us-17-Mueller-Exploiting-Network-Printers

Prévia do material em texto

Exploiting Network Printers
Jens Müller, Vladislav Mladenov, 
Juraj Somorovsky, Jörg Schwenk
1
Why printers?
1987 2017
2
Evolution
3
Yet another T in the IoT?
• Systematization of printer attacks
• Evaluation of 20 printer models
• PRinter Exploitation Toolkit (PRET)
• Novel attacks beyond printers
• New research directions
4
Contributions
1. Background
2. Attacks
3. Evaluation
4. PRET
5. Beyond printers
6. Countermeasures
5
Overview
1. Printing channel (USB, network, …)
2. Printer language (PJL, PostScript, …)
6
How to print?
7
What to attack?
Printing
Unit
Printer USB
RAW
IPP
LPD
SMB
PJL
Interpreter
PostScript
Interpreter
Further
Interpreter
(PCL, PDF, …)
• Printer Job Language
• Manages settings like output tray or paper size
@PJL SET PAPER=A4
@PJL SET COPIES=10
@PJL ENTER LANGUAGE=POSTSCRIPT
• NOT limited to the current print job
8
PJL
• Invented by Adobe (1982 – 1984)
• Heavily used on laser printers
• Turing complete language
9
PostScript
1. Background
2. Attacks
3. Evaluation
4. PRET
5. Beyond printers
6. Countermeasures
10
Overview
• Is your copy room always locked?
11
Attacker model: Physical access
• Who would connect a printer to the Internet?
12
Attacker model: Network access
13
Attacker model: Network access
Attacker
(Insider)
Attacker
14
Attacker model: Web attacker
Carrier
Attacker
(Website)
• Denial of service
• Protection bypass
• Print job manipulation 
• Information disclosure
15
Four classes of attacks
• Postscript infinite loop
{} loop
16
Denial of service
16
Next level DoS
• NVRAM has limited # of write cycles
• Can be set in print jobs themselves!
• Continuously set long-term
value for number of copies
@PJL DEFAULT COPIES=X
17
Physical damage
• Reset to factory defaults
• Can be done with a print job (HP) 
@PJL DMCMD ASCIIHEX= 
"040006020501010301040106"
17
Protection bypass
• Redefinition of Postscript showpage operator
18
Print job manipulation
• Access to memory
• Access to file system
• Capture print jobs
 Save on file system or in memory
19
Information disclosure
20
Attacker model: Web attacker
Carrier
Attacker
(Website)
21
Same-origin policy
Carrier
evil.org internal.bank.com
22
CORS spoofing
Carrier
evil.org
JavaScript (PS file)
(HTTP/1.0 OK) print
(Access-Control-Allow-Origin: evil.org) print
…
printer.bank.com:9100
1. Background
2. Attacks
3. Evaluation
4. PRET
5. Beyond printers
6. Countermeasures
23
Overview
• How would you proceed?
Our approach: Contacted university 
system administrators
24
Obtaining printers
25
Printers. Lots of printers
26
Evaluation results
Overview
1. Background
2. Attacks
3. Evaluation
4. PRET
5. Beyond printers
6. Countermeasures
27
Overview
Translator
PJL PostScript
PRET
Result
/str 256 string def (%*%../../../*) {==} str filenameforall
PostScript Request
PJL Request
PJL Response
(%disk0%../../../ init)
(%disk0%../../../.profile)
(%disk0%../../../tmp)
Postscript Response
init TYPE=FILE SIZE=1276
.profile TYPE=FILE SIZE=834
tmp TYPE=DIR
@PJL FSDIRLIST NAME="0:\..\..\" ENTRY=1 COUNT=3User command
- 834 .profile
- 1276 init
d - tmp
ConnectorAttacker
ls
28
PRinter Exploitation Toolkit (PRET)
29
PRET commands
1. Background
2. Attacks
3. Evaluation
4. PRET
5. Beyond printers
6. Countermeasures
30
Overview
31
Google Cloud Print
Target: Google
Attacker
Converting PostScript = interpreting PostScript
• PS conversion websites
• Image conversion sites
• Thumbnail preview
32
PostScript in the web?
1. Background
2. Attacks
3. Evaluation
4. PRET
5. Beyond printers
6. Countermeasures
33
Overview
34
Countermeasures
“Hacker Stackoverflowin made 160,000 printers spew
out ASCII art around the world” -- theregister.co.uk
35
Do not connect printers to the Internet
https://www.theregister.co.uk/2017/02/06/hacker_160000_printers/
 Employees: always lock the copy room
 Administrators: sandbox printers in a
VLAN accessible only via print server
 Printer vendors: undo insecure design
decisions (PostScript, proprietary PJL)
 Browser vendors: block port 9100
36
Countermeasures
Christian Slater was right: Printers are insecure
• PostScript and PJL considered dangerous
• Exploitation through lots of channels
(websites, even ☺)
• No real countermeasures yet
37
Black Hat sound bytes
PRET („Printer Exploitation Toolkit“)
 https://github.com/RUB-NDS/PRET
Hacking Printers Wiki
 http://hacking-printers.net/
Questions?
38
Thanks for your attention...
https://github.com/RUB-NDS/PRET
http://hacking-printers.net/