80,000 printers are exposing their IPP port online

mood · Jun 23, 2020

80,000 printers are exposing their IPP port online
June 23, 2020
https://www.zdnet.com/article/80000-printers-are-exposing-their-ipp-port-online/

For years, security researchers have warned that every device left exposed online without being protected by a firewall is an attack surface.

Hackers can deploy exploits to forcibly take control over the device, or they can just connect to the exposed port if no authentication is required.
However, despite this being common knowledge among cyber-security and IT experts, we still have a large number of devices that are left exposed online unsecured.
Click to expand...

IPP EXPOSURE
In a report published earlier this month, security researchers from the Shadowserver Foundation, a non-profit organization focused on improving cyber-security practices across the world, have published a warning about companies that are leaving printers exposed online.

More specifically, Shadowserver experts scanned all the four billion routable IPv4 addresses for printers that are exposing their IPP port.
Click to expand...

ISSUES WITH NOT SECURING THE IPP PORT
There are several major problems with leaving the IPP port fully exposed online without any additional protections, such as a firewall or authentication mechanism.

For starters, Shadowserver experts say this port can be used for intelligence gathering. This was possible because a large percentage of IPP-capable printers returned additional information about themselves, such as printer names, locations, models, firmware versions, organization names, and even WiFi network names.
Attackers can collect this information and then search through it for enterprise networks on which they'd want to focus future attacks.
Click to expand...

Shadowserver: Open IPP Report – Exposed Printer Devices on the Internet

Since July 2019, The Shadowserver Foundation has been participating in a EU CEF (Connecting Europe Facility) funded project called VARIoT. The main goal of the VARIoT (Vulnerability and Attack Repository for IoT) project is to create new services that provide actionable security-related information about the Internet of Things (IoT).

One of The Shadowserver Foundation’s roles in the project involves expanding our internet wide daily port scanning capability to enable the mapping of exposed IoT devices on the Internet.
We scan by sending an IPP Get-Printer-Attributes request to TCP port 631.
Click to expand...

Log in or Sign up

80,000 printers are exposing their IPP port online

mood Updates Team

Log in or Sign up

80,000 printers are exposing their IPP port online

mood Updates Team

Useful Searches