Printers Vulnerable To Security Threats

jcatcw writes "Networked printers are more vulnerable to attack than many organizations realize. Symantec has logged vulnerabilities in five brands of network printers. Printers outside firewalls, for ease of remote printing, may also be open to easy remote code execution. They can be possible launching pads for attacks on the rest of the network. Disabling services that aren't needed and keeping up with patches are first steps to securing them." From the article: "Security experts say that printers are loaded with more complex applications than ever, running every vulnerable service imaginable, with little or no risk management or oversight.... [N]etworked printers need to be treated like servers or workstations for security purposes — not like dumb peripherals."

*print incoming*

[BMonger]

Dwight:

At 8 AM today, someone poisons the coffee. Do NOT drink the coffee. More instructions will follow.

Cordially, Future Dwight.

What are they going to do...

[Macthorpe]

...print out pictures of Viagra?

Jamming

[vjmurphy]

Even worse, such attacks may jam the printers, making it impossible to print out important Dilbert cartoons.

This is news?

[NoseyNick]

Was years ago I hacked my employer's printer to say: "Insert Coin" instead of "Ready" and "Feed Me" instead of "Paper tray empty" ... and I know I could have done a lot worse.

Yeah - watch out

[TheWoozle]

You don't want to become a victim of printer hacking. A malicious printer hacker could print out sheet music of copyrighted songs, stills from copyrighted movies, or child pornograhpy - leaving you a target of litigaton from the *AA or worse. Not to mention all the juvenile pranks like printing all your valuable company memos in l33t speak.

Protect your printers today!

I wonder when Symantec will release their first security software suite for printers...

Using printers to deal with rowdy girls

[GillBates0]

Not exactly the same scenario, but I think this comment [slashdot.org] by stuffman64 [slashdot.org] deserves an honorary mention here:

Last year in my apartment, I had a very loud, rowdy group of girls living above me. Basically, they would get all drunk and mean, and any attempt to ask them to politely stop stomping on the floor or whatever they do at 3AM was met with flase promises (5 minutes later they'd be at it again). Even my mack-daddy roommate couldn't seduce them in hopes of somehow convicing them to stop being so damn loud. This kid could pick up any girl he wanted, but we surmised from all the romping and giggling that perhaps they were more interested in eachother when they got so drunk (backed up by the fact that they always came to the door in robes and/or towels).

We tried to figure out a good way to get back at them. We could report them to the main office, but it's kinda a douchebag thing to do as in enails a $100 per person, not to mention that the apartment complex's owners were also douchebags and didn't deserve any more money from anyone. I'd known for a while that they had an unprotected wireless network, and all of their computers had file and print sharing enabled (not to mention that one of them appropriately named their computer "BITCHFACE"). I "stumbled upon" an ebook copy of War and Peace and decided to start printing it on all of their printers one day when I assumed they'd be at class. One of the girls (I assume the one who drives a Mercedes she must have got for graduation) had an HP Laserjet 5 (how the hell she had room for it in the apartment is beyond me), so there is a good chance I got off at least a few hundred pages before it ran out of paper. I'd assume they didn't know how or why it happened, but afterwards, any time they would be loud I'd start printing a bunch of pages of non-acronymized "STFU" pages. They eventually came down on time and told me that if we didn't stop printing, they'd tell the office. Once I reminded them that we could go down to the office to report noise violations @ $100 per person per violation (not to mention possible eviction after the 3rd violation) any time we heard any noise from them, they quickly realized we had the upper hand. After that, we didn't have any more problems with them, and actually started getting along with eachother.

I can see the 0-day exploit headline now

[antifoidulus]

"Printers worldwide slammed with requests to print the goatse man"

Symantec anti-virus for printers.

[khasim]

Given my past experience with the high quality of Symantec products we'll be switching to clay tablets and cuneiform.

In the long run, it will be easier and more cost effective.

Re:Using printers to deal with rowdy girls

[Anonymous Coward]

If there was a Penthouse for nerds, this could be the start of a great story.

Well, at least RMS is happy!

[iamacat]

The whole reason he went into open source movement is because some printer was running proprietary software that he couldn't fix. At least now anyone can download source code from HP website and modify the way your printer works in any way they want.

Re:Try it out

[jrockway]

> "CHANGE YOUR ADMIN PASSWORD NOW!" or "I AM NOT SECURE!"

I always change it to "OUT OF WATER".

I did this to every printer in my high school a few years ago, and it was great. People were speculating as to where the water should go; HP support had no idea what was wrong; etc. After that, some firewall rules were changed and it never happened again :)