Hardcoded Administrator Account Opens Backdoor Access To Samsung Printers 103
hypnosec writes "A new flaw has been discovered in printers manufactured by Samsung whereby a backdoor in the form of an administrator account would enable attackers to not only take control of the flawed device, but will also allow them to attack other systems in the network. According to a warning on US-CERT the administrator account is hard-coded in the device in the form of an SNMP community string with full read-write access. The backdoor is not only present in Samsung printers but also in Dell printers that have been manufactured by Samsung. The administrator account remains active even if SNMP is disabled from the printer's administration interface."
Re:Silver Lining? (Score:3, Informative)
Question: Does anyone know if this exploit could be used to alter/remove the tracking dots every color laser printer marks its documents with?
No need. Following a link from the page you posted shows Samsung doesn't have tracking dots [eff.org].
Re:Silver Lining? (Score:2, Informative)
This just gives you the equivalent of local administrator access, and local admins can't turn off those tracking dots, so you almost certainly can't with this SNMP admin password either. The tracking-dot stuff is hardcoded somewhere that's not supposed to be user-visible, not even admin-visible.