New Printers Vulnerable To Old Languages

When we published our research on network printer security at the beginning of the year, one major point of criticism was that the tested printers models had been quite old. This is a legitimate argument. Most of the evaluated devices had been in use at our university for years and one may raise the question if new printers share the same weaknesses.

35 year old bugs features

The key point here is that we exploited PostScript and PJL interpreters. Both printer languages are ancient, de-facto standards and still supported by almost any laser printer out there. And as it seems, they are not going to disappear anytime soon. Recently, we got the chance to test a $2,799 HP PageWide Color Flow MFP 586 brand-new high-end printer. Like its various predecessors, the device was vulnerable to the following attacks:

• Capture print jobs of other users if they used PostScript as a printer driver; This is done by first infecting the device with PostScript code
• Manipulate printouts of other users (overlay graphics, introduce misspellings, etc.) by infecting the device with PostScript malware
• List, read from and write to files on the printers file system with PostScript as well as PJL functions; limited to certain directories
• Recover passwords for PostScript and PJL credentials; This is not an attack per se but the implementation makes brute-force rather easy
• Launch denial of Service attacks of various kinds:
  • PostScript based infinite loops
  • PostScript showpage redefinition
  • Disable jobmedia with proprietary PJL
  • Set the device to offline mode with PJL

Now exploitable from the web

All attacks can be carried out by anyone who can print, which includes:

• Web attacker:
  • A malicious website that uses XSP
• Network access:
  • Via Jetdirect (port 9100/tcp)
  • Via LPD (port 515/tcp)
  • Via IPP (port 631/tcp)
• Wireless access:
  • Apple Air Print (enabled by default)
• Cloud access:
  • Google Cloud Print (disabled by default)
• Physical access:
  • Printing via USB cable or USB drive
  • Potentially NFC printing (haven't tested)

Note that the product was tested in the default configuration. To be fair, one has to say that the HP PageWide Color Flow MFP 586 allows strong, Kerberos based user authentication. The permission to print, and therefore to attack the device, can be be limited to certain employees, if configured correctly. The attacks can be easily reproduced using our PRET software. We informed HP's Software Security Response Team (SSRT) in February.

Conclusion: Christian Slater is right

PostScript and PJL based security weaknesses have been present in laser printers for decades. Both languages make no clear distinction between page description and printer control functionality. Using the very same channel for data (to be printed) and code (to control the device) makes printers insecure by design. Manufacturers however are hard to blame. When the languages were invented, printers used to be connected to a computer's parallel or serial port. No one probably thought about taking over a printer from the web (actually the WWW did not even exist, when PostScript was invented back in 1982). So, what to do? Cutting support for established and reliable languages like PostScript from one day to the next would break compatibility with existing printer drivers. As long as we have legacy languages, we need workarounds to mitigate the risks. Otherwise, "The Wolf" like scenarios can get very real in your office…

More info

1. Hackers Toolbox
2. Hack Tools Mac
3. Pentest Tools Url Fuzzer
4. Hak5 Tools
5. Hack Apps
6. Pentest Tools For Android
7. World No 1 Hacker Software
8. Hacker Tools For Mac
9. Best Hacking Tools 2019
10. Computer Hacker
11. Pentest Tools Alternative
12. Pentest Automation Tools
13. Blackhat Hacker Tools
14. Pentest Tools List
15. Termux Hacking Tools 2019
16. Pentest Tools Nmap
17. Pentest Tools For Mac
18. Hacking Tools 2020
19. Game Hacking
20. Pentest Tools
21. Hack Tool Apk No Root
22. Growth Hacker Tools
23. Hack Tools For Pc
24. Nsa Hack Tools
25. Tools Used For Hacking
26. Hacker Tools For Windows
27. What Are Hacking Tools
28. Hacker Tools Free Download
29. Pentest Box Tools Download
30. Free Pentest Tools For Windows
31. Pentest Tools Apk
32. Pentest Tools Tcp Port Scanner
33. Hackrf Tools
34. Pentest Tools For Mac
35. Termux Hacking Tools 2019
36. Hacking App
37. Hacking Tools Github
38. Hack App
39. Pentest Tools Open Source
40. Hacking Tools For Windows
41. Nsa Hacker Tools
42. Hack Tools
43. Hacking Tools Online
44. Hacks And Tools
45. Blackhat Hacker Tools
46. Hacking Tools Windows 10
47. Hacking Tools Name
48. Nsa Hack Tools
49. Pentest Tools For Ubuntu
50. Hacking App
51. Hacking Apps
52. Nsa Hack Tools Download
53. Physical Pentest Tools
54. Hacker Tools For Windows
55. Hacker Hardware Tools
56. Hacker Tools
57. Hacking Tools 2020
58. Pentest Box Tools Download