Slashdot Mirror
Hardcoded Administrator Account Opens Backdoor Access To Samsung Printers
hypnosec writes "A new flaw has been discovered in printers manufactured by Samsung whereby a backdoor in the form of an administrator account would enable attackers to not only take control of the flawed device, but will also allow them to attack other systems in the network. According to a warning on US-CERT the administrator account is hard-coded in the device in the form of an SNMP community string with full read-write access. The backdoor is not only present in Samsung printers but also in Dell printers that have been manufactured by Samsung. The administrator account remains active even if SNMP is disabled from the printer's administration interface."
What about the Samsung backdoor into your phones?
He'll have a printer botnet running in no time!
Question: Does anyone know if this exploit could be used to alter/remove the tracking dots every color laser printer marks its documents with?
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Nothing like security through obscurity.
Trying to remember where I heard this, but there was something similar with the old HP laserjet printers.
I think there was a time when it was considered good practice to put backdoors like this into internet connected devices. I think the reasoning was that every device needed to have a universal password.
But yeah, this is a pretty crazy issue to have.
Crap! Now I have to move my printers out of the DMZ.
It's hard to understand how we've got to the point where the simplest items to explain are so complex in reality.
Why does a printer have "accounts"? It's job is to print a file we throw at it. It should be nothing but a recipient of information, a dropbox. In fact it should be an email, to which you send an attached file, and the printer fetches it and prints it. Or at least that should be the interface.
But what we have now is just a horrible mess. I fix the printers in my office several times every week. They're very unreliable, over-engineered pieces of hardware.
It's not "back-to-basics" that we need, it's just common sense.
A printer should be a computer that only receives files and prints them. They should not be "connected" to a network any more than a UDP package is connected to its recipient.
At least for my work. I'm down to about 5 pages a month and could probably get by with none in a pinch.
not if you need singed paper work
We have a few Dell 1720's and they have this issue. SNMP public is read/write on these printers even if you turn it off. We discovered this back in 2011 during an internal network security audit. The risk is pretty low for us because we have adaquate network controls but we asked Dell technical support about this and they told us that because the printers were so old there was no hope of a firmware fix; they actually first said it was a feature before I called their BS.
Anyway, they didn't even have to research it. They had it right in their KB. If it was on for the old printers and they didn't fix it on newer printers then someone dropped the ball (or wanted to keep the "feature").
but will also allow them to attack other systems in the network
We had one go on a rampage last week! It tore up half the bay before a couple of us beat to death with a dictionary and one of those big staplers from the copy room. WHY WOULD THEY EVEN PUT HIDDEN ARMS AND LEGS ON A PRINTER?!
That girl's standing over there listening and you're telling him about our back doors?
That is all.
It's about time the large corporations sent a memo to developers to remove hard coded administrator access from its devices.
Time to start attacking the company samsung directly!
Backdoors are a-ok! Company approved!
Lets get to cracking anonymous! at the very least it will be entertaining to sit and decide when all the printers in a company will spit out a goatse pic.
captcha:jammed (lol)
'PC Load Letter'? What does that mean?
(ob disc: I have been in the snmp field for over 25 years doing development on agents as well as nms)
let me see if I understand this:
snmp set (writes) ability using something other than snmpv3?
uhm, you're kidding me. tell me you are joking.
the vendor gets an F- in design. sheesh! snmpv3 has been out long enough so that no one should be doing ANY sets (writes) using unsecure v1/v2c.
not to mention the GALL of using a hardcoded write-password.
(you know, the snmp opportunities have nearly gone to zero and its now all outsourced (which puts me out of gainful employment, lately). and THIS is the crap 'designs' you get when you outsource it to clueless morons who get the job by being the lowest bidder. I wonder if the industry will learn its lesson that 'you get what you pay for' when it comes to actual design and architecture, not to mention implementation details.)
--
"It is now safe to switch off your computer."
Apple patented this in 2008. C'mon, Samsung, at least change the password to something other than "jobsrules".
"Believe me!" -- Donald Trump
I think I have one of the printers in question. Does this allow me to do anything useful or interesting? Where can I find more information on playing with it?
It's all because Samsung engineers are backdoor kind of guys.
They guy who designed the security for this printer quit and became the chief of security for Onity hotel swipe card key systems, it looks like.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
How often you see a Samsung printer hanging around in office? And you need someone come to your office to exploit its snmp backdoor, I'd assume no one will assign their printer with a public internet IP. Maybe add a firewall / switch ACL to block it before the printer LAN port will do...
Or more generally about all the backdoors hidden deep down in hardware that we never heard about and yet that are daily used by state agencies to spy on citizens / companies / agencies.
Huawei certainly comes to mind...
But then about stuff like the good old Crypto AG stuff where the key for mobile phone encryption would still be encrypted, but the rogue hardware chip would reduce the keyspace by using a certain number of known bits?
I'm typing this on a MacBook Pro and between Apple, the Huawei 3G USB Internet connection and the Intel CPU, I'm wouldn't be surprised if there were three of four backdoors here (not mentionning my good old iPhone 3 sitting on my desk).
Sad world.
And in case anyone else wants to test, the password is: s!a@m#n$p%c
It is issues like this that make the whole idea behind IPv6 (that everything needs an internet address) so silly.
Nobody wants to put their printer on the internet. If only because they do not want it to be hacked by a scriptkiddy.