Slashdot Mirror
Printers Vulnerable To Security Threats
jcatcw writes "Networked printers are more vulnerable to attack than many organizations realize. Symantec has logged vulnerabilities in five brands of network printers. Printers outside firewalls, for ease of remote printing, may also be open to easy remote code execution. They can be possible launching pads for attacks on the rest of the network. Disabling services that aren't needed and keeping up with patches are first steps to securing them." From the article: "Security experts say that printers are loaded with more complex applications than ever, running every vulnerable service imaginable, with little or no risk management or oversight.... [N]etworked printers need to be treated like servers or workstations for security purposes — not like dumb peripherals."
Over the past several years, if you did a random port scan of the Internet (nmap -iR) the majority of open telnet (tcp port 23) servers were print servers that let you telnet in and change all sorts of settings.
------ Take away the right to say fuck and you take away the right to say fuck the government.
Dwight:
At 8 AM today, someone poisons the coffee. Do NOT drink the coffee. More instructions will follow.
Cordially, Future Dwight.
One of my colleague told me about a printer that started printing page after page of funny characters. It seems there was a virus in the network, trying to write himself on all shares - of which the printer had one.
How much is able one of those printers to do? Printers dedicated to big offices have a pretty powerful processor, lots of RAM, hard drive. Taking control of such a printer could be just as useful for a black-hat cracker as taking control of a computer there, with the bonus that printers aren't usual suspects for infections
...print out pictures of Viagra?
"It does not do to leave a live dragon out of your calculations, if you live near him." - Tolkien
Printers have been network servers for a long time now. I have a 1995 vintage networked laser from Digital Equipment Corporation (rest in pieces) and its manual tells the exact procedure to get to the command line, by using a default password and telnt. Yes, this printer has a unix-like command line interface for configuring its print server functions, and anyone who knows the IP address and the password can get in. Needless to say I've been careful to keep the printer behind my firewall box.
Anyone remember the story about the guy who wrote a "visual basic" virus to send the O RLY owl to all printers in the company?
Maybe we'll see a lot of these coming, it'll be fun *hee hee hee* {devilish laugh}. I don't have a printer }:-]
Syllable 0.62 is here at last!!!
Even worse, such attacks may jam the printers, making it impossible to print out important Dilbert cartoons.
Vincent J. Murphy
Spandex Justice
Was years ago I hacked my employer's printer to say: "Insert Coin" instead of "Ready" and "Feed Me" instead of "Paper tray empty" ... and I know I could have done a lot worse.
Nick Waterman, Sr Tech Director, #include <stddisclaimer>
You don't want to become a victim of printer hacking. A malicious printer hacker could print out sheet music of copyrighted songs, stills from copyrighted movies, or child pornograhpy - leaving you a target of litigaton from the *AA or worse. Not to mention all the juvenile pranks like printing all your valuable company memos in l33t speak.
Protect your printers today!
I wonder when Symantec will release their first security software suite for printers...
Insisting on "correct" English is like saying that there is only one, definitive recipe for chili.
On many if not most college campuses the printers are administered and accounted for my a system tied to a student id. Each student can get so many free prints per semester and can pay per print after exceeding that. Malicious code executing on a print server could sniff all the student accounts accessing the printer.
http://www.vistahelpforum.com/
Windows Vista Help Forum
Laugh if you want, but this was what happened to Iraq on the eve of the Gulf War. A modified printer was put onto their defense computer network by an Allied operative. Right when the air war started, the bug fired up and brought down the network. Just because a threat sounds outlandish does not mean it isn't a real threat.
(The story was recounted in The Generals' War.)
A NYC lawyer blogs. http://www.chuangblog.com/
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
I figure it's safer to assume that anything connected to the network could be an attack point. If you have a network toy like some light-up furby that connects to the network and changes color based on packet throughput, that thing probably has no security whatsoever on it (even assuming it has embedded linux or something).
stuff |
Symantec is really grasping at straws here. In the age of internet security, why anyone would put a printer outside the firewall is too far beyond me to comprehend. Any firewall admin should be able to put rules in place for remote printing. And for that matter, why does any one need to remotely print? Anybody heard of email? Ol' deskjet at home too slow? Users in the office too lazy? Too many pebcak errors? Remote printing may be the most worthless of the worthless network setups. Also, why are people not using external secure computing devices. This stuff is not that expensive for the return it gives.
Symantec is quaking in its boots and instead of shouting fire in a theater they should be looking at what they have and capitalizing on it. Why else would they buy Veritas? I'm sure it wasn't because it they wanted to add AV to it.
Imagine those companies that sell expensive toner and ink cartridges pairing up with someone to write some malicious code to burn through your printing supplies faster.
It won't be long before you hear about something like the "Page_Blackout" or "Toner_Drain" worm.
We used these REGULARLY to exploit banks, in our testing.
The high-end HPs had both harddisk, and a JVM with listening socket on port 80. WHeee!
"Flyin' in just a sweet place,
Never been known to fail..."
"Printers worldwide slammed with requests to print the goatse man"
Monstar L
Given my past experience with the high quality of Symantec products we'll be switching to clay tablets and cuneiform.
In the long run, it will be easier and more cost effective.
Unlike, of course, printers behind firewalls, which are not at all open to remote code execution, since there's no chance that anything attached to the firewalled network will ever be hacked. Ah, the magic of the firewall.
- telnetting in
- For a base of operations
- As an aid in information gathering
- Denial of service
- Printing garbage as an annoyance
- Causing apparent hardware failure, distracting service personnel from real attacks
- Damaging the device with invalid NVRAM
- Loss of integrity: modify interpreter to change printing behavior in some mission-sensitive way.
For example, you could display "028*: Radon Discharge Hazard" or some other nonsense trouble symptoms at random intervals on the control panel. The techs in charge would then have to deal with that problem, while you attack their database server or other target. With a modified Postscript interpreter, you could insert random words or even carefully selected phrases in documents as they printed, using the same font that the document prints. How often do people proofread the text of a document they just proofread on screen? Only if they printed it to proofread it, and even then they might not notice. Also, printers in network environments often have file storage space, which makes them a target both to corrupt, if their storage is used in production. If the area is not used in production, it can be used by a rogue to hide things, since typically no one looks at that storage area if it's not in production.sigs, as if you care.
And if you had some search engine toolbar installed, and printer was visible to the outside, its config page was probably snitched to the rest of the world.
One line blog. I hear that they're called Twitters now.
The whole reason he went into open source movement is because some printer was running proprietary software that he couldn't fix. At least now anyone can download source code from HP website and modify the way your printer works in any way they want.
FX of Phenoelit gave an amazing talk on this at CanSecWest/core03 back in 2003 that outlined how to turn a JetDirect printer into a webserver, fileserver or even a port scanner! We all had a huge chuckle at the thought of someone tracking down a port scanner on the network only to find it was coming from an HP printer.
The entire presentation is still available online in both PDF and PPT format.
The tools used to hack the printers are available here.
Of course, this also means that I can't stick up a website for the world from my laptop anymore, either. =/ Ah well.
The World Wide Web is dying. Soon, we shall have only the Internet.
I work in the networked printer/multifunction industry. While HP is popular on desktops, other brands are gaining, and rule in the 50ppm+ arena. These devices come from other vendors like Canon, Sharp, Kyocera and Xerox. These multifunction devices provide scan, fax and print services and run a variety of OS's from VxWorks to Solaris. Yes Johnny, that means Windows XP embedded as well. Although I have to say, I haven't seen a DOS based controller in about 6 years.
We routinely receive questions about security, and help patch and configure these boxes to meet network security requirements as closely as possible. Unfortunately, we have limited access to the core OS, so we go as far as we can and workaround the rest. Many vendors, especially those using Windows, provide controller patches with security fixes included. EFI even allows an admin to RDP in and use Windows Update to keep current
These devices aren't perfect, but they have come a long way. That being said, if you haven't heard about this in the past, you have no business being in charge of network security. Multifunction devices today are just as powerful as your desktops and servers, running the same software. Admin control is limited, and vulnerabilities are a reality - note the recent Xerox vulnerability
I would say it is important to stay in contact with your local vendor/dealer to stay on top of these issues. We work with these products everyday, and receive regular notices about security issues and solutions, not to mention a wide variety of other product data. We are a resource, just like any other outside consultant, to help you get and stay secure.