Multifunction Printers — The Forgotten Security Risk? 153
eweekhickins writes to share an article in eWeek highlighting the forgotten risks that a multifunction printer could possibly offer. Brendan O'Connor first called attention to the vulnerabilities of these new devices at a Black Hat talk in '06 and warns that these are no longer "dumb" machine sitting in the corner and should be treated with their own respective security strategy. "During his Black Hat presentation in 2006, O'Connor picked apart the security model of a Xerox WorkCentre MFP, showing how the device operated more like a low-end server or workstation than a copier or printer--complete with an AMD processor, 256MB of SDRAM and an 80GB hard drive and running Linux, Apache and PostGreSQL. He showed how the authentication on the device's Web interface can be easily bypassed to launch commands to completely hijack a new Xerox WorkCentre machine."
First virus (Score:5, Interesting)
Re:First virus (Score:5, Insightful)
There was a famous trojan that infected apple laser printers via postscript... but I don't think it 'spread' itself so it wasn't really a virus, nor would it qualify as a Mac virus because it didn't infect Macs, just some Apple Printers.
In any case I think it just lived on the printer. Although one of its effects was to change the password, something that could only be done a limited number of times for some demented reason, which meant eventually the printer would lock you out, and you couldn't reset the password without swapping in a bios or pram, or something along those lines.
Nonetheless, yes, laserprinters have been 'servers' in their own right for over 20 years, so this is hardly news. The same is true of NAS, Routers, managed switched, and so forth. And as for an 'IT security strategy" really, what can you do? Be aware its possible, and limit your attack surfaces to a level appropriate to the risk of them being compromised and the level of damage they could do if compromised.
For most of us, "Don't put your printer on the internet" is probably sufficient"IT security strategy"... although for higher security installations, something more detailed would be required.
Re: (Score:3, Interesting)
The sysadmin who came in after me decided this was a boneheaded decision made by a network NAZI, replaced all my Linux boxen with Windows boxen, moved the printers onto the wor
Re: (Score:2)
I believe we call this "Job Security".
Re: (Score:2)
At least s/he looks like they're busy.
The trick is to continually make reports on security/installations/network status. Scripting language of choice here or Zabbix or WMI queries et al. ??? Then Shaldot/Facebook/Pr0n/2girls1cup or whatever bakes your cookie.
Re:First virus (Score:5, Funny)
Re: (Score:3, Funny)
You should have made that 'Sugar Y/N/Double'
Re:First virus (Score:4, Funny)
Fun for you, sure. YOU didn't have to clean the coins out of the gears.
Re: (Score:2)
Re: (Score:2)
It does actually have a real world use by the way - it's nice to customise the display during specialised operations, but in most environments these days, it is a little bit antiquated to do so.
Re: (Score:3, Funny)
Re: (Score:2)
Re:First virus (Score:4, Informative)
So what's the potential threat? (Score:5, Funny)
Re:So what's the potential threat? (Score:4, Funny)
Re:So what's the potential threat? (Score:4, Funny)
Re: (Score:3, Interesting)
Re:So what's the potential threat? (Score:4, Interesting)
Re: (Score:2)
I imagine something that does such a texture map, and adds a big "DO NOT COPY THIS" to the printout. Of course, the goatse image is subtitled "TOLD YOU SO".
I DID THIS! (Score:3, Funny)
Re: (Score:2)
I remember someone had created a IPTABLES -- web proxy that turned pictures upside down [ex-parrot.com] for the leechers. A few doses of goatse or tubgirl should scar them for life.
MOD PARENT UP INSIGHTFUL (Score:2)
It also makes for a realistic discussion of the risk with a non-technical user.
I don't want to lose sleep over the possibility, do you?
Except, how would you prevent it from happening? I'm not sure you can, but I'll bet the answer is in this book called Extrusion Detection. [awprofessional.com] I haven't (yet) read it, however I have read its sister book (Network Security Monitoring) by the same outstanding expert
Re: (Score:2)
Re:So what's the potential threat? (Score:5, Insightful)
Re: (Score:2)
naturally networked printers like this should live on their own subnet that refuses all port communication except inbound originating print request or necessary admin traffic from specific other networks....
so yes, lots of network admin overhead to keep them lock
Re:So what's the potential threat? (Score:5, Funny)
Re: (Score:2)
I had a client who *insisted* on printing out *every* *single* email they received.
Every one of them. And this was before I set them up with spam filtering; they printed ALL their email and they got TONS of spam.
Some people really do need to be taken out and shot.
Re: (Score:3, Interesting)
On a serious side, that machine can send a scanned docum
pr0n print (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)
Fool the black hats! (Score:5, Funny)
Re:Fool the black hats! Speak upppp.... (Score:2)
So what? (Score:4, Interesting)
Still, with client-side antivirus and firewalls, and the control we have over the servers (for a multifunction printer to be able to scan to a server, it has to be given specific access, which doesn't happen lightly), it doesn't seem like being able to access the web interface can pose a whole lot of a threat. An attacker could potentially waste a ream of paper or two, a bit of toner, but I don't foresee any major consequences.
Re: (Score:1, Informative)
Enabling the MFP to cache all documents so they can be retrieved by the hijacker is an example on how to steal sensitive information.
How about physical document security instead? (Score:5, Interesting)
Let's work with the concept that a multifunction machine get pwned for a moment. Instead of all the ideas of using it to root around on your servers, or join a botnet, what if the vulnerability did something as innocuous as FTP/SMTP (or even fax) images of scanned/printed documents to a server on the outside world?
Get a machine in a place that does financial or medical records and now you have a steady stream of confidential information going somewhere in the form of soc. security numbers, bank account numbers, etc. all in scanned form.
Since the machine probably already does this on a regular basis under normal use, it's possible that such an exploit could continue for a while before it would ever be discovered.
Re: (Score:2, Interesting)
While true it also got me the "Man I hope our I.T Manager (me) never turns on us.." look. I get one of those every month or so.
Re: (Score:2)
There's a great book called Stealing the Network: How to Own the Box [amazon.com] which contains a series of realistic short stories chronicaling a variety of black hat adventures. In one story, the protagonist uses an open printer as a base of operations from which to launch attacks on other boxes in the network. This is especially useful since internal servers may be IP-range limited to prevent direct access from outside machines.
IIRC, the attacker also used it as a gateway to steal and forward packets traveling t
Re: (Score:2)
Re: (Score:2, Funny)
Re: (Score:2)
Just what I need (Score:2)
Re: (Score:2)
Weakest Link (Score:5, Insightful)
Re: (Score:3, Funny)
Perhaps I'm jaded, but is this news? (Score:5, Insightful)
FerCrissakes, every USB stick has that ability if you have not done your work/research etc.
But still, by far, the most dangerous thing on your network is the end user(s)...
That's life, it's the way the cookie crumbles, and it's how you're going to lose brownie points with the PHB at work.
It ain't news. (Score:3, Insightful)
I apologized and pulled the camera off the network. I then plugged it int
Re: (Score:2)
On mainframes, you don't even have to stand next to the printer - you can see big jobs (payroll?) if you have SDSF access to the print spooler.
Re: (Score:3, Informative)
Re: (Score:2)
Some of the current crop of printers theoretically have a "confidential print" option where you tell it to wait for a name and a PIN before it actually starts spitting paper out. Lexmark T632's are one I'm familiar with.
I say "theoretically" because I've tried to use the fea
Hit it, The Paper (Score:3, Funny)
Screeeeeeeech
Re: (Score:2, Funny)
The cleverest hacks are in front of your nose (Score:5, Interesting)
Maybe your VoIP system's very happy you linked it to your Active Directory with an administrative logon. Seen any weird LDAP requests recently? Had to reboot your RIP engine recently? Surprise!
Diligence is its own reward.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Not simply PSC then (Score:3, Informative)
Re: (Score:2)
Re: (Score:3, Interesting)
We have bunch of these Xeroxes that have - wait for it - an XP workstation hanging off them! No idea what the advantage to that is. You can't use it as a print server, because only ten people at a time can have a connection to it, so as soon as it starts to
Re: (Score:2)
the printers don't have a e-net port on them?
Sound like a PHB move.
Re:Not simply PSC then (Score:4, Interesting)
What you are describing is an EFI Fiery RIP. This is not just a "workstation hanging off of the printer." It is doing the actual work of rasterizing the Postscript. Get rid of it, and your Xerox is not even a dumb printer. It won't print at all.
EFI Fiery controllers generally run a version of XP Embedded, which is itself locked down in a variety of ways, but sometimes not. They often have a proprietary motherboard with unique RIP hardware. We have several here. One, driving a Canon CLC 4000, does not even have enough of Windows present to install a driver (VNC in this case).
Another, driving a Konica BizHub Pro 6500 is almost wide open, except that we actually had to pay for the privilege of hooking up a monitor and keyboard. That's right, they flash the motherboard in such a way that the machine is headless, unless you pay extra.
Re: (Score:2)
Regardless - get the bizhub PRO C6500 AWAY from any network that should be secure. It's a print room machine and should be in your print room (on an isolated print room network). If you want a secure product for your corporate network, you should consider a bizhub branded product rather than a bizhub PRO branded p
Re: (Score:2)
The difference is that the Xeroxes without a separate box have some sort of RIP hanging off the back of them, or a very simple internal RIP. Fiery sells simplified controllers that are still running XP (or 2000) internally, but have
Re: (Score:2)
Both Fiery and Creo are still used on Production colour though.
See another of my posts in another thread discussing the security of Konica Minolta own systems. Fiery and Creo are for the print room and that's where they should stay. Don't put either of them anywhere near a corpor
Gee, (Score:1)
You can run Linux on 2Mb of flash (Score:3)
This means that anything that size or bigger, could be running a set of software perfectly able to be compromised, and used as a springboard into other systems. Anything with a network port should have the same security policies applied as a server.
[1] e.g. http://www.picotux.com/techdatae.html [picotux.com]
Re: (Score:2)
Re: (Score:2)
Security (Score:2)
http://www.lynuxworks.com/solutions/security.php [lynuxworks.com]
http://www.coyotos.org/ [coyotos.org]
Multi-malfunction devices, more like it (Score:3, Insightful)
Brendan O'Conner first called attention to the vulnerabilities of these new devices at a Black Hat talk in '06 and warns that these are no longer "dumb" machine sitting in the corner and should be treated with their own respective security strategy.
The Xerox WorkCentres are more likely to malfunction, first. They jam incessantly unless you use Xerox brand paper (rather than design their machines to handle popular paper, they design their machines to only handle Xerox paper properly) and they have basic design defects- for example, toner builds up on fingers near the fuser assembly, which has to be scraped off regularly or the machine starts to jam with increasing frequency.
Also, the print spooler PC on the back of the 3535 units (the B&W ones, may have that # wrong) were completely stupid- when the copier displays a message to the effect of "PC booting" with a progress bar, it's a TIMER, and nothing more- the machine doesn't actually check if the PC successfully booted and is accepting jobs.
Don't even get me started about how atrocious the Windows-based RIP engine is for the color printers.
Not even remotely "smart".
Chip Crowding - Firmware Hack (Score:2)
Of course I didn't, nor did anyone here do
Re: (Score:2)
Re: (Score:2)
Several people had the same hack as ours later in the thread - as difficult as it is to read the "crazy" ones, they are pretty accurate as well. Once you've been "there" everything else become somewhat trivial by comparison.
http://www.securityfocus.com/cgi-bin/index.cgi?c=articlecomments&op=display_comments&ArticleID=11372&expand_all=true&mode=threaded [securityfocus.com]
Not-too-long-ago... (Score:2)
Mind you, it still printed.
This is just the technology filtering down. :)
At my work (a bank)... (Score:5, Funny)
They purchased it for scanning confidential documents. The hitch is that there is only 1 way to get documents off of this printer: A public non-protected network share... This is basically against the law for a bank.
I suggested that I could set up a private network and they could securely upload docs to the proper place with the right security, however that plan was nixed for being "non-standard"
The result is that now they consult me when buying a pencil sharpener because they don't know how it will affect network security.
Envelopes (Score:2)
Re: (Score:2)
Sadly that's a hardware problem - not a software problem.
It seems like a simple thing to do until you start thinking about the variety of thicknesses which have to pass through the rollers without jamming - oh and flaps, and gum which can't degrade from the heat if they pass through a fuser, so stick to the device if a flap folds up...
They actually make specialty envelope printers for high volume applications, they are almost universally based on inkjet technology because it is cold printing.
Personally I
Poor article title (Score:2)
AV (Score:2, Funny)
Much Earlier Article on Xerox Systems (Score:3, Interesting)
Basically, 9 years ago we showed some remarkably embarassing features in Xerox multifunction printer/copiers/faxes. Including SNMP access to plaintext passwords!
I wonder how many of these "features" are still there.
Old news is... old news (Score:2)
The generation of WorkCentre Pros mentioned in the article are no longer part of the current line up.
A 'smart' network entity will be a risk if it isn't locked down regardless of whether it is a printer or a server or a desktop computer.
The current generation of devices have improved security features including encryption of job files and digital watermarking at creation to ensure you can track the originator of any document.
To use a basic analogy - if you don't close and lock your doors - is it the hous
My old idea of "Multifunction Printer" (Score:2)
Now goatse-laden printers, that's scary.
The first Laserprinter was the fastest Apple (Score:2)
Re:ABout time (Score:5, Insightful)
Some details please.
Re: (Score:2)
Re: (Score:2)
Re:ABout time (Score:4, Funny)
Re: (Score:2, Insightful)
Re: (Score:2)
Re: (Score:3, Informative)
Plus how do you know what IP address is a printer without special tools such as a sniffer.
It's pretty rare for people to change the MAC address of their devices, even on devices that allow it. And since each vendor is allocated its own prefix(es) it's pretty straightforward to narrow your search to e.g. Xerox MAC addresses. With a bit of research it's likely you'd be able to find even narrower prefixes that the vendor has allocated to particular types of printers.
don't you want to control that printer and it's agent from outside the bank? To do that you got to do a lot more things, like change firewall/router rules and routing tables
I think that's what the installation of the wireless router is for.
Also, don't forget that all your criticisms are implying tha
Re: (Score:2)
Re: (Score:2)
Think before you post. (Score:2)
Did you even read the guy's entire post? Why would you need to cut a cable to break into the network with a wireless connection? You must be clueless because you think it is some amazing feat to run a network sniffing program.
Where does slashdot get posters these days? Oh yeah, they are 12 year old kids. I used to read this site because quite a few posters seemed to be experts in their respective fields--at least the ones who where modded up. Now I don't know why I bother.
Since apparently we have to sig
Re: (Score:2)
The "wireless" was referring to the tap that the attackers attached to the network, not to an existing wireless connection. You'd still have to tap into the rest of the bank's network somewhere. It's doubtful they'd have an RJ45 socket hanging around in the
Lol (Score:2, Funny)
Re: (Score:2)
Re: (Score:2, Informative)
http://www.troygroup.com/SecurityPrinting/products/MICRPrinter/4300secure.asp [troygroup.com]
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
The archive [notacon.org] of the talk is here: [mp3] [notaconmedia.com], [avi] [notaconmedia.com]. Essentially, most of the webservers in these things are vulnerable to all sorts of mischief. If you can own the underlying OS, the sky's the limit.