Printers Vulnerable To Security Threats

jcatcw writes "Networked printers are more vulnerable to attack than many organizations realize. Symantec has logged vulnerabilities in five brands of network printers. Printers outside firewalls, for ease of remote printing, may also be open to easy remote code execution. They can be possible launching pads for attacks on the rest of the network. Disabling services that aren't needed and keeping up with patches are first steps to securing them." From the article: "Security experts say that printers are loaded with more complex applications than ever, running every vulnerable service imaginable, with little or no risk management or oversight.... [N]etworked printers need to be treated like servers or workstations for security purposes — not like dumb peripherals."

Try it out

[delirium of disorder (701392)]

Over the past several years, if you did a random port scan of the Internet (nmap -iR) the majority of open telnet (tcp port 23) servers were print servers that let you telnet in and change all sorts of settings.

Re:Try it out

[Anonymous Monkey (795756)]

What most people don't get is that that cute, slim-line print kit that they slid in the back of there copy machine is, in fact, made out of lap top parts and running DOS. Any multifunction print system is a computer with a printer & scanner attached, and should be treated thusly.

Re:Try it out

[advocate_one (662832)]

More likely a stripped down Linux... I assisted a service agent a couple of years ago and the fancy photocopier, scanner, faxer, emailer (it could scan and send the scans as emails... very useful) beast showed a Linux boot up sequence while booting into safe mode (he knew the secret jumper to set for this mode)... Also, my HP PSC1350 is running Linux, I know this because when I was installing Debian on my computer a few months ago, I had the printer connected and powered up and the Debian installer wanted to know if I wanted to install debian onto the ext2 partition it had found on the printer (connected via USB). I was rather surprised and thankfully I hadn't blindly accepted it.

Well, at least RMS is happy!

[iamacat (583406)]

The whole reason he went into open source movement is because some printer was running proprietary software that he couldn't fix. At least now anyone can download source code from HP website and modify the way your printer works in any way they want.

Re:

[Anonymous Monkey (795756)]

I have not played with a print controller in a while. The last time I was working with one was about two years ago, back then a brand new Konica ran MS-DOS.

Knowing that they are now Linux is a good bit of information.

Re:

[advocate_one (662832)]

no, there was no card in the slot, and it showed up as a 2 gig ext2 partition.

Re:

[nine-times (778537)]

I really don't get this-- why? Why would you put your printer outside your firewall? So you can print from the internet? What's the point?

Re:Try it out

[soft_guy (534437)]

I really don't get this-- why? Why would you put your printer outside your firewall? So you can print from the internet? What's the point?

The point is that these printers aren't being configured this way on purpose - people plug them and and dick with them randomly until they get a document to physically come out of the printer. Then they walk away from it and never think about it again until it runs out of toner.

Re:

[bladesjester (774793)]

Some companies (especially smaller ones) do this because they want one of their workers to be able to print things on the office printer from their home office or some other place. They don't want to drop the money on getting a vpn set up, so they just put the printer out there and trust that nobody else can print to it (or don't know that someone else can).

I know it sounds strange to us, but it does happen.

Is it worth it?

[yog (19073)]

Why make printers so "smart" to begin with? Used to be, a man was a man and a printer was a printer. It did what its master told it. The things had just enough internal logic to interpret the voltage differences on the RS232 pins, and maybe a few K of RAM (hah!) to buffer the jobs.

Now they have minds of their own. *Grumble* visions of departmental HP printers that never seemed to be configured properly, always displaying bizarre diagnostic messages
Even a $150 Brother all-in-one machine at the office is

Re:

[Mister Whirly (964219)]

If I find an open printer with out an admin password set, I generally will go in and keep changing the language to Portuguese or German on the control panel. It is mostly harmless, and points out the fact that someone can go in and easily change their settings. Some control panels even let you display a custom message. On those I have it read "CHANGE YOUR ADMIN PASSWORD NOW!" or "I AM NOT SECURE!"

Re:Try it out

[jrockway (229604)]

> "CHANGE YOUR ADMIN PASSWORD NOW!" or "I AM NOT SECURE!"

I always change it to "OUT OF WATER".

I did this to every printer in my high school a few years ago, and it was great. People were speculating as to where the water should go; HP support had no idea what was wrong; etc. After that, some firewall rules were changed and it never happened again :)

*print incoming*

[BMonger (68213)]

Dwight:

At 8 AM today, someone poisons the coffee. Do NOT drink the coffee. More instructions will follow.

Cordially, Future Dwight.

Identifying viruses

[Calinous (985536)]

One of my colleague told me about a printer that started printing page after page of funny characters. It seems there was a virus in the network, trying to write himself on all shares - of which the printer had one.
      How much is able one of those printers to do? Printers dedicated to big offices have a pretty powerful processor, lots of RAM, hard drive. Taking control of such a printer could be just as useful for a black-hat cracker as taking control of a computer there, with the bonus that printers aren't usual suspects for infections

Re:

[chunews (924590)]

In my experience, that virus - printing page after page of funny characters - is a human one, from someone trying to print a PCL formatted file to a PostScript printer or vice versa.

Re:

[Calinous (985536)]

It was a printer in a Windows network - and the network was inside a trash truck, street cleaning company. And when the computers with the virus were taken off network, the printing stopped

Re:

[ajs318 (655362)]

Or from switching on the printer after the instruction to enter graphics mode has been sent ..... resulting in the bitmaps which would make up the graphics being treated as ASCII codes, and printed in the printer's native font.

But no; I have seen a printer chuck out pages of junk, starting with "This program requires Microsoft Windows" or something, and it was due to an infected Windows machine trying to copy the virus to every SMB share it could see. Including the printer (which was on a SAMBA share).

What are they going to do...

[Macthorpe (960048)]

...print out pictures of Viagra?

Re:

[Calinous (985536)]

Taking a snapshot of everything that is printed, and mail it to an interesting party?
Altering what is printed? Change amounts on printed spreadsheets, change destination for item transfers, and other "creative uses"

Re:

[geekoid (135745)]

Ok, this is scary.

One of the first attacks done by security consultants is the printer. From there you can get into the network.

The fact that people here don't seem to relize this is just disconscerting.

Re:

[Macthorpe (960048)]

Or maybe I did realise it, and accidentally told a joke instead of making a serious comment (ohnoes).

I would say that it won't happen again, but I'm sure it will.

Double duh

[by Anonymous Coward]

Printers have been network servers for a long time now. I have a 1995 vintage networked laser from Digital Equipment Corporation (rest in pieces) and its manual tells the exact procedure to get to the command line, by using a default password and telnt. Yes, this printer has a unix-like command line interface for configuring its print server functions, and anyone who knows the IP address and the password can get in. Needless to say I've been careful to keep the printer behind my firewall box.

Happened before

[CapitalT (987101)]

Anyone remember the story about the guy who wrote a "visual basic" virus to send the O RLY owl to all printers in the company?

Maybe we'll see a lot of these coming, it'll be fun *hee hee hee* {devilish laugh}. I don't have a printer }:-]

Jamming

[vjmurphy (190266)]

Even worse, such attacks may jam the printers, making it impossible to print out important Dilbert cartoons.

This is news?

[NoseyNick (19946)]

Was years ago I hacked my employer's printer to say: "Insert Coin" instead of "Ready" and "Feed Me" instead of "Paper tray empty" ... and I know I could have done a lot worse.

Re:

[by Anonymous Coward]

It seems like an innocent trick, but I once cost a company thousands. They had one printer that was cleared by the NSA for printing classified documents -- it didn't store the things it printed in RAM, or it had some approved method of obfuscating its RAM, or some shit.

I started dicking around with the PCL "ready" message, and they realized that it COULD store data -- in the "ready" message.

New printer, ahoy!

Yeah - watch out

[TheWoozle (984500)]

You don't want to become a victim of printer hacking. A malicious printer hacker could print out sheet music of copyrighted songs, stills from copyrighted movies, or child pornograhpy - leaving you a target of litigaton from the *AA or worse. Not to mention all the juvenile pranks like printing all your valuable company memos in l33t speak.

Protect your printers today!

I wonder when Symantec will release their first security software suite for printers...

Symantec anti-virus for printers.

[khasim (1285)]

Given my past experience with the high quality of Symantec products we'll be switching to clay tablets and cuneiform.

In the long run, it will be easier and more cost effective.

Campus Printers

[cpearson (809811)]

On many if not most college campuses the printers are administered and accounted for my a system tied to a student id. Each student can get so many free prints per semester and can pay per print after exceeding that. Malicious code executing on a print server could sniff all the student accounts accessing the printer.

http://www.vistahelpforum.com/ [vistahelpforum.com]

Re:

[pla (258480)]

On many if not most college campuses the printers are administered and accounted for my a system tied to a student id.

Yeah, I've seen that done before - It entirely depends on students printing via locked-down (usually Windows) print servers.

Just note the printer model, download the driver, and install the printer directly on your laptop. Bam, free and unlimited printing.

Re:

[drinkypoo (153816)]

Yeah, I've seen that done before - It entirely depends on students printing via locked-down (usually Windows) print servers. Just note the printer model, download the driver, and install the printer directly on your laptop. Bam, free and unlimited printing.

The people at some schools are not idiots and can prevent you from doing this. Some printers actually have access controls, although people seldom bother to use them. Set an admin password, and disallow network printing from any but the print server

Re:

[profplump (309017)]

First, an almost trivial change supported by many if not most printers is to allow print jobs only from a certain host or set of hosts. HP's JetDirect cards can even read that list of hosts from a DHCP parameter, so you don't have to update all your printers if the queue changes.

Since this is only an IP-based security solution it can be overcome, but it's not as trivial as plugging your computer into the network and installing the print drivers, at least not if the network is reasonably secured in the first

Re:Campus Printers

[afidel (530433)]

The LPT/USB port isn't usually disabled, so just hook up a cable and print =)

This is what happened to Iraq.

[darkmeridian (119044)]

Laugh if you want, but this was what happened to Iraq on the eve of the Gulf War. A modified printer was put onto their defense computer network by an Allied operative. Right when the air war started, the bug fired up and brought down the network. Just because a threat sounds outlandish does not mean it isn't a real threat.

(The story was recounted in The Generals' War.)

Re:

[by Anonymous Coward]

Just because you read it soemwhere doesn't mean it's true [theregister.co.uk] Try googling "gulf war printer virus"

Using printers to deal with rowdy girls

[GillBates0 (664202)]

Not exactly the same scenario, but I think this comment [slashdot.org] by stuffman64 [slashdot.org] deserves an honorary mention here:

Last year in my apartment, I had a very loud, rowdy group of girls living above me. Basically, they would get all drunk and mean, and any attempt to ask them to politely stop stomping on the floor or whatever they do at 3AM was met with flase promises (5 minutes later they'd be at it again). Even my mack-daddy roommate couldn't seduce them in hopes of somehow convicing them to stop being so damn loud. This kid could pick up any girl he wanted, but we surmised from all the romping and giggling that perhaps they were more interested in eachother when they got so drunk (backed up by the fact that they always came to the door in robes and/or towels).

We tried to figure out a good way to get back at them. We could report them to the main office, but it's kinda a douchebag thing to do as in enails a $100 per person, not to mention that the apartment complex's owners were also douchebags and didn't deserve any more money from anyone. I'd known for a while that they had an unprotected wireless network, and all of their computers had file and print sharing enabled (not to mention that one of them appropriately named their computer "BITCHFACE"). I "stumbled upon" an ebook copy of War and Peace and decided to start printing it on all of their printers one day when I assumed they'd be at class. One of the girls (I assume the one who drives a Mercedes she must have got for graduation) had an HP Laserjet 5 (how the hell she had room for it in the apartment is beyond me), so there is a good chance I got off at least a few hundred pages before it ran out of paper. I'd assume they didn't know how or why it happened, but afterwards, any time they would be loud I'd start printing a bunch of pages of non-acronymized "STFU" pages. They eventually came down on time and told me that if we didn't stop printing, they'd tell the office. Once I reminded them that we could go down to the office to report noise violations @ $100 per person per violation (not to mention possible eviction after the 3rd violation) any time we heard any noise from them, they quickly realized we had the upper hand. After that, we didn't have any more problems with them, and actually started getting along with eachother.

Re:

[by Anonymous Coward]

If there was a Penthouse for nerds, this could be the start of a great story.

Isn't anything on the network a vulnerability?

[192939495969798999 (58312)]

I figure it's safer to assume that anything connected to the network could be an attack point. If you have a network toy like some light-up furby that connects to the network and changes color based on packet throughput, that thing probably has no security whatsoever on it (even assuming it has embedded linux or something).

How FUDtastic!!!

[by Anonymous Coward]

Symantec is really grasping at straws here. In the age of internet security, why anyone would put a printer outside the firewall is too far beyond me to comprehend. Any firewall admin should be able to put rules in place for remote printing. And for that matter, why does any one need to remotely print? Anybody heard of email? Ol' deskjet at home too slow? Users in the office too lazy? Too many pebcak errors? Remote printing may be the most worthless of the worthless network setups. Also, why are people not

Toner and Ink Cartridge companies look to exploit.

[Radon360 (951529)]

Imagine those companies that sell expensive toner and ink cartridges pairing up with someone to write some malicious code to burn through your printing supplies faster.

It won't be long before you hear about something like the "Page_Blackout" or "Toner_Drain" worm.

I can see the 0-day exploit headline now

[antifoidulus (807088)]

"Printers worldwide slammed with requests to print the goatse man"

Funny to realise that in 2006

[denisbergeron (197036)]

I find, use and patch somes problems with [ancester of] theses printers from 1998. I have to run some tests for the Y2K projet in that time, and we so much open telnet attack that can be made from printer, we design some specials firewall and network rules at that time.

If you are in the security industry

[geekoid (135745)]

and this is news to you, please get out of the business.

firewall

[bfields (66644)]

Printers outside firewalls, for ease of remote printing, may also be open to easy remote code execution.

Unlike, of course, printers behind firewalls, which are not at all open to remote code execution, since there's no chance that anything attached to the firewalled network will ever be hacked. Ah, the magic of the firewall.

Two areas of concern here

[RealProgrammer (723725)]

In security we balance likelihood of attack, likely damage, and cost to mitigate the threat. The cost to mitigate includes labor, time, materials, and increased difficulty to use (or decreased availability of) the asset. For printers there are at least two such areas of concern (people model them as vectors or attack trees, variously).

1. telnetting in
   1. For a base of operations
   2. As an aid in information gathering
2. Denial of service
   1. Printing garbage as an annoyance
   2. Causing apparent hardware failure, distracting service personnel from real attacks
   3. Damaging the device with invalid NVRAM
3. Loss of integrity: modify interpreter to change printing behavior in some mission-sensitive way.

For example, you could display "028*: Radon Discharge Hazard" or some other nonsense trouble symptoms at random intervals on the control panel. The techs in charge would then have to deal with that problem, while you attack their database server or other target. With a modified Postscript interpreter, you could insert random words or even carefully selected phrases in documents as they printed, using the same font that the document prints. How often do people proofread the text of a document they just proofread on screen? Only if they printed it to proofread it, and even then they might not notice. Also, printers in network environments often have file storage space, which makes them a target both to corrupt, if their storage is used in production. If the area is not used in production, it can be used by a rogue to hide things, since typically no one looks at that storage area if it's not in production.

Hacking Embedded Network Systems

[nuckfuts (690967)]

FX of Phenoelit gave an amazing talk on this at CanSecWest/core03 back in 2003 that outlined how to turn a JetDirect printer into a webserver, fileserver or even a port scanner! We all had a huge chuckle at the thought of someone tracking down a port scanner on the network only to find it was coming from an HP printer.

The entire presentation is still available online in both PDF [cansecwest.com] and PPT [cansecwest.com] format.

The tools used to hack the printers are available here [phenoelit.de].

HP Isn't the only brand

[howlinmonkey (548055)]

I work in the networked printer/multifunction industry. While HP is popular on desktops, other brands are gaining, and rule in the 50ppm+ arena. These devices come from other vendors like Canon, Sharp, Kyocera and Xerox. These multifunction devices provide scan, fax and print services and run a variety of OS's from VxWorks to Solaris. Yes Johnny, that means Windows XP embedded as well. Although I have to say, I haven't seen a DOS based controller in about 6 years.

We routinely receive questions about security, and help patch and configure these boxes to meet network security requirements as closely as possible. Unfortunately, we have limited access to the core OS, so we go as far as we can and workaround the rest. Many vendors, especially those using Windows, provide controller patches with security fixes included. EFI [efi.com] even allows an admin to RDP in and use Windows Update to keep current

These devices aren't perfect, but they have come a long way. That being said, if you haven't heard about this in the past, you have no business being in charge of network security. Multifunction devices today are just as powerful as your desktops and servers, running the same software. Admin control is limited, and vulnerabilities are a reality - note the recent Xerox vulnerability [xerox.com]

I would say it is important to stay in contact with your local vendor/dealer to stay on top of these issues. We work with these products everyday, and receive regular notices about security issues and solutions, not to mention a wide variety of other product data. We are a resource, just like any other outside consultant, to help you get and stay secure.

Re:Unless...

[Jeremiah Cornelius (137)]

We used these REGULARLY to exploit banks, in our testing.

The high-end HPs had both harddisk, and a JVM with listening socket on port 80. WHeee!

Re:

[AndroidCat (229562)]

And if you had some search engine toolbar installed, and printer was visible to the outside, its config page was probably snitched to the rest of the world.

Re:Unless...

[FooAtWFU (699187)]

My school, before the Great Firewalling of its network a few years ago, had its printers open to the whole Internet. Apparently someone hacked into one and used it as an FTP server for warez and porn. And it still worked as a printer. :)

Of course, this also means that I can't stick up a website for the world from my laptop anymore, either. =/ Ah well.