Researchers warn of severe risks from ‘Printjack’ printer attacks

guest · Nov 23, 2021

Researchers warn of severe risks from ‘Printjack’ printer attacks
November 23, 2021
https://www.bleepingcomputer.com/ne...-severe-risks-from-printjack-printer-attacks/

A team of Italian researchers has compiled a set of three attacks called 'Printjack,' warning users of the significant consequences of over-trusting their printer.

The attacks include recruiting the printers in DDoS swarms, imposing a paper DoS state, and performing privacy breaches.
Click to expand...

As the researchers point out, modern printers are still vulnerable to elementary flaws and lag behind other IoT and electronic devices that are starting to conform with cybersecurity and data privacy requirements.
By evaluating the attack potential and the risk levels, the researchers found non-compliance with GDPR requirements and the ISO/IEC 27005:2018 (framework for managing cyber-risks).
Finding exploitable printers
A paper titled 'You Overtrust Your Printer' by Giampaolo Bella and Pietro Biondi explains how Shodan was used to scan European countries for devices with a publicly accessible TCP port 9100, typically used for raw TCP/IP printing jobs.
Click to expand...

Taking part in DDoS attacks
The first type of Printjack attack is to recruit the printer in a DDoS swarm, and threat actors can do this by exploiting a known RCE vulnerability with a publicly available PoC.

The researchers use CVE-2014-3741 as an example but underline that at least a few dozen other vulnerabilities are available in the MITRE database.
Click to expand...

DoSing the printer itself
The second attack is a 'paper DoS attack' achieved by sending repeated print jobs until the victim runs out of paper from all trays.

This situation doesn't sound like a catastrophe, but it could still cause business disruption, so it's not about ink and paper cost but service downtime and incident response.
Click to expand...

Infringing owner’s privacy
In the most severe type of Printjack attacks, there's the potential to carry out "man in the middle" attacks and eavesdrop on the printed material.

Because no printing data is sent in encrypted form, if an attacker exploited a vulnerability on the printer's network, they could theoretically retrieve data in plaintext form.
Click to expand...

arXiv: You Overtrust Your Printer
(PDF): https://arxiv.org/pdf/2111.10645

Printers are common devices whose networked use is vastly unsecured, perhaps due to an enrooted assumption that their services are somewhat negligible and, as such, unworthy of protection. This article develops structured arguments and conducts technical experiments in support of a qualitative risk assessment exercise that ultimately undermines that assumption.

Three attacks that can be interpreted as post-exploitation activity are found and discussed, forming what we term the Printjack family of attacks to printers.
Moreover, a large number of printers, at least on an EU basis, are found to honour unauthenticated printing requests, thus raising the risk level of an attack that sees the crooks exhaust the printing facilities of an institution.
Click to expand...

Log in or Sign up

Researchers warn of severe risks from ‘Printjack’ printer attacks

guest Guest

Log in or Sign up

Researchers warn of severe risks from ‘Printjack’ printer attacks

guest Guest

Useful Searches