Multifunction Printers — The Forgotten Security Risk?

eweekhickins writes to share an article in eWeek highlighting the forgotten risks that a multifunction printer could possibly offer. Brendan O'Connor first called attention to the vulnerabilities of these new devices at a Black Hat talk in '06 and warns that these are no longer "dumb" machine sitting in the corner and should be treated with their own respective security strategy. "During his Black Hat presentation in 2006, O'Connor picked apart the security model of a Xerox WorkCentre MFP, showing how the device operated more like a low-end server or workstation than a copier or printer--complete with an AMD processor, 256MB of SDRAM and an 80GB hard drive and running Linux, Apache and PostGreSQL. He showed how the authentication on the device's Web interface can be easily bypassed to launch commands to completely hijack a new Xerox WorkCentre machine."

Comments

First virus

[IdeaMan]

Wasn't one of the first Mac viruses spread by a mac printer?

Re:First virus

[Anonymous Coward]

The funny thing is, when I was setting up our office network I put the printers in their own network (no router), with the print server being the only host able to access both the printer network and the office network. All print jobs were routed through the print server. All scan jobs were available on the print server's file system.

The sysadmin who came in after me decided this was a boneheaded decision made by a network NAZI, replaced all my Linux boxen with Windows boxen, moved the printers onto the workstation network... and then hacked up a bunch of procedures (as in, words on a page that a human has to act upon) for "securing" the printers so that only marketing people can get to the (expensive per page) colour printer, for example. The security works by only configuring the printer on the desktops of the people who are supposed to be allowed to use it.

When I point out the possibility of PostScript viruses infecting the printers and possibly turning them into vectors of attack, I'm labelled "paranoid" and dismissed.

After all, it will "never happen to us."

In the meantime, the administrator is continually policing desktops to remove unauthorised installations of the printer driver for the colour printer, while we keep burning about $100/month on unauthorised use of that resource.

That's the problem with Microsoft Windows zealots. It's the 99% of them that give the other 1% a bad name.

So what?

[SpiritGod21]

The biggest issue isn't a lack of (software or physical) security regarding the machine, but a lack of a security policy in these instances. At our institution, machines have unique names, unique passwords (when they have to scan to a network drive), and are behind the campus firewall. But a user could get one, hook it up (putting it behind the firewall) and not change the default password and we'd 1) be none the wiser and 2) have no control over the machine. If a department gets one, it's their printer, not ours.

Still, with client-side antivirus and firewalls, and the control we have over the servers (for a multifunction printer to be able to scan to a server, it has to be given specific access, which doesn't happen lightly), it doesn't seem like being able to access the web interface can pose a whole lot of a threat. An attacker could potentially waste a ream of paper or two, a bit of toner, but I don't foresee any major consequences.

The cleverest hacks are in front of your nose

[postbigbang]

Lexmark, Xerox, the list goes on. How about a Linksys WRT54G? How many devices out there can be easily rooted and owned? The list is endless. Who would suspect a logon attempt or a slow port scan from a printer, or a volume-page scanner?

Maybe your VoIP system's very happy you linked it to your Active Directory with an administrative logon. Seen any weird LDAP requests recently? Had to reboot your RIP engine recently? Surprise!

Diligence is its own reward.

How about physical document security instead?

[Radon360]

Let's work with the concept that a multifunction machine get pwned for a moment. Instead of all the ideas of using it to root around on your servers, or join a botnet, what if the vulnerability did something as innocuous as FTP/SMTP (or even fax) images of scanned/printed documents to a server on the outside world?

Get a machine in a place that does financial or medical records and now you have a steady stream of confidential information going somewhere in the form of soc. security numbers, bank account numbers, etc. all in scanned form.

Since the machine probably already does this on a regular basis under normal use, it's possible that such an exploit could continue for a while before it would ever be discovered.

Re:How about physical document security instead?

[archen]

Heh, and at least FTP/SMTP would be traceable through a firewall that logged it. Our company just got a printer in today with fax from PC capability. Everyone was like "That's great". Then I pointed out that anyone with this on their PC could potentially send any document in the company via fax, and no one would probably catch it in the phone logs.

While true it also got me the "Man I hope our I.T Manager (me) never turns on us.." look. I get one of those every month or so.

Re:Not simply PSC then

[JoeZeppy]

I take it from the summary that simple print-scan-copy machines aren't what is being mentioned. Instead, referring to those smart printers that "can access all your companies files" -- couldn't figure how that was a good idea when I saw the ads myself.

We have bunch of these Xeroxes that have - wait for it - an XP workstation hanging off them! No idea what the advantage to that is. You can't use it as a print server, because only ten people at a time can have a connection to it, so as soon as it starts to get heavily used, users complain that they can't connect to it. There's some kind of management console on it that allows you to reprint documents. Yours or your managers I presume. And the management console needs local admin rights to run.

So we run around locking down all the users workstations, but we have a shared workstation in the corner logged in as local admin with no screen saver. Thanks, Xerox! And they don't run Windows update either, you have to get patches from EFI, the compapny that builds the workstations and sells them to Xerox. We don't know how to support them, and neither do the Xerox reps.

So we create a server queue, that points to the workstation, that points to the printer. WTF? Where's the value added there? But we can manage our own print jobs! So? Why do you want to? You can't click print again if you need another copy?

And the drivers don't play nice. Very fun when you have over a hundred queues installed on each print server. the other day, they spent all morning trying to install drivers for one of these crap sandwiches. Every time they installed the driver the server would die.

And every floor has 3 or 4 of them, because each department needs their own. so half of them are totally underused. But we're saving money on all the printers we replaced! You mean the ones that migrated to users desks? We have people with a Laserjet 8000 sitting on a table in their office, sucking up power and $90 toner cartridges, so Manager McPrivileged doesn't have to walk down the hall to print out his 5 emails a day.

We keep telling the Xerox sales rep that we hate her. She thinks we're kidding.

Re:So what's the potential threat?

[El Lobo]

I know your'e trying to be funny, but at my university, our neighbour department has an (almost) wide open Xerox Workcenter 7245. I say *almost* because they have their Apache with the default 11111 password. Last april the 1rst I printed a 50 pages documetnt (100 copies) to their printer. It was actually the Administrator's guide for the Xerox Workcenter, as a pdf. To this day, they are still asking who the hell missused their printer that way... ;-)

On a serious side, that machine can send a scanned document to any mail address using some external SMTP or an internal one (sendmail). If I were a spammer, i could make my day.

Re:Not simply PSC then

[Teilo]

What you are describing is an EFI Fiery RIP. This is not just a "workstation hanging off of the printer." It is doing the actual work of rasterizing the Postscript. Get rid of it, and your Xerox is not even a dumb printer. It won't print at all.

EFI Fiery controllers generally run a version of XP Embedded, which is itself locked down in a variety of ways, but sometimes not. They often have a proprietary motherboard with unique RIP hardware. We have several here. One, driving a Canon CLC 4000, does not even have enough of Windows present to install a driver (VNC in this case).

Another, driving a Konica BizHub Pro 6500 is almost wide open, except that we actually had to pay for the privilege of hooking up a monitor and keyboard. That's right, they flash the motherboard in such a way that the machine is headless, unless you pay extra.

Re:So what's the potential threat?

[Trogre]

... or as a faint watermark that wasn't immediately obvious until in the boss/client's hands.

Re:So what's the potential threat?

[Ungrounded Lightning]

Better yet: A texture map that is virtually invisible to the naked eye but becomes visible when copied by a xerographic process (like the "void" markings on some checks).

Much Earlier Article on Xerox Systems

[The Infamous TommyD]

http://csrc.nist.gov/nissc/2000/proceedings/papers/034.pdf

Basically, 9 years ago we showed some remarkably embarassing features in Xerox multifunction printer/copiers/faxes. Including SNMP access to plaintext passwords!

I wonder how many of these "features" are still there.