Multifunction Printers — The Forgotten Security Risk?

eweekhickins writes to share an article in eWeek highlighting the forgotten risks that a multifunction printer could possibly offer. Brendan O'Connor first called attention to the vulnerabilities of these new devices at a Black Hat talk in '06 and warns that these are no longer "dumb" machine sitting in the corner and should be treated with their own respective security strategy. "During his Black Hat presentation in 2006, O'Connor picked apart the security model of a Xerox WorkCentre MFP, showing how the device operated more like a low-end server or workstation than a copier or printer--complete with an AMD processor, 256MB of SDRAM and an 80GB hard drive and running Linux, Apache and PostGreSQL. He showed how the authentication on the device's Web interface can be easily bypassed to launch commands to completely hijack a new Xerox WorkCentre machine."

Comments

First virus

[IdeaMan]

Wasn't one of the first Mac viruses spread by a mac printer?

Re:First virus

[vux984]

Wasn't one of the first Mac viruses spread by a mac printer?

There was a famous trojan that infected apple laser printers via postscript... but I don't think it 'spread' itself so it wasn't really a virus, nor would it qualify as a Mac virus because it didn't infect Macs, just some Apple Printers.

In any case I think it just lived on the printer. Although one of its effects was to change the password, something that could only be done a limited number of times for some demented reason, which meant eventually the printer would lock you out, and you couldn't reset the password without swapping in a bios or pram, or something along those lines.

Nonetheless, yes, laserprinters have been 'servers' in their own right for over 20 years, so this is hardly news. The same is true of NAS, Routers, managed switched, and so forth. And as for an 'IT security strategy" really, what can you do? Be aware its possible, and limit your attack surfaces to a level appropriate to the risk of them being compromised and the level of damage they could do if compromised.

For most of us, "Don't put your printer on the internet" is probably sufficient"IT security strategy"... although for higher security installations, something more detailed would be required.

Re:First virus

[Anonymous Coward]

The funny thing is, when I was setting up our office network I put the printers in their own network (no router), with the print server being the only host able to access both the printer network and the office network. All print jobs were routed through the print server. All scan jobs were available on the print server's file system.

The sysadmin who came in after me decided this was a boneheaded decision made by a network NAZI, replaced all my Linux boxen with Windows boxen, moved the printers onto the workstation network... and then hacked up a bunch of procedures (as in, words on a page that a human has to act upon) for "securing" the printers so that only marketing people can get to the (expensive per page) colour printer, for example. The security works by only configuring the printer on the desktops of the people who are supposed to be allowed to use it.

When I point out the possibility of PostScript viruses infecting the printers and possibly turning them into vectors of attack, I'm labelled "paranoid" and dismissed.

After all, it will "never happen to us."

In the meantime, the administrator is continually policing desktops to remove unauthorised installations of the printer driver for the colour printer, while we keep burning about $100/month on unauthorised use of that resource.

That's the problem with Microsoft Windows zealots. It's the 99% of them that give the other 1% a bad name.

Re:First virus

[Anonymous Coward]

The sysadmin who came in after me decided this was a boneheaded decision made by a network NAZI, replaced all my Linux boxen with Windows boxen

Maybe they realized that anybody that uses the word "boxen" is a douchebag that can't really be taken seriously.

Re:First virus

[arth1]

Dunno if it was the first network printer hack, but I remember having great fun telnetting to our networked printers more than a decade ago, making the tiny LCD display say "Insert Coin".

Re:First virus

[nilbud]

Completely true

Re:First virus

[Mister Liberty]

Dunno if it was the first network printer hack, but I remember having great fun telnetting to our networked printers more than a decade ago, making the tiny LCD display say "Insert Coin".
You should have made that 'Sugar Y/N/Double'

Re:First virus

[Vectronic]

All your boxen are belong to us...

Re:First virus

[Anonymous Coward]

"Dunno if it was the first network printer hack, but I remember having great fun telnetting to our networked printers more than a decade ago, making the tiny LCD display say "Insert Coin"."

Fun for you, sure. YOU didn't have to clean the coins out of the gears.

Re:First virus

[Anonymous Coward]

I remember having great fun telnetting to our networked printers more than a decade ago, making the tiny LCD display say "Insert Coin". Hell, I still do this. Actually, making the LCD say "Paper Jam" is my personal favorite.

Re:First virus

[|Cozmo|]

That's awesome. I did something similiar to the verifone credit card machine at my first job. I changed the "swipe card" prompt to say "access denied" and everyone thought the machine was broken. They didn't think it was nearly as funny as I did.

Re:First virus

[Agripa]

PC Load Letter

Re:First virus

[Endymion]

In the meantime, the administrator is continually policing desktops

I believe we call this "Job Security".

Re:First virus

[Anonymous Coward]

What the fuck does that mean?

Re:First virus

[X0563511]

Just the other day I discovered this "hack".

The Lexmark laser printer in my class now reads "PC LOAD NAPALM". Good times!

Re:First virus

[spasm]

Meh. For those too lazy to telnet, Google hpsetdisp.pl for a quick perl script to change the lcd display of any HP with JetDirect (ie most modern ones)

Re:First virus

[Trogre]

It means that some moron has sent a job to the printer in US Letter again. Just hit OK to have it print from the A4 tray.

Re:First virus

[J.Y.Kelly]

Someone pointed me to this nice little script which uses the JetDirect language to change the display on most recent HP printers.

Plenty of potential for confusing coworkers...

Re:First virus

[YttriumOxide]

It'll actually work on most devices that accept that PJL command... including Fiery RIPs.

It does actually have a real world use by the way - it's nice to customise the display during specialised operations, but in most environments these days, it is a little bit antiquated to do so.

Re:First virus

[nosfucious]

Actually, I think that's more "Busy work". Which may (or may not) translate to job security.

At least s/he looks like they're busy.

The trick is to continually make reports on security/installations/network status. Scripting language of choice here or Zabbix or WMI queries et al. ??? Then Shaldot/Facebook/Pr0n/2girls1cup or whatever bakes your cookie.

So what's the potential threat?

[daveywest]

Are we going to have a bot net of machines that print our spam for us?

Re:So what's the potential threat?

[Adriax]

Fear the Goatse printer virus.

Re:So what's the potential threat?

[KublaiKhan]

More evil would be a system that forwards the documents printed to another location....

Re:So what's the potential threat?

[AuMatar]

No, they print out a ransom note, demanding $1,000,000,000 or they'll print out all our spam. Management will pay, because at the current cost of ink the billion is cheap.

Re:So what's the potential threat?

[whoever57]

Fear the Goatse printer virus.

Oh, that is just pure evil! Imagine a printer that randomly inserted a small number of Goatse pages in its output.

Re:So what's the potential threat?

[__aajfby9338]

Where's that "-1,000,000: Causes Projectile Vomiting" mod when we need it? :-)

Re:So what's the potential threat?

[VampireByte]

The biggest threat is PC Load Letter messages causing you to lose your temper.

Re:So what's the potential threat?

[Anonymous Coward]

If you want projectiles, tubgirl is what you're looking for.

Re:So what's the potential threat?

[El Lobo]

I know your'e trying to be funny, but at my university, our neighbour department has an (almost) wide open Xerox Workcenter 7245. I say *almost* because they have their Apache with the default 11111 password. Last april the 1rst I printed a 50 pages documetnt (100 copies) to their printer. It was actually the Administrator's guide for the Xerox Workcenter, as a pdf. To this day, they are still asking who the hell missused their printer that way... ;-)

On a serious side, that machine can send a scanned document to any mail address using some external SMTP or an internal one (sendmail). If I were a spammer, i could make my day.

Re:So what's the potential threat?

[ettlz]

Let me guess, it'll get caught in the ring-buffer.

Re:So what's the potential threat?

[Trogre]

... or as a faint watermark that wasn't immediately obvious until in the boss/client's hands.

Re:So what's the potential threat?

[robi2106]

which is entirely possible to do (assuming you can get a hold of the compiler needed to create your own code). all you need to do is send the PJL needed to upload the program, and then stick it in the stack and vioala! instant print job mirroring.

naturally networked printers like this should live on their own subnet that refuses all port communication except inbound originating print request or necessary admin traffic from specific other networks....

so yes, lots of network admin overhead to keep them locked down.

Re:So what's the potential threat?

[Ungrounded Lightning]

Better yet: A texture map that is virtually invisible to the naked eye but becomes visible when copied by a xerographic process (like the "void" markings on some checks).

Re:So what's the potential threat?

[myowntrueself]

or they'll print out all our spam.

I had a client who *insisted* on printing out *every* *single* email they received.

Every one of them. And this was before I set them up with spam filtering; they printed ALL their email and they got TONS of spam.

Some people really do need to be taken out and shot.

Re:So what's the potential threat?

[Anonymous Coward]

A note to company webapp printing plugin designers.

The parents idea has been implemented before. Be wary of your coding practices if your plugin sets up batch print jobs as pdf or postscript for internal company print stations.

Re:So what's the potential threat?

[Anonymous Coward]

... or slipped it into a fax to a client

Re:So what's the potential threat?

[Birki]

no sir, pure evil would be a printer virus that prints everything upside-down..

Re:So what's the potential threat?

[Doctor O]

This is *so* evil. What are we still talking about, let's get hacking! ;)

I imagine something that does such a texture map, and adds a big "DO NOT COPY THIS" to the printout. Of course, the goatse image is subtitled "TOLD YOU SO".

Re:So what's the potential threat?

[Anonymous Coward]

I did exactly this while I was in school @ VTech.

A little bit of analysis showed that most students printed 8 pages or less off of the school's printers. Thus, every 9th page would be a naked woman peeing.

It went on for damn near 6 months, primarily because so few people hit that 9 page mark. Great success.

Re:So what's the potential threat?

[Anonymous Coward]

print/copy/scan/fax off a receipt, grab some bank account or credit card account numbers
print/copy/scan/fax off a credit card front and back, mail off the cache file
print/copy/scan/fax off your taxes, steal your identity
print/copy/scan/fax off something confidential, steal your IP
print/copy/scan/fax off your bankruptcy notification and smash your stock value early

there's no end to the mayhem you could cause just by accessing the cache directories and emailing off copies of everything the machine touches, let alone the mayhem you could cause by sniffing the network, or using the printer as a base to launch attacks.

Xerox has a sloppy track record with security inside these devices, accessing the internals is trivial, especially if you have physical access to the box, but remote access is possible through the sloppy coding in the postscript interpreter and other places. Why anyone would allow one of these threats onto your network is beyond my understanding.

Re:So what's the potential threat?

[nospam007]

Are we going to have a bot net of machines that print our spam for us?

I'd write a virus that would secretly fax me every document the concurrent companies print, scan or copy. Since they have almost also character recognition, perhaps the virus could decide what to send me.
When I have all their secrets, patent applications and client lists I'd make their printer fax a billion pages to Burma or whatever is more expensive until they're bankrupt.
Or fax a complaint to the police and when they arrive the printer is busy printing hundred dollar bills and dirty bomb plans.
The possibilities are endless.

ABout time

[geekoid]

when I did security work, the number one way to get into their systems was via printers.
Nothing like sitting down and be into a banks system in less then 30 seconds.

Re:ABout time

[Anonymous Coward]

Talking shit with no factual back-up gets +5 at Slashdot...

Re:ABout time

[Anonymous Coward]

Was this before or after designing the fridge of the future, that you couldn't get funding for?

Re:ABout time

[mpapet]

I'm calling you on this because I think it's very improbable without a laptop in the physical location. Sure it broadcasts like crazy in a LAN, but there's a HUGE leap from getting on the printer to turning it into your bot from a remote destination. Did the print server have a public IP?

Some details please.

Re:ABout time

[twiddlingbits]

Bullsh*t. You been watching too much Hollywood crap. They'd have to have a ladder to reach the tiles, some way to cut the Cat 5 cable, put a connector on the end (non-trivial if fiber), then have to splice the router into the cable, set the router IPs to be on the same subnet as the bank (unless you know this you'll need a sniffer program to grab it). While they are doing this they can't cause a noticable outage and I doubt the banks DNS is going to give the laptop an IP without some kind of login and authentication. Plus you probably need to know what kind of printers they are running, thier IP addresss and/or name before you can get to them to install the Trojan/virus.

Re:ABout time

[GNU(slash)Nickname]

I doubt the banks DNS is going to give the laptop an IP Yep, pretty sure you're right about that.

Re:ABout time

[Anonymous Coward]

Heh! At the Univesity I'm at, the fine guys at ITS officially disallow NAT or the like. It's ridiculous. So, indeed, any network printer at the entire university is I'm sure accessible from anywhere on the planet.

Re:ABout time

[JoeZeppy]

Bullsh*t. You been watching too much Hollywood crap. They'd have to have a ladder to reach the tiles, some way to cut the Cat 5 cable, put a connector on the end (non-trivial if fiber), then have to splice the router into the cable, set the router IPs to be on the same subnet as the bank (unless you know this you'll need a sniffer program to grab it). While they are doing this they can't cause a noticable outage and I doubt the banks DNS is going to give the laptop an IP without some kind of login and authentication. Plus you probably need to know what kind of printers they are running, thier IP addresss and/or name before you can get to them to install the Trojan/virus.

I don't know what you mean, a DHCP server will happily give out IPs to anything that asks for one, there's no authentication involved. And if you're good, you can probably cut a cat5 cable and put an RJ45 on it in a minute or two. Sure the guy at the cube who's cable you cut will probably complain, but how long will it take an electrician to figure out what happened, or will they just pull a new cable? Not saying I believe the story, but it's not as far-fetched as you make it sound.

And anyway, a 4 port Linksys WRT54g will function like a hub, and pass the DHCP request right through if it's set up right. That's why admins freak about people buying them at Best Buy and hooking them up under their desks.

Heck if I was doing it, I'd have my laptop set up to talk to the Linksys box with WPA and not broadcast an SSID, to make it harder for security to find my private WAN.

Re:ABout time

[debatem1]

Any halfway decent sysadmin has about a dozen ways to punch holes in that particular scheme, and particularly at a bank you're almost certainly not going to get that to work. ARPtables, captive portals, fwknop, ssh, the list is endless of ways to stop that from working.

Re:ABout time

[GnomeThinker]

Any halfway decent sysadmin has about a dozen ways to punch holes in that particular scheme, and particularly at a bank you're almost certainly not going to get that to work. ARPtables, captive portals, fwknop, ssh, the list is endless of ways to stop that from working.

Sadly if you look less at the 'bank' world and more at the smaller 'Credit Unions' you'll quickly find little to no fully qualified sysadmins, instead you'll generally find over-titled help desk people with a bunch of vendors. Some have security vendors who MIGHT do continuous observations but generally do 'scans' at predetermined intervals. So yes there ARE endless ways to 'stop that from working' but sadly not all the people in position to use said ways are capable or have the time to do them.

Re:ABout time

[Aramis]

Where I work every single one of our printers has it's own public IP. I accidentally printed my tax return on the work printer from home because I forgot to change the default printer.

Re:ABout time

[twiddlingbits]

Still not solved the IP address issues and authentication issues and printer names/types/addresses.

Re:ABout time

[twiddlingbits]

I meant to say DHCP. There are DHCP servers that will request Authentication or only allow certain MAC addresses to get IP's. No one has yet solved the issue of how you know the bank has just the right printer with just the right firmware version. Plus how do you know what IP address is a printer without special tools such as a sniffer. It's not a hack for the amatuer. Also, don't you want to control that printer and it's agent from outside the bank? To do that you got to do a lot more things, like change firewall/router rules and routing tables, etc. which will require a login to the firewall. You may also have a DMZ you have to deal with. Once you are in it's not going to be easy to punch out. The old janitor/maintenance man trick may work to get access if the bank employees are stupid but it'll only work once. There is also the assumption the Cat5 cables are running over the area of the restroom and that they carry internal traffic. If you found a haphazardly Windows system that was configured by poor admins you might get it to work. It's probably easier to steal an employee acess ID and password, then you got it all at your fingertips.

Re:ABout time

[Anonymous Coward]

Sniffing the network should give you enough info to guess network settings that are likely to work. Printers - well you'd be looking for specific types for which you have default logins and/or other exploits, so nmap, telnet, plus a bit of prior research should allow you to identify your target devices.

Re:ABout time

[totally bogus dude]

Plus how do you know what IP address is a printer without special tools such as a sniffer.

It's pretty rare for people to change the MAC address of their devices, even on devices that allow it. And since each vendor is allocated its own prefix(es) it's pretty straightforward to narrow your search to e.g. Xerox MAC addresses. With a bit of research it's likely you'd be able to find even narrower prefixes that the vendor has allocated to particular types of printers.

don't you want to control that printer and it's agent from outside the bank? To do that you got to do a lot more things, like change firewall/router rules and routing tables

I think that's what the installation of the wireless router is for.

Also, don't forget that all your criticisms are implying that the bank has implemented good security practices across the board. We like to think they do, but in reality they're probably only a little bit better than the majority of companies. Very few people require authentication before providing an address via DHCP, for example, or do MAC filtering on every port (or even enough ports to make it meaningful).

Finally, the post you responded to didn't say the guys just walked in out of the blue without any prior research. That seems unlikely. Also why would you need to give your wireless router an IP on their network if it's sitting in the network path? Ideally you wouldn't be using an off-the-shelf one, but I think that'd be fine on most networks, particularly since most people consider their internal cabling to be pretty trustworthy.

Your other main criticism is they'd need to take down the network in order to patch into it, but that would only take a few minutes. If you lose a part of your network are you going to go "everyone quick, to the restroom!" to find the culprit? Very improbable. Most likely it would take a minute or two before the network admins even identified the switches/routers that were having problems, then it'd take another few minutes for them to physically go to the devices and check the cables are plugged in (the first place most people would start looking once they established that the link was down). And by this time it's probably come back up again.

Now if their security guys are really hardcore they might decide to go through the roof and check out the entire length of the network cable to make sure it hasn't been tampered with, but 99% of people are just going to "monitor it and see if it happens again" -- which it wouldn't. Then it'd be forgotten about.

Re:ABout time

[JoeZeppy]

At the risk of being pedantic, I'm going to reply. Keep in mind, I'm not saying this would definitely work, just I know how our environment is set up, and how obsessive our corporate security folks are, and these are actual weaknesses in our environment that aren't being addressed. Other businesses may not be as careful as we are, so I can only imagine what holes they might have.

There are DHCP servers that will request Authentication or only allow certain MAC addresses to get IP's.

We have probably 6000 devices in our downtown campus. At least a dozen or so a day die and get replaced. Recording MAC addresses for each one and adding it to a RADIUS server or something like that isn't on our radar.

No one has yet solved the issue of how you know the bank has just the right printer with just the right firmware version. Plus how do you know what IP address is a printer without special tools such as a sniffer. It's not a hack for the amatuer.

No, it's a hack for a ping sweep tool. All the printers ship with a standard easily recognizable format for host names, which never get changed. Or if they do, they get changed to something like "xerox255-001". Plus, like any other environment, our static IP's start at a low number and go up to .50 or so. all your printers are going to have static IP's. Believe me, if you saw a ping sweep for one of our subnets, it would take you about 15 seconds to figure out whats a printer, router, server, switch or PC, based on our naming convention.

Then, the printers all have helpful web interfaces that will tell you everything you need to know about them, and all the settings they use to authenticate users to the network, hostnames for domain controllers, etcetera.

Also, don't you want to control that printer and it's agent from outside the bank? To do that you got to do a lot more things, like change firewall/router rules and routing tables, etc. which will require a login to the firewall. You may also have a DMZ you have to deal with. Once you are in it's not going to be easy to punch out.

Simple, install the wireless access point near a common area like a coffee shop or lobby, or an outside wall, and sit next door. The exact opposite of how I used to sit in my cube on the 7th floor and pick up free wireless from the hotel across the street to get out from behind the firewall.

The old janitor/maintenance man trick may work to get access if the bank employees are stupid but it'll only work once. There is also the assumption the Cat5 cables are running over the area of the restroom and that they carry internal traffic.

That is probably the biggest assumption, I know ours all run in cable trays under the floor, and hub rooms are locked, only accessible by ID badge. Still, it's techinically possible if you had access to building blueprints, to find a weak spot.

If you found a haphazardly Windows system that was configured by poor admins you might get it to work. It's probably easier to steal an employee acess ID and password, then you got it all at your fingertips.

We have an entire department devoted to security, and they are major pains in the ass. They just aren't looking at this stuff.

Re:ABout time

[JoeZeppy]

Just occurred to me how to access the cabling. Like any other large office building, we sublet floor space to other companies. Law firms, brokerage offices, etcetera that aren't under our control, administratively or physically. If you can access those areas, and they aren't security concious, you've exploited another weakness.

Duh

[Anonymous Coward]

Wait till every light bulb has a 32 bit processor and a firmware in flash memory. If we're still cranking out shitty software like we do today then, it'll be hackers' paradise.

Fool the black hats!

[EmbeddedJanitor]

Remove the toner from the printer and you only get white hats.

So what?

[SpiritGod21]

The biggest issue isn't a lack of (software or physical) security regarding the machine, but a lack of a security policy in these instances. At our institution, machines have unique names, unique passwords (when they have to scan to a network drive), and are behind the campus firewall. But a user could get one, hook it up (putting it behind the firewall) and not change the default password and we'd 1) be none the wiser and 2) have no control over the machine. If a department gets one, it's their printer, not ours.

Still, with client-side antivirus and firewalls, and the control we have over the servers (for a multifunction printer to be able to scan to a server, it has to be given specific access, which doesn't happen lightly), it doesn't seem like being able to access the web interface can pose a whole lot of a threat. An attacker could potentially waste a ream of paper or two, a bit of toner, but I don't foresee any major consequences.

Re:So what?

[Pirulo]

There are other consequences that are sensitive to several business,

Enabling the MFP to cache all documents so they can be retrieved by the hijacker is an example on how to steal sensitive information.

Re:So what?

[Anonymous Coward]

If the attacker can get inside your printer to waste paper, they can get in and collect information on what is printed.
All sorts of personal information is printed on paper. Do you want that info stolen?
I sure wouldn't.

Re:So what?

[nih]

At our institution, machines have unique names, unique passwords

yes i'm sure they do, now stop worrying and calm down, the doctor will be here any second

Re:So what?

[Jeff DeMaagd]

In addition to the above industrial espionage potential, they could also be used to aid in a DoS. The second might not be that likely as it's so easy to root a Windows system.

Re:So what?

[Anonymous Coward]

Well...since many of these save images of all the scans and print jobs, there is a huge pii risk. For instance, the HR machine used to photocopy your drivers license and ss card on the first day of work. (This is an old link, but I ran across one recently.)

Just what I need

[antifoidulus]

is to come into work in the morning to find all the ink and paper has been wasted printing the goatse man over and over again....

Re:Just what I need

[Farmer Tim]

That's not a waste, it's a network security diagram.

Weakest Link

[ookabooka]

This is actually a very good point, a network is only as strong as its weakest link (or firewall). While each machine on a network may be secure, hijacking a printer can do the same amount of damage as hacking any other machine on the network (save actual servers w/ data on them). Imagine hijacking a printer on a network and then having it send out spam (hey, its on superreliabledomain.com, no reason to hastily toss it in the spam bucket), or arp poisoning to listen in on other traffic on the network it should have no business with. Any device connected to a network should meet a certain standard of security, it only takes one weak link to really mess things up.

Re:Weakest Link

[gotzero]

Thankfully, all of the multi-function print centers I have at my job are never working long enough at one time to get hijacked. Maybe the horrible up-times were a gift from the manufacturers to prevent these attacks!

Re:Weakest Link

[rant64]

... which still comes down to a most-restricted policy. A company that is able to afford one or several multifunctionals probably has VLANs (thwarts ARP poisoning) and a firewall in place. Allowing SMTP out from any server other than your mail servers is a big no-no anyways, don't need printers to exploit that.

Perhaps I'm jaded, but is this news?

[zappepcs]

As noted, this has been covered before. If you are not doing your best to segment your network for security reasons, then you probably deserve to learn about this one the hard way. EVERYTHING now has the smarts/hardware to launch/spread/spawn a virus attack on your network. Every day I get one or two messages about this and mobile computing being the 'number one' threat to our networks.

FerCrissakes, every USB stick has that ability if you have not done your work/research etc.

But still, by far, the most dangerous thing on your network is the end user(s)...

That's life, it's the way the cookie crumbles, and it's how you're going to lose brownie points with the PHB at work.

Hit it, The Paper

[Digi-John]

My dot-matrix parallel printer will never turn on me like that!
Screeeeeeeech

Re:Hit it, The Paper

[that this is not und]

My favorite Dot Matrix printer was this big behemoth GE Terminet printer that I had full command of years back. I was writing Assembly Language code for 4-bit embedded controllers and had taken it for my very own, attached to the '286 machine I had glommed onto at the time. It was many-pages-per-minute fast. It would hurl paper up into the air when doing multiple page ejects. In fact, if you turned the PC off before the printer, for some odd reason the printer would interpret the signal on the cable as being infinite-page-ejects. It could throw many feet of paper up into the air before you could get to it to turn it off.

It was, needless to say, quite a _fine_ printer.

Re:Hit it, The Paper

[Anonymous Coward]

My dot-matrix parallel printer will never turn on me like that!

Until the Dot Matrix decides to use you as a battery.

The cleverest hacks are in front of your nose

[postbigbang]

Lexmark, Xerox, the list goes on. How about a Linksys WRT54G? How many devices out there can be easily rooted and owned? The list is endless. Who would suspect a logon attempt or a slow port scan from a printer, or a volume-page scanner?

Maybe your VoIP system's very happy you linked it to your Active Directory with an administrative logon. Seen any weird LDAP requests recently? Had to reboot your RIP engine recently? Surprise!

Diligence is its own reward.

Re:The cleverest hacks are in front of your nose

[bendodge]

The WRT54G is easy to secure. Just use DD-WRT!

Re:The cleverest hacks are in front of your nose

[syousef]

You can pwn my PC but leave my WRT54GL alone. It's one of the few pieces of hardware I own that's proven to be as reliable as the sun rising in the East. Yes I've installed the Linux bios.

Re:The cleverest hacks are in front of your nose

[postbigbang]

Me too. Strip out everything but what you need, and beware the IPV6 mods.

Not simply PSC then

[pembo13]

I take it from the summary that simple print-scan-copy machines aren't what is being mentioned. Instead, referring to those smart printers that "can access all your companies files" -- couldn't figure how that was a good idea when I saw the ads myself.

Re:Not simply PSC then

[raehl]

There are plenty of printers out there with network ports. Once you plug something into your network, it's plugged into your network.

Re:Not simply PSC then

[JoeZeppy]

I take it from the summary that simple print-scan-copy machines aren't what is being mentioned. Instead, referring to those smart printers that "can access all your companies files" -- couldn't figure how that was a good idea when I saw the ads myself.

We have bunch of these Xeroxes that have - wait for it - an XP workstation hanging off them! No idea what the advantage to that is. You can't use it as a print server, because only ten people at a time can have a connection to it, so as soon as it starts to get heavily used, users complain that they can't connect to it. There's some kind of management console on it that allows you to reprint documents. Yours or your managers I presume. And the management console needs local admin rights to run.

So we run around locking down all the users workstations, but we have a shared workstation in the corner logged in as local admin with no screen saver. Thanks, Xerox! And they don't run Windows update either, you have to get patches from EFI, the compapny that builds the workstations and sells them to Xerox. We don't know how to support them, and neither do the Xerox reps.

So we create a server queue, that points to the workstation, that points to the printer. WTF? Where's the value added there? But we can manage our own print jobs! So? Why do you want to? You can't click print again if you need another copy?

And the drivers don't play nice. Very fun when you have over a hundred queues installed on each print server. the other day, they spent all morning trying to install drivers for one of these crap sandwiches. Every time they installed the driver the server would die.

And every floor has 3 or 4 of them, because each department needs their own. so half of them are totally underused. But we're saving money on all the printers we replaced! You mean the ones that migrated to users desks? We have people with a Laserjet 8000 sitting on a table in their office, sucking up power and $90 toner cartridges, so Manager McPrivileged doesn't have to walk down the hall to print out his 5 emails a day.

We keep telling the Xerox sales rep that we hate her. She thinks we're kidding.

Re:Not simply PSC then

[Joe The Dragon]

do they get messed up if you try to go to the windows / Microsoft update website?

the printers don't have a e-net port on them?

Sound like a PHB move.

Re:Not simply PSC then

[Teilo]

What you are describing is an EFI Fiery RIP. This is not just a "workstation hanging off of the printer." It is doing the actual work of rasterizing the Postscript. Get rid of it, and your Xerox is not even a dumb printer. It won't print at all.

EFI Fiery controllers generally run a version of XP Embedded, which is itself locked down in a variety of ways, but sometimes not. They often have a proprietary motherboard with unique RIP hardware. We have several here. One, driving a Canon CLC 4000, does not even have enough of Windows present to install a driver (VNC in this case).

Another, driving a Konica BizHub Pro 6500 is almost wide open, except that we actually had to pay for the privilege of hooking up a monitor and keyboard. That's right, they flash the motherboard in such a way that the machine is headless, unless you pay extra.

Re:Not simply PSC then

[JoeZeppy]

What you are describing is an EFI Fiery RIP. This is not just a "workstation hanging off of the printer." It is doing the actual work of rasterizing the Postscript. Get rid of it, and your Xerox is not even a dumb printer. It won't print at all.

EFI Fiery controllers generally run a version of XP Embedded, which is itself locked down in a variety of ways, but sometimes not. They often have a proprietary motherboard with unique RIP hardware. We have several here. One, driving a Canon CLC 4000, does not even have enough of Windows present to install a driver (VNC in this case).

Well ours had enough of Windows for us to install the corporate antivirus software, and the SMS client, and now Altiris. So corporate security bitches every time they get a report because the Fiery box isn't current on Windows Update patches.

And it has IE 6 on it, can visit websites, has command line functionality, will run vbscript, Remote Desktop and Dameware remote software. So how is that not a Windows workstation? That being said, what's the difference between the Xeroxes with Fiery's and the ones without? They all print, scan, copy and email. What's the advantage to the workstation for your average technophobic secretary?

Re:Not simply PSC then

[Teilo]

I didn't say it could not function as a workstation. Indeed it can - sometimes. Installing lots of junk on them often has the side effect of breaking the RIP. Again, it all depends upon what particular package EFI puts together. I hate EFI. Only use them because we are forced to.

The difference is that the Xeroxes without a separate box have some sort of RIP hanging off the back of them, or a very simple internal RIP. Fiery sells simplified controllers that are still running XP (or 2000) internally, but have no external ports to hook a monitor or keyboard up to. Often the Fiery RIPs provide the value added stuff like Mailboxes, Scan-to-network, etc. If it's just a basic B&W Xerox printer, then often they will just have the simpler embedded PS Rip. Canon uses Fiery RIPs even on their office BW printers if there is a need for good Postscript support. If only PCL is needed, then they don't bother. Mac's need the Postscript support, as anything else works poorly on many Canons. Our supplier here in the Twin Cities won't even place a machine without a Fiery RIP if their customers are using Macs.

If the device is a business color device from Canon, Toshiba, Konica, Xerox, etc., it will almost always have a RIP of some kind, usually Fiery, sometimes Creo (another Windows box). Xerox has their own Unix based RIP as well (running Solaris), but I'm not sure who wrote their PS rip for that one. Maybe Global Graphics.

Re:Not simply PSC then

[YttriumOxide]

Business Colour from Konica Minolta generally doesn't use a Fiery or Creo. Fiery is an option on business colour, but is rapidly being phased out since Konica Minolta's own technology is MORE than capable in this area these days.

Both Fiery and Creo are still used on Production colour though.

See another of my posts in another thread discussing the security of Konica Minolta own systems. Fiery and Creo are for the print room and that's where they should stay. Don't put either of them anywhere near a corporate or public network or you're just asking for trouble.

Disclosure: Yes, I do work for Konica Minolta.

Re:Not simply PSC then

[YttriumOxide]

Just as a note, it's EFI that charge for the extra to add the keyboard and monitor... just on the Canon, you paid for it when you bought the MFP, as opposed to separately with the Konica Minolta.

Regardless - get the bizhub PRO C6500 AWAY from any network that should be secure. It's a print room machine and should be in your print room (on an isolated print room network). If you want a secure product for your corporate network, you should consider a bizhub branded product rather than a bizhub PRO branded product.

Gee,

[prevajanje]

come to think of it, my refrigerator made some noise as I powered up the computer,....

It ain't news.

[hal9000(jr)]

hah. about 10 years ago, I got a call from an admin at the University of Texas. Seems a host on my network was scanning his network pretty aggressively. Figuring the guy went to the trouble to find person responsible for the offending host, me, I talked to him, got the IP, and finally found the host. It was a web cam. huh. So while I had him on the line, I pulled the cable. Scanning stopped. Put the cable back in, scanning started.

I apologized and pulled the camera off the network. I then plugged it into a disconnected hub and poked around. Linux box running apache and some other crap. A few minutes later, I too p0wned the camera.

about 2 years ago my boss was talking about the security risk in shared network printers. If he wanted a hard copy of something sensitive, he would have to hit Print, and then trot down the hall to get his output before anyone say it. Printers and other IP devices have a host of problems. No news here.

Re:It ain't news.

[thewils]

Man, in a big shop you could loiter by a printer quite easily (hey I'm waiting for a top secret doc) and snarf anything that printed there to read at your leisure later. Those "lost" printouts would simply be resubmitted because Windows/the printer fouled up again.

On mainframes, you don't even have to stand next to the printer - you can see big jobs (payroll?) if you have SDSF access to the print spooler.

Re:It ain't news.

[RollingThunder]

about 2 years ago my boss was talking about the security risk in shared network printers. If he wanted a hard copy of something sensitive, he would have to hit Print, and then trot down the hall to get his output before anyone say it.

Some of the current crop of printers theoretically have a "confidential print" option where you tell it to wait for a name and a PIN before it actually starts spitting paper out. Lexmark T632's are one I'm familiar with.

I say "theoretically" because I've tried to use the feature, just to confirm it works, and never managed to get it to work properly. The request either vanishes, or prints immediately....

Re:It ain't news.

[flink]

Many larger/more sophisticated printers these days have a "print to mailbox" option that causes the document to remain spooled on the printer indefinitely instead of immediately printed. You have to be physically at the printer and enter your user ID and PIN to start your print job. So that mitigates the hanging around the printer attack, still doesn't help if the printer gets r00ted though.

Re:It ain't news.

[that this is not und]

About 25 years ago I was a camera operator at a COM (computer output to microfilm) shop. We were a job shop that took in tapes from all kinds of customers and shipped out microfiche to places all over. One of the big semi-annual jobs was the University of Minnesota Transcripts. Yes, a couple times a year we (I) had access to complete decks of microfiche which contained the grades of everybody for about a 30 year timespan who had attended the University of Minnestoa.

It was a big, big job that took multiple days to run, during which time the fiche were in the shop. Part of our responsibility was to put the fiche in a reader and check character quality.

Ah, the old days.

Security IS weak

[p51d007]

I work on networked multifunction copiers & printers. You would think they would lock a lot of them down, but they don't. Some times, I need net access when I'm working on one, and 99 times out of 100, all I have to do is unhook the net cable from the MFP, and connect it to my laptop and bingo, I'm on the net. The only place I've been that this doesn't work is a major hospital....duh...at least because of the HIPPA rule, they lock EVERYTHING down.

How about physical document security instead?

[Radon360]

Let's work with the concept that a multifunction machine get pwned for a moment. Instead of all the ideas of using it to root around on your servers, or join a botnet, what if the vulnerability did something as innocuous as FTP/SMTP (or even fax) images of scanned/printed documents to a server on the outside world?

Get a machine in a place that does financial or medical records and now you have a steady stream of confidential information going somewhere in the form of soc. security numbers, bank account numbers, etc. all in scanned form.

Since the machine probably already does this on a regular basis under normal use, it's possible that such an exploit could continue for a while before it would ever be discovered.

Re:How about physical document security instead?

[Anonymous Coward]

"Get a machine in a place that does financial or medical records and now you have a steady stream of confidential information going somewhere in the form of soc. security numbers, bank account numbers, etc. all in scanned form."

Or, in a university, the final exams and any other tests that are sent to the printer.

It's probably time to implement some kind of encryption protocol for network printing, because I'll bet it would be simple for someone to gather up all the jobs sent to a particular printer and screen them for anything interesting.

Re:How about physical document security instead?

[archen]

Heh, and at least FTP/SMTP would be traceable through a firewall that logged it. Our company just got a printer in today with fax from PC capability. Everyone was like "That's great". Then I pointed out that anyone with this on their PC could potentially send any document in the company via fax, and no one would probably catch it in the phone logs.

While true it also got me the "Man I hope our I.T Manager (me) never turns on us.." look. I get one of those every month or so.

Re:How about physical document security instead?

[jimbojw]

There's a great book called Stealing the Network: How to Own the Box which contains a series of realistic short stories chronicaling a variety of black hat adventures. In one story, the protagonist uses an open printer as a base of operations from which to launch attacks on other boxes in the network. This is especially useful since internal servers may be IP-range limited to prevent direct access from outside machines.

IIRC, the attacker also used it as a gateway to steal and forward packets traveling through the local network hub. Good stuff :)

Re:How about physical document security instead?

[flappinbooger]

That's way handier than rooting through the trash.

OMG! This is soo true!

[Anonymous Coward]

This one time, at my office, this guy, he hacked the multifunction printer,.. And it didn't print!!!

That feeling you get, that tingling sensation when you walk down into your dark basement cellar. That's the feeling of the multifunction printer watching your every move.

Re:OMG! This is soo true!

[Tuoqui]

He wouldn't have happened to be using an axe at the time would he?

You can run Linux on 2Mb of flash

[Colin Smith]

With processor, ethernet etc that fits into 35mm×19mm×19mm of space[1]. Basically the same OS as your file, printer, web and database servers...

This means that anything that size or bigger, could be running a set of software perfectly able to be compromised, and used as a springboard into other systems. Anything with a network port should have the same security policies applied as a server.

[1] e.g. http://www.picotux.com/techdatae.html

Re:You can run Linux on 2Mb of flash

[Digi-John]

But... but... Linux is ABSOLUTELY SECURE, right?

Re:You can run Linux on 2Mb of flash

[Colin Smith]

That depends... Did you use ash as /sbin/init?

Re:You can run Linux on 2Mb of flash

[flyingfsck]

Every network printer I have ever tried, sports a FTP server. This is handy when all else fails - FTP a postscript file to the damn printer and la voila! Of course, this can be exploited with a denial of service continuous print loop in postscript.

Lol

[Anonymous Coward]

Im in ur bulbs, givin u seezures.

Security

[zymano]

http://www.openbsd.org/

http://www.lynuxworks.com/solutions/security.php

http://www.coyotos.org/

Re:Fool the black hats! Speak upppp....

[davidsyes]

Fortunately, these MFP's don't have speakers. Otherwise, the goats would have a new form of emission... mwaehhehehe mwaehhehhee.... Now, you can hear, see, *and* smell the goat..

Multi-malfunction devices, more like it

[SuperBanana]

Brendan O'Conner first called attention to the vulnerabilities of these new devices at a Black Hat talk in '06 and warns that these are no longer "dumb" machine sitting in the corner and should be treated with their own respective security strategy.

The Xerox WorkCentres are more likely to malfunction, first. They jam incessantly unless you use Xerox brand paper (rather than design their machines to handle popular paper, they design their machines to only handle Xerox paper properly) and they have basic design defects- for example, toner builds up on fingers near the fuser assembly, which has to be scraped off regularly or the machine starts to jam with increasing frequency.

Also, the print spooler PC on the back of the 3535 units (the B&W ones, may have that # wrong) were completely stupid- when the copier displays a message to the effect of "PC booting" with a progress bar, it's a TIMER, and nothing more- the machine doesn't actually check if the PC successfully booted and is accepting jobs.

Don't even get me started about how atrocious the Windows-based RIP engine is for the color printers.

Not even remotely "smart".

Chip Crowding - Firmware Hack

[not_hylas( )]

All kidding aside (printf), we had a break in a few years ago by some very organized Blokes one (of many) thing they hit was an HP 120nr printer (w/ RIP [fonts]) to which they tried (and failed) to chip crowd or replace the firmware. They jumped routers/switches to the local LAN to accomplish this, the network card was damaged in this attempt - we just got it back from the repair shop and the Tech asked me "what did you do, pull the NIC card while it was running?"
Of course I didn't, nor did anyone here do such a thing, what you have to understand is only a portion of the printers' motherboard was damaged. I'll leave it as an exercise to you to figure which area.
All was not lost as the USB still functions as well as the parallel port,
The printer was not configured.
The computers/LAN were Macintosh (OS8.x.x, 9.2.2 clients) - OS X 10.2.8 clients/servers.
Init's were utilized on the legacy OSs to attack.
OS X (Shockwave, QT, Flash etc.) was used for "the show".
The routers had to be re-flashed.

Yeah, and Bob's your Uncle.

Re:Chip Crowding - Firmware Hack

[Joe The Dragon]

tell us more

Re:Chip Crowding - Firmware Hack

[not_hylas( )]

Read article and comments:
Several people had the same hack as ours later in the thread - as difficult as it is to read the "crazy" ones, they are pretty accurate as well. Once you've been "there" everything else become somewhat trivial by comparison.

http://www.securityfocus.com/cgi-bin/index.cgi?c=articlecomments&op=display_comments&ArticleID=11372&expand_all=true&mode=threaded

Not-too-long-ago...

[FooAtWFU]

Not too long ago (less than 4 years) my university's network still gave everyone Real IP Addresses accessible from the Internet anywhere, without much (if any) firewalling. They've since cracked down and NATted, but before that point, apparently, one of the big laser printers was compromised and turned into a warez FTP server.

Mind you, it still printed.

This is just the technology filtering down. :)

At my work (a bank)...

[netsavior]

We have a $45,000 high quality high volume scan/printer that is a paperweight.

They purchased it for scanning confidential documents. The hitch is that there is only 1 way to get documents off of this printer: A public non-protected network share... This is basically against the law for a bank.

I suggested that I could set up a private network and they could securely upload docs to the proper place with the right security, however that plan was nixed for being "non-standard"
The result is that now they consult me when buying a pencil sharpener because they don't know how it will affect network security.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Sensitive data issues

[Bork]

There are issues using them when handling sensitive data such as personal records. The hard drive in these printers do not always clear out the information used to make the previous printouts, allowing someone to later to recall and make reprints.

My wife works in a HR position and will not use these work center type of printer because she does not have a usable means to clear out the disk after make printouts of personal data. There was a push for the office users to use this as there default network printer in order to reduce the number of personal printers that was in the office. She asked if there was a method to make sure the information was erased after making a printout. She was assured that it would be taken care of and not to worry about it, to which she replied, that she would make sure to print out their personal files out on the printer if it seemed to be needing service.

The printer that she now uses is one that does not have any data retention capabilities like a hard drive, it also sits at her desk and not in the common area.

Re:Sensitive data issues

[mlts]

This gets me wondering. A printing company like HP could make money hand over fist by designing a printer from the ground up for security. For storing data to be spooled, if the data is in RAM, as soon as the data is printed, the bits of RAM are zeroed out. If the data is stored on a HDD, have the data encrypted with a random key that changes every boot, and perhaps every hour or so if no jobs are in the queue. Of course, this means that any jobs in the printer have to be dropped if there is a power outage. The printer should use reasonable security in its embedded OS and have consideration for buffer overruns and other methods of attack, perhaps having a watchdog circuit that will force a reset if the embedded OS locks up.

Of course, a secure printer should have capture/release functionality where someone can print to the printer, and the job will be held until they are physically at the console and can enter a PIN or perhaps have some type of authentication before the job is printed. This keeps someone from just "accidentally" walking off with a confidential job. Perhaps even have a printer that has secure safety deposit box-like receptacles that open with keys for people who print secure jobs often, but don't want anyone in the office to snatch the output.

Another security device that could be made is a fairly simple embedded firewall between the printer and the rest of the network. This device pretty much would consist of two network interfaces, and some embedded, hardened routing OS. This would be configurable and (for example) would prevent the printer from connecting out (maybe an exception for a machine for SMNP logging), and block any machine that is not in a local subnet from accessing the printer. If this is made inexpensively, this would be a good help in ensuring that only people physically there can access the printer, and the printer cannot send any information out, even if it does get compromised. Maybe HP should put this on their JetDirect interface cards.

On a lower level, I wonder about a modified lpr protocol that would support user authentication before the printer allows anything else to be accessed. The printer can keep a local user access list, or query a LDAP or Active Directory server. In case people forget passwords, have the printer forgot its configuration and return to factory defaults if a hard reset is done (power+OK on HP printers, or perhaps holding down a reset button for 5-10 seconds.) To eliminate brain dead default passwords, the printer should demand the user enter some password in on first power on. At least an attacker would have to guess if a user used "1234" or "ABCDE" for the printer's password.

Re:Sensitive data issues

[Bork]

You mean like this one?

http://www.troygroup.com/SecurityPrinting/products/MICRPrinter/4300secure.asp

Re:Sensitive data issues

[YttriumOxide]

Last I checked (which was a few minutes ago), every current Konica Minolta office product has every feature you're talking about ("office products" excludes the printers, SOHO toys and production equipment (like the C6500 mentioned in another thread - which being a production machine shouldn't be anywhere near a corporate or public network - it's a print room machine!)). Data erasure policies for RAM and HDD, Active Directory login, security logging, internal firewall... plus many you didn't mention such as encryption of all data on the HDD, lockouts to prevent password guessing and the ability to completely disable ANY port it opens.

Yes I do work for Konica Minolta (as a programmer)

Of course, the vast majority of our customers don't even change the default admin password let alone set up anything else. And honestly at least SOME of the blame for this probably rests on our pre-sales consultants for not even mentioning these features before the equipment is installed, but we do have them.

irongeek did some research into this

[Anonymous Coward]

I dont know if it was before or after the blackhat talk.

http://www.irongeek.com/i.php?page=security/networkprinterhacking

its really interesting stuff.

Re:irongeek did some research into this

[Myself]

Does april 2006 count as before?

The archive of the talk is here: [mp3], [avi]. Essentially, most of the webservers in these things are vulnerable to all sorts of mischief. If you can own the underlying OS, the sky's the limit.

Envelopes

[mbstone]

Maybe somebody will invent a benevolent virus for multifunction printers that will enable them to actually print envelopes.

Re:Envelopes

[Macgrrl]

Sadly that's a hardware problem - not a software problem.

It seems like a simple thing to do until you start thinking about the variety of thicknesses which have to pass through the rollers without jamming - oh and flaps, and gum which can't degrade from the heat if they pass through a fuser, so stick to the device if a flap folds up...

They actually make specialty envelope printers for high volume applications, they are almost universally based on inkjet technology because it is cold printing.

Personally I'm a fan of window envelopes, folder/inserters and well designed document templates which put the address block in the right location to show up through the envelope window. You son't even have to worry about getting the letter in the 'wrong' envelope.

Re:Envelopes

[Anonymous Coward]

Just getting our MFPs at work to actually print the job you want and in the format (colour/double sided/ 2 pages per sheet etc) you want would be a good start.

Then to actually get the scanner so it sticks the files somewhere sensible (our old printers scanned and emailed the resulting pdf to you, the new lot use SMB/CIFS share - which means a call to the helpdesk to get the drive mapping setup, which they usually get wrong etc etc).

Our facilities department chose the current MFP lineup (Sharp) on one basis: cost and cost alone. :(

Poor article title

[nsayer]

It's not that the printer is multifunction that has anything to do with it. I used to have a multifunction printer that connected to my computer with USB. I dare say that it offered no particularly interesting attack vector in that configuration.

Comment removed

[account_deleted]

Comment removed based on user account deletion

RandomCapitaLization

[Anonymous Coward]

wtf PostGreSQL? It's "PostgreSQL", "postgres", or "Pg".

AV

[fester2001]

Upgrade now to Norton Anti virus 2008 to ensure your printer is safe.

Re:AV

[rant64]

Your user number is far too high to have any authority on this. Don't believe him folks! Symantec Anti Virus 2008 is the way to go!

I DID THIS!

[Cyno01]

Sort of. After a power outage, i hadnt rebuilt the settings on my wireless router. One day i went into my network places and there were a few new folders in there, as well as another shared printer. Checked the logs and sure enough "ScottsLaptop" or somebody was leeching my wireless. My own fault for not re-securing it, but i still printed several pages of goatse on his shared printer before i booted him off my network. Not really related at all, but a mildly amusing network printer story if there ever were such a thing.

Re:I DID THIS!

[cant_get_a_good_nick]

Even scarier...
I remember someone had created a IPTABLES -- web proxy that turned pictures upside down for the leechers. A few doses of goatse or tubgirl should scar them for life.

Options to get around these problems

[screevo]

I know for a fact that Toshiba copiers offer a variety of security features for what they call their E-Bridge Architecture, the built in Linux server that powers the MFP. These range from a hard drive data-overwrite kit to a scrambler board that encrypts and decrypts data on the fly using a user-created site-key. Also, they do digital signatures when scanning to a SMB/CIFS share (scanning to an FTP server is also an option, as well as directly to a thumb drive) and allow for LDAP or smart-card based authentication before any scanning or printing function is used. The newest models also allow for secure PDFs. I've given some effort to get root access to one of the devices, and have thus far failed. Not saying it can't be done, I'm certainly not a "black hat". Full Disclosure: I am the I.T. Manager / Sr. Network Engineer for a wholly-owned Toshiba subsidiary.

Much Earlier Article on Xerox Systems

[The Infamous TommyD]

http://csrc.nist.gov/nissc/2000/proceedings/papers/034.pdf

Basically, 9 years ago we showed some remarkably embarassing features in Xerox multifunction printer/copiers/faxes. Including SNMP access to plaintext passwords!

I wonder how many of these "features" are still there.

Re:Much Earlier Article on Xerox Systems

[jrr]

Reminds me of our first networked HP printer bought back in the 20th century. I wanted to change a couple of settings so I downloaded some software from the HP site. When I ran it I found that it discovered all the HP printers in the building and asked me if I wanted to update everyone's firmware (among other things). Those were the days. :-)

Security options are available

[TheSpatulaOfLove]

...but when it comes to bid, most companies decide it's not worth the cost. I've worked in the MFP business now for nearly ten years, and security has evolved to address these issues as well as regulatory requirements. Some manufacturers are better at it than others, and those who do not create it themselves partner up to provide the solutions.

Security is on every single RFP, whether it be device management or document security, and most companies talk the importance of security until they see the price (financial and/or convenience) - then it becomes a distant third to cost and glitz. In the case of built-in security, many times it's just plain not used, either because it was perceived as a pain in the ass to deploy, or caused restrictions that end users would not tolerate.

Want your MFPs to be rock-solid secure? Man up, and don't let the bean counter compromise your security standards. Get involved with the RFP process EARLY and review the vendor solutions instead of just letting your facilities dinosaur run the show and award the contract to the lowest bidder...and suddenly pop up on your network.

Old news is... old news

[Macgrrl]

The generation of WorkCentre Pros mentioned in the article are no longer part of the current line up.

A 'smart' network entity will be a risk if it isn't locked down regardless of whether it is a printer or a server or a desktop computer.

The current generation of devices have improved security features including encryption of job files and digital watermarking at creation to ensure you can track the originator of any document.

To use a basic analogy - if you don't close and lock your doors - is it the houses' fault it's "insecure"?

pr0n print

[emj]

I actually came back to the office one day finding 400 pages of porn printed in color on our office printer. Apparently it was open for everyone on the net to use as a print server.

Re:pr0n print

[Hyperspite]

Well? What did the department do with it? You can't just waste that...

Re:pr0n print

[Doug Neal]

I actually came back to the office one day finding 400 pages of porn printed in color on our office printer. Apparently it was open for everyone on the net to use as a print server. This can also be done with your neighbours' open wireless networks.

MOD PARENT UP INSIGHTFUL

[SpzToid]

Seriously. Such a suggestion is a clear illustration of a security threat to be concerned about and guarded against.

It also makes for a realistic discussion of the risk with a non-technical user.

I don't want to lose sleep over the possibility, do you?

Except, how would you prevent it from happening? I'm not sure you can, but I'll bet the answer is in this book called Extrusion Detection. I haven't (yet) read it, however I have read its sister book (Network Security Monitoring) by the same outstanding expert author, a former US Air Force captain who should know, and that's why I think the answer to prevent such an internal 'exploit' is in that particular book.

you *almost* got it

[Anonymous Coward]

In a place like slashdot where people like to go off every time a security vulnerability is discovered that lets hackers take over commercial websites and use them to deliver viruses, etc. to their users I'd hoped somebody here would have understood the point better.

Let me walk you through the steps that were described in that old conference paper:
1) printer (doesn't matter whether it was multifunction or just-plain printer) runs web server by default so lazy admins can manage it without walking to different buildings
2) printer runs java-clone (can't be turned off)
3) vulnerability in web server code in the printer exposes printer's admin/'root' access password to anybody
4) printer's admin/'root' access password is all you need to upload user-written java-clone source code to the printer and command the printer to run the new code
5) that user-written java-clone source code can do most of the usual things you can do with a java program to attack computers or a network

So...those printers or any device which runs a web server for a 'friendly' admin interface is something you should be worried about because you don't know what security vulnerabilities it has, you can't run an anti-virus product in them and admins rarely bother to apply regular security updates to them (if the vendor even bothers to look for or fix the security vulnerabilities).

If you were a network/system admin and knew that you had hundreds of machines on your net still running Windows 2000 SP1 (no subsequent security patches) and with no anti-virus software on them wouldn't you feel pretty nervous about the security of the rest of your computers? The point of that old conference paper is that you are in exactly that situation today and probably didn't even know it.

postscrip IRC server

[sglines]

Way back in the early 1990's someone at MIT wrote an IRC server in postscript that ran (very slowly) on an HP printer. I was never able to stay connected to it for very long but it dis illustrate what you could do with postscript on a postscript enabled printer.

Think before you post.

[sowth]

Did you even read the guy's entire post? Why would you need to cut a cable to break into the network with a wireless connection? You must be clueless because you think it is some amazing feat to run a network sniffing program.

Where does slashdot get posters these days? Oh yeah, they are 12 year old kids. I used to read this site because quite a few posters seemed to be experts in their respective fields--at least the ones who where modded up. Now I don't know why I bother.

Since apparently we have to sign our "name" to be in the club--a lot of you 12 year olds are doing it. Who the hell thought that was cool?

Signed: The slashdot is full of 12 year olds "troll".

Re:Think before you post.

[FLEB]

You shouldn't pick on the 12-year-olds. Just because you just turned 13, it doesn't necessarily mean you're any better at reading comprehension than any of them, especially when you go and prove it with a stunningly brilliant foot-in-mouth rant like that.

The "wireless" was referring to the tap that the attackers attached to the network, not to an existing wireless connection. You'd still have to tap into the rest of the bank's network somewhere. It's doubtful they'd have an RJ45 socket hanging around in the ceiling above the bathroom, so you'd probably end up cutting the wire, putting plugs on the ends, and splicing in the wireless unit. Then you'd use that wireless connection, which you control, as a remote entry point into the network.

My old idea of "Multifunction Printer"

[haaz]

Looking at this, I was wondering how or why there would be talk at Black Hat about a multifunction printer being a security risk. "What, would terr'ists sneak in and use the printer to scan jihadist documents are very slowly print them out -- only to fax them!!" No, it's a little more elevated than that. Still not anything I need to worry about right now though.

Now goatse-laden printers, that's scary.

Article's Erroneous Underlying Assumptions

[bratwiz]

The article is assuming that people are actually _concerned_ about security, as opposed to the _illusion_ and _game_ (read: commerce surrounding) security.

So many of the things that organizations (particularly government organizations) do to "improve security" are really exercises in "security theater" to make management and certain "nervous nellie" types feel better about the complex machines and complex processes they oversee but don't have a prayer in hell of ever really understanding.

Real security begins as a culture of accountability and responsibility, along with the understanding that anything is only ever as secure as the awareness of the people managing it and their physical ability to secure and defend it. It is an ongoing, top-down set of procedures and processes along with a community (constituency) oriented communication and education effort designed to teach _and_ engage the user community about security awareness and the various procedures.

You can't buy a one-size-fits all security thingy and expect to turn it on and have it to work forever in all cases all of the time. And yet that is exactly the mentality of so many people I encounter on a routine basis-- particularly where I work at a large govt agency-- and MOST particularly the _security people themselves_ !! I suppose the closer you are to an issue the harder it is to really see it maybe.

The first Laserprinter was the fastest Apple

[cant_get_a_good_nick]

Due to processing demands of Postscript, it had the highest speed 68000 available in an Apple product, besting all the Macs of the time.

Re:The first Laserprinter was the fastest Apple

[dafing]

Great post, just thinking that myself! Its rather crazy eh? What about how the Mac was so much better in basically every way than the Lisa, EXCEPT for not having HDD/Networks, basically it was like quarter the price right?, but without a HDD and Ethernet. Crazy!

Hijack that printer (to be a server)

[StringTech]

I ran across this one day. (10-22-2007)

200555110.education.umn.edu/hp/device/.dir/13/order-hydrocodone.html UMN took it down after notification.

I remember that

[Anonymous Coward]

the Field Engineers scraped the hard drives before bringing back any movies.