Another day in the security buiss

Hey, was up guys/gals?

Haven't posted in quite a while;however, I thought i would throw this out.
While doing a security audit for a large car dealership i found some interesting stuff. Their webserver was being DOS'ed from an internal ip address. Upon reviewing the logs it pointed to a printer. An Hp laserjet to be exact. Now I was rather excited because i had heard/read about printer hacking but never really had a chance to dive deep into the exploration of it. ( What better way to learn is there then to get paid for it :) ) Being that as it may be, We changed the ip addy of our websever back to its original with the printer on, and well it was hit by massive amounts of traffic by this printer. We turned the printer off and well, guess what, the traffic stopped. We turned it back on and yep it started again. I started reading up and performing tests of various kinds and i came up with this. Each of the hp printers has like 4megs of Ram but everyone knows that once off all memory is erased or what not, however these printers also had flash memory. which in this case had small piece of DOS software. Rather brilliant actually. I said wtf? And went to the HP website and found everything i ever really wanted to know about pcl, hp's printer language. I thought this was an awsome hack and thought id share it with you all.

Sounds rather interesting..

Were you able to determine how the DoS code got placed into the flash memory in the first place?

Is it possible it could have been done remotely?, Normal printer bios flash is via a connection to PC is it not? I seem to remember doing one over the network once.

That does sound very interesting. it sounds like the code had been writen custom for the job?

Is there anything else that you can post on this. I've never heard of anyone writing a DoS app and placing it on a printer. If you have any more specifics or end up discovering anymore, please post them. Thanks.
-NeuTron

http://www.syngress.com/samplechapters/249_chap4.pdf
I found this link a few min ago, gives you an idea of what can be done remotley with a printer. I dont know if this if actually a real example or not, but it does describe pretty much to a T a hackers exploit of a printer. Very interesting reading.
Same b
asic idea that was used on the car dealerships printers.

I agree I could not stop reading and I learned alot from it thanks for sharing it :D

the printer flash memory can be flashed from a remote location. HP provides the software to do it for patches and upgrades to their printer software. So I guess if this can be done by HP then it should be ab le to be done by anyone else if you ahve the right info and skilss.

Wow that is interesting. New information for me also. Thanks for the info.

PeacE
-BoB

Thats a great link, and well worth the read.

Wait until all of our home appliances are connected to the net.

my fr1dg3 0wnz j00!!

:)

I can only imagine the pandimonium that would occur. LOL.
"Hunny what happened to the coffee maker?"
"Nothing just another hacker got into it." LOL

PeacE
-BoB

Wow, I have seen quite a few odd things, but I have never seen or heard of a printer DoS'ing a computer. That is quite interesting. Now everyone has to start putting permissions on printers that deny connections, not only print jobs now; before it was sufficient to just limit printing to local subnets, now it looks like we will have to have dedicated boxes for printers after all, just set iptables to drop all packets that don't come from LAN IP's.

Interesting, this coincides with a conversation I had just this week with a friend who is using a printer as a honeypot.


I have always locked down my printers because they ALL have web servers and since it's a web server I have always thought... hmmm. And even the older ones you could telnet to. This is one of the most interesting articles I have read in a long time. :)

Yep, and to take this a step farther (I love doing that :)), you can actually ftp to HP print servers and upload *tons* of garbage to the print server rendering it useless. Today you find HP jet direct print servers with a Webserver, FTP service and Telnet service. All are wide open out of the box and the great thing about HP is they give you the Jet Admin software, which, you guessed it, out of the box is wide open. This means that you can down printing services enterprise-wide in minutes if you don't take the necessary steps to lock down a print server.

One more side note: When I started at my current position, I found print servers (i.e. Jet Direct Print Servers) used as mini WAREZ servers. They have enough space to house toolz and other nasty business.

Keep your eyes on other internal hardware in the months to come. You'll see an increase in attacks on devices that admins typically don't think about.

I find it amazing and interesting that an entire network was compromised by a single model set of HP printers. Sure there were other issues, but the system was compromised based on accessing a printer and then re-compromised later by the same doorway.