Slashdot Mirror
Hardcoded Administrator Account Opens Backdoor Access To Samsung Printers
hypnosec writes "A new flaw has been discovered in printers manufactured by Samsung whereby a backdoor in the form of an administrator account would enable attackers to not only take control of the flawed device, but will also allow them to attack other systems in the network. According to a warning on US-CERT the administrator account is hard-coded in the device in the form of an SNMP community string with full read-write access. The backdoor is not only present in Samsung printers but also in Dell printers that have been manufactured by Samsung. The administrator account remains active even if SNMP is disabled from the printer's administration interface."
What about the Samsung backdoor into your phones?
He'll have a printer botnet running in no time!
Question: Does anyone know if this exploit could be used to alter/remove the tracking dots every color laser printer marks its documents with?
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Nothing like security through obscurity.
Trying to remember where I heard this, but there was something similar with the old HP laserjet printers.
I think there was a time when it was considered good practice to put backdoors like this into internet connected devices. I think the reasoning was that every device needed to have a universal password.
But yeah, this is a pretty crazy issue to have.
At least for my work. I'm down to about 5 pages a month and could probably get by with none in a pinch.
Yes. Because we don't want any way to prevent student A from cancelling student B's jobs. Or any way for a trusted user, such as the sysadmin, from cancelling all jobs.
And we definitely want all nimwits on the network to have complete and arbitrary control over how many pages they can use, or how much ink. Maximum quality print jobs in a comp sci department printer? No problem! (I remember watching a dot-matrix printer spit out a core file, that was entertaining.)
Definitely, no good whatsoever could come from a printer with any authentication control.
Obviously, Samsung agrees, because all their printers apparently have the same unchangeable admin account and password.
not if you need singed paper work
We have a few Dell 1720's and they have this issue. SNMP public is read/write on these printers even if you turn it off. We discovered this back in 2011 during an internal network security audit. The risk is pretty low for us because we have adaquate network controls but we asked Dell technical support about this and they told us that because the printers were so old there was no hope of a firmware fix; they actually first said it was a feature before I called their BS.
Anyway, they didn't even have to research it. They had it right in their KB. If it was on for the old printers and they didn't fix it on newer printers then someone dropped the ball (or wanted to keep the "feature").
but will also allow them to attack other systems in the network
We had one go on a rampage last week! It tore up half the bay before a couple of us beat to death with a dictionary and one of those big staplers from the copy room. WHY WOULD THEY EVEN PUT HIDDEN ARMS AND LEGS ON A PRINTER?!
Printers have a lot of features I don't use, so I can't understand why anyone else should be able to have those features.
I "fix" the printers in my office several times every week.
FTFY. I haven't had to fix the printers in my office for months, possibly because I did it properly last time. Let the anecdote wars begin!
systemd is Roko's Basilisk.
That girl's standing over there listening and you're telling him about our back doors?
That is all.
It's about time the large corporations sent a memo to developers to remove hard coded administrator access from its devices.
Oh good, because we wouldn't want to have any assurances that our 100MB print jobs were transferred to the printer successfully... Or know when they're running low on toner... or that there's a paper jam and the printer has caught fire... or be able to tell it to use the media in tray number 5... or be able to connect a printer to your WiFi network.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
(ob disc: I have been in the snmp field for over 25 years doing development on agents as well as nms)
let me see if I understand this:
snmp set (writes) ability using something other than snmpv3?
uhm, you're kidding me. tell me you are joking.
the vendor gets an F- in design. sheesh! snmpv3 has been out long enough so that no one should be doing ANY sets (writes) using unsecure v1/v2c.
not to mention the GALL of using a hardcoded write-password.
(you know, the snmp opportunities have nearly gone to zero and its now all outsourced (which puts me out of gainful employment, lately). and THIS is the crap 'designs' you get when you outsource it to clueless morons who get the job by being the lowest bidder. I wonder if the industry will learn its lesson that 'you get what you pay for' when it comes to actual design and architecture, not to mention implementation details.)
--
"It is now safe to switch off your computer."
Apple patented this in 2008. C'mon, Samsung, at least change the password to something other than "jobsrules".
"Believe me!" -- Donald Trump
I think I have one of the printers in question. Does this allow me to do anything useful or interesting? Where can I find more information on playing with it?
They guy who designed the security for this printer quit and became the chief of security for Onity hotel swipe card key systems, it looks like.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
FTFY. I haven't had to fix the printers in my office for months, possibly because I did it properly last time. Let the anecdote wars begin!
Actually, your printer's been going down every few days. Good thing I'm rebooting it for you from Siberia!
A printer still needs to report feedback, such as toner levels, problems like paper jams, success/failure of a job etc.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
How often you see a Samsung printer hanging around in office? And you need someone come to your office to exploit its snmp backdoor, I'd assume no one will assign their printer with a public internet IP. Maybe add a firewall / switch ACL to block it before the printer LAN port will do...
He's PC World's cousin. http://www.channelregister.co.uk/2012/11/19/police_constable_world_error/
And in case anyone else wants to test, the password is: s!a@m#n$p%c
Why does a printer have "accounts"? It's job is to print a file we throw at it. It should be nothing but a recipient of information, a dropbox. In fact it should be an email, to which you send an attached file, and the printer fetches it and prints it. Or at least that should be the interface.
By the way, HP has exactly that as a feature (ePrint) in their current printers. They give an e-mail address for your printer from their cloud service, and then you can start sending documents there.