When we published our research on network printer security at the beginning of the year, one major point of criticism was that the tested printers models had been quite old. This is a legitimate argument. Most of the evaluated devices had been in use at our university for years and one may raise the question if new printers share the same weaknesses.
35 year old
The key point here is that we exploited PostScript and PJL interpreters. Both printer languages are ancient, de-facto standards and still supported by almost any laser printer out there. And as it seems, they are not going to disappear anytime soon. Recently, we got the chance to test a $2,799 HP PageWide Color Flow MFP 586 brand-new high-end printer. Like its various predecessors, the device was vulnerable to the following attacks:
More information35 year old bugs features
The key point here is that we exploited PostScript and PJL interpreters. Both printer languages are ancient, de-facto standards and still supported by almost any laser printer out there. And as it seems, they are not going to disappear anytime soon. Recently, we got the chance to test a $2,799 HP PageWide Color Flow MFP 586 brand-new high-end printer. Like its various predecessors, the device was vulnerable to the following attacks:- Capture print jobs of other users if they used PostScript as a printer driver; This is done by first infecting the device with PostScript code
- Manipulate printouts of other users (overlay graphics, introduce misspellings, etc.) by infecting the device with PostScript malware
- List, read from and write to files on the printers file system with PostScript as well as PJL functions; limited to certain directories
- Recover passwords for PostScript and PJL credentials; This is not an attack per se but the implementation makes brute-force rather easy
- Launch denial of Service attacks of various kinds:
- PostScript based infinite loops
- PostScript showpage redefinition
- Disable jobmedia with proprietary PJL
- Set the device to offline mode with PJL
Now exploitable from the web
All attacks can be carried out by anyone who can print, which includes:- Web attacker:
- A malicious website that uses XSP
- Network access:
- Wireless access:
- Apple Air Print (enabled by default)
- Cloud access:
- Google Cloud Print (disabled by default)
- Physical access:
- Printing via USB cable or USB drive
- Potentially NFC printing (haven't tested)
Conclusion: Christian Slater is right
PostScript and PJL based security weaknesses have been present in laser printers for decades. Both languages make no clear distinction between page description and printer control functionality. Using the very same channel for data (to be printed) and code (to control the device) makes printers insecure by design. Manufacturers however are hard to blame. When the languages were invented, printers used to be connected to a computer's parallel or serial port. No one probably thought about taking over a printer from the web (actually the WWW did not even exist, when PostScript was invented back in 1982). So, what to do? Cutting support for established and reliable languages like PostScript from one day to the next would break compatibility with existing printer drivers. As long as we have legacy languages, we need workarounds to mitigate the risks. Otherwise, "The Wolf" like scenarios can get very real in your office…- Hacking Tools For Beginners
- Pentest Recon Tools
- Hack Website Online Tool
- Hacking Tools For Pc
- Hacker
- Hacker Tools For Windows
- Hacks And Tools
- Pentest Tools Nmap
- Hack Tools Online
- Hack Tools Online
- Hack And Tools
- Wifi Hacker Tools For Windows
- Hacking Tools Free Download
- Pentest Tools For Mac
- Hacking Tools Usb
- Hacking Tools For Mac
- Hacker Tools Mac
- Nsa Hack Tools
- World No 1 Hacker Software
- Hacking Tools Hardware
- Hacker Hardware Tools
- Hacking Tools 2019
- Top Pentest Tools
- Hacking Tools And Software
- Pentest Tools Port Scanner
- Hack Tool Apk
- Pentest Automation Tools
- Tools 4 Hack
- Tools For Hacker
- Hacker Tools For Pc
- Pentest Tools Apk
- Hacker Tools For Mac
- Free Pentest Tools For Windows
- Hacking Tools And Software
- Pentest Automation Tools
- Pentest Tools Subdomain
- Hacking Tools And Software
- Bluetooth Hacking Tools Kali
- Hack Tools Download
- Hacker Security Tools
- How To Install Pentest Tools In Ubuntu
- Hacking Tools Windows
- Computer Hacker
- Hacker Tools For Ios
- Hacking Tools Windows 10
- Hacking Tools Windows
- Pentest Tools Linux
- Hacks And Tools
- Hacking Tools Usb
- Pentest Tools Free
- Pentest Tools Download
- Best Hacking Tools 2020
- Hacker Tools Free
- Tools 4 Hack
- Hacker Techniques Tools And Incident Handling
- Blackhat Hacker Tools
- Hacker Tools Online
- Tools For Hacker
- Growth Hacker Tools
- Hacking Tools Online
- Hacking Tools Online
- Beginner Hacker Tools
- Hacking Tools For Kali Linux
- Pentest Tools Subdomain
- Android Hack Tools Github
- Hacker Techniques Tools And Incident Handling
- Pentest Tools For Mac
- Hack Tools Download
- Pentest Tools Subdomain
- Hacker Tools Free Download
- Hacker Tools Linux
- Hacking Tools Hardware
- Hack Tools Pc
- Hacker Tools Software
- Github Hacking Tools
- Ethical Hacker Tools
- Hack Tools
- Pentest Recon Tools
- Hacking Tools Kit
- Pentest Tools Kali Linux
- Hack And Tools
- Pentest Tools Url Fuzzer
- Hack Tools For Ubuntu
- Hack Tools 2019
- Hackrf Tools
- Hacker Tools For Windows
- Hacking Apps
- Hacker Tools Windows
- Pentest Tools For Android
- Pentest Tools Download
- Hacker Tools
- Pentest Tools List
- Nsa Hack Tools
- Hackers Toolbox
- Hacker Tools Linux
- Physical Pentest Tools
- New Hack Tools
- Hack Tools 2019
- Pentest Tools Nmap
- Hacker Hardware Tools
- What Is Hacking Tools
- Android Hack Tools Github
- Hack Tools For Windows
- Hacker Tools