The good news is, if you disable Universal Plug and Play in your router, then Hamachi, like anybody else, will not be able to do this.

STEVE: They're being opened by the applications because the routers have Universal Plug and Play enabled in the router.

A lot of routers rushed into having, oh, yes, we support Universal Plug and Play, too.

Now, we should say that this is a Universal Plug and Play server, and that's only facing the LAN side.

But if you enable Universal Plug and Play on a router, and something did get into your machine that could talk to the router, then you're in trouble.

And as we know, NAT is very good security as long as you have Universal Plug & Play disabled.

Except that Universal Plug and Play, UPnP, explicitly allows this.

If you have Universal Plug and Play enabled, any machine in your network can open ports through your router.

Except that, if something does get on your system, and you allow Universal Plug and Play, it just opens the ports and says c'mon in, guys.

Port forwarding with UPnP (Universal Plug and Play)