Tuesday, August 25, 2020

New Printers Vulnerable To Old Languages

When we published our research on network printer security at the beginning of the year, one major point of criticism was that the tested printers models had been quite old. This is a legitimate argument. Most of the evaluated devices had been in use at our university for years and one may raise the question if new printers share the same weaknesses.

35 year old bugs features

The key point here is that we exploited PostScript and PJL interpreters. Both printer languages are ancient, de-facto standards and still supported by almost any laser printer out there. And as it seems, they are not going to disappear anytime soon. Recently, we got the chance to test a $2,799 HP PageWide Color Flow MFP 586 brand-new high-end printer. Like its various predecessors, the device was vulnerable to the following attacks:
  • Capture print jobs of other users if they used PostScript as a printer driver; This is done by first infecting the device with PostScript code
  • Manipulate printouts of other users (overlay graphics, introduce misspellings, etc.) by infecting the device with PostScript malware
  • List, read from and write to files on the printers file system with PostScript as well as PJL functions; limited to certain directories
  • Recover passwords for PostScript and PJL credentials; This is not an attack per se but the implementation makes brute-force rather easy
  • Launch denial of Service attacks of various kinds:

Now exploitable from the web

All attacks can be carried out by anyone who can print, which includes:
Note that the product was tested in the default configuration. To be fair, one has to say that the HP PageWide Color Flow MFP 586 allows strong, Kerberos based user authentication. The permission to print, and therefore to attack the device, can be be limited to certain employees, if configured correctly. The attacks can be easily reproduced using our PRET software. We informed HP's Software Security Response Team (SSRT) in February.

Conclusion: Christian Slater is right

PostScript and PJL based security weaknesses have been present in laser printers for decades. Both languages make no clear distinction between page description and printer control functionality. Using the very same channel for data (to be printed) and code (to control the device) makes printers insecure by design. Manufacturers however are hard to blame. When the languages were invented, printers used to be connected to a computer's parallel or serial port. No one probably thought about taking over a printer from the web (actually the WWW did not even exist, when PostScript was invented back in 1982). So, what to do? Cutting support for established and reliable languages like PostScript from one day to the next would break compatibility with existing printer drivers. As long as we have legacy languages, we need workarounds to mitigate the risks. Otherwise, "The Wolf" like scenarios can get very real in your office…

More articles


  1. Hacking Tools 2019
  2. Hacker Tools For Windows
  3. Hack Website Online Tool
  4. Hack Tools For Games
  5. Pentest Tools For Android
  6. Hacker Tools Github
  7. Pentest Reporting Tools
  8. Black Hat Hacker Tools
  9. Hacking Tools For Windows 7
  10. Hacking Tools For Windows
  11. Hacker Tools 2019
  12. Tools 4 Hack
  13. Hack Website Online Tool
  14. Hacking Tools For Games
  15. Hacking Tools Download
  16. Hacker Tools Windows
  17. Hacker Techniques Tools And Incident Handling
  18. Pentest Tools Framework
  19. Hacker Tools For Windows
  20. Hacker Tools
  21. Hacker Tools For Pc
  22. Hacker Tools Apk
  23. Hacker Tool Kit
  24. Hack Tools Download
  25. Pentest Tools Github
  26. Pentest Tools Online
  27. Pentest Tools Alternative
  28. New Hacker Tools
  29. Game Hacking
  30. Hacker Tools For Pc
  31. Hack Tools 2019
  32. Hacks And Tools
  33. New Hack Tools
  34. Hack Tools Online
  35. Top Pentest Tools
  36. Hack Tools For Ubuntu
  37. Hacker Tool Kit
  38. Hack Tool Apk No Root
  39. Best Hacking Tools 2020
  40. Pentest Recon Tools
  41. Hacker Tools For Ios
  42. Best Hacking Tools 2019
  43. Hack Tools Download
  44. Hacker Tools For Ios
  45. Hack Website Online Tool
  46. Beginner Hacker Tools
  47. Pentest Recon Tools
  48. Hacker Tools 2020
  49. Hacker
  50. Hack Tool Apk
  51. Hack Tools Pc
  52. Hacking Tools For Windows Free Download
  53. Hack And Tools
  54. Hacking Tools For Windows Free Download
  55. Hacking Tools 2019
  56. Hack App
  57. Pentest Tools Bluekeep
  58. Hacking Tools Software

No comments:

Post a Comment