a risk of real time code injection at this point.

How could you get around this? Well, unfortunately the answer is what no one wants to hear. You have some offline way of accessing the logs and viewing all this data instead of having be real-time on your firewall device.

But in my case, I like the functionality the UDM Pro provides. I just run it on a separate segregated network on my pfSense and put it behind a second firewall that is locked down to not allow traffic I don’t want reaching the internet and where I have less internet interaction from the console and more restrictive rules.

That said, I’ve found some pretty serious bugs in the pfSense code. So nothing is perfect. You have to monitor and evaluate the security of all your systems all the time. There are always trade-offs. In this case, I get more visibility into my traffic but on the other hand someone knows I’m logged into my admin console while I’m looking at it potentially. Any vulnerabilities could lead to an RCE through some link connected to the Internet on the admin console — in my browser if it’s code running in my browser.

Oh and ironically, after publishing this and writing about how the pfSense console mostly does not make Internet connections. I logged in today and there was a popup in pfSense sending me to Survey Monkey to take a survey about their product. Really? Or was that some kind of joke…very funny.

Also, full disclosure, I helped architect a system like this in the past that ran on AWS. One of my approaches was to segregate the different services — accounts and billing, logs and reporting, configuration, and device interactions — into separate teams with separation of duties. I was incredibly concerned about the interactions involved in storing configurations in the cloud.

There are definitely some benefits to that approach — and a lot that can go wrong. So as with everything, it depends on your security risk profile as to which features you turn on and use in your environment. In my case I have different potential risks than say, providing wifi at a football stadium, at coffee shops, or in an airport.

There’s one other type of traffic I’ve been trying to understand and that is the STUN traffic coming out of the device. I looked at that to some extent here. It may be completely expected but it doesn’t mean I have to like it. This traffic gets blocked by other firewalls. I just don’t know why it has to be there if I haven’t hooked up anything that requires peer to peer connectivity or real time communications.

[embed]How to Figure Out What’s Running On a Specific Port on Linux Some strange process is running on a particular port — what is that?medium.com

I’m sure it has a purpose. I just don’t yet know what it is. And for the firewall connected to the edge in my network, I’d prefer to not have that running. For this reason I segregate this device off on a pfSense as mentioned so I can monitor what it’s doing and in this case, block any STUN traffic because at this point I don’t think I need it. If and when I do, I can open up those ports.

Ubiquiti has a bug bounty program on Hacker One so I’m sure this is well tested, but still something to keep an eye on.

Follow for updates.

Teri Radichel | © 2nd Sight Lab 2025

About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab

Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation

Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab