HP Jetdirect security

Hi all,

I have an HP JetDirect 300x print server. I use it on my home lan just to keep it easy for people to print.

I was playing around with it a bit and found out that it has a ftp server on it.
I'm not quite sure of the size of the memory... but anywho.

I have setup a password on this, but it is still accessable to ppl who try to get to it.
(they can't copy/store files or make changes to the config)

With the username and password, I have stored/retrieved files from it.
I'm keeping them small becuase I don't know the memory size.

The services running on it (which I can't seem to disable... only password protect)

Quote:

---

Port State Service
21/tcp open ftp
80/tcp open http
280/tcp open http-mgmt
515/tcp open printer
631/tcp open ipp
9100/tcp open jetdirect

---

Is there anything anyone can do with a JetDirect that I should be worried about?

JetDirects have an HTTP interface so they can be managed via web browser. You will want to secure that, as well. Also, turn off the SNMP service, or secure it. Any JetDirects connected to the net should have these services secured.

Check with HP for the updated firmware for this model JetDirect, as well.

Here's an article that you might find interesting phishphreek80 , it comes right from HP's website. The article is called ::
HP Jetdirect Print Servers - Making HP Jetdirect Print Servers Secure on a Network
here's the link :: http://www.hp.com/cposupport/network.../bpj05999.html

I found that an effective way of protecting small devices such as this, is to omit the default route when configuring them.

Then they cannot talk to any boxes outside the lan.

Slarty

rapier57: Thanks for the suggestion. I normally only think to check for firmware upgrades when there is a problem/bug. I'll have to remember to check for firmware for all small devices like that.

Agent_Steal: Thanks for the article. I'll have to read it over my morning coffee. I somehow missed it in my searching.

slarty: thanks for the suggestion. I will do that, as there is NO reason that the print server will need to access the net. Unless using ftp for to DL the firmware, or whatever the procedure is fot that. I'll make sure to reconfig it w/o the gateway.

I was actually thinking more on the evil side of things when I wrote this original thread.

What if:

Someone was to gain access to the print server, then store a malicious script in the FTP. Be it vbs or .bat, a virus even... whatever. Then at a later time, have another script download the malicious script from the ftp server and boom! Kind of like a poor mans logic bomb? It could even be incorporated into the logon scripts, but to run at a certain time/date... Guess it could be from any ftp or website... but if it was on the local lan, it'd be much faster. Don't know how fast those print servers ftp service really is though.

I don't think anyone will get access to it to start with... it was just an idea.
I'm alway parinoid I guess.

Is your network separated by a hardware firewall? When it comes in is it then connected by a router? Is your Printer connected to a System used as a Printer Server? What OS/SOFTWARE is used as the print server?

I have a similar setup in my house and I shut down some of the customized configuration and left it wide open. Watching the traffic comming in the two main sources hit were my router and my print server. So maybe you are on the right track being paranoid of someone attacking your printer.

There is a cisco 806 broadband router that I use as my firewall at the perimiter.

I use NAT so I only need one public IP. So, everything is behind the firewall.

Each client has a software firewall/AV too... except for the print server.

The print server is a HP JetDirect 300x.

I'm not too too worried about it now, cause Agent_Steal had a great recource. I can kill almost every service running that I don't need. FTP, HTTP, SNMP, eveything...

I'm always thinking about stupid things like that. I know I don't want an FTP server running on my LAN... even if it can't get out to the net.

I use samba for my filesharing needs... easy to setup and secure and very very fast.

Though... I did have a pretty interesting idea for a poor mans logic bomb... I might have to setup a couple test boxes and mess around with that a bit more...

Yeah the hp jetdirects can be used to store files on, size depending on the type of printer. Do a search for a hijetter or pft.

The suggestions to not put in a default route/gateway is a good one, unless you plan on printing to that printer from a different subnet/network.

Here phishphreek80 do a search on this sites for HP JetDirect Print Server ...
http://www.iis.net
http://www.cert.org
http://www.securityfocus.com
http://www.atstake.com
you might be able to find something on here ... Hope that helps

ooops it's
http://www.iss.net ,,,, not iis sorry about that typo ...

To disable FTP through telnet, type the following command sequence:
1. ftp-config: 0.
2. Press Quit.

i read an article where a guy was gettin ddos attack on one of his servers at a car dealership...he spend days tryin to figure out what it was because the IP was a printer and he never heard that a printer can launch DDoS attacks. He looked for a computer spoofin the IP and so on...he later figured out that the printer had a FTP service running on it (not sayin it was ur HP DirectJet) but someone had uploaded a DDoS program to the printer and thats what was goin on. So yeh a FTP service on a printer can pose as a risk, mainly just DDoS and boggin the printer down with data. We have a printer here with a FTP service and i just password protected it, i'm not sure if i turned it off or not (cant remember) but password protecting it to no one can access/upload to it should do ya just fine.

How can a file server execute a ddos program???

i guess the printer could ping a server to death? i dunno...its just an article i read. Only one way to find out...someone try it.

I mean unless your able to upload out of the bound (ie ../../) and put the file in a location where it get executed or you can overwirte a certain program.

But in the case of simple file sharing configured correctly theres no way an uploaded file could execute a dos is there?

there is though a vulnerabilty that can kill the printer to where u have to restart it.
I'm havin no luck finding the article of where the guy had that DDoS problem with the FTP Service on his printer. Heres the link to the vulnerability though.
http://www.securiteam.com/securitynews/5DP0C2K20O.html

Well blow me down... :o

I didn't know my JetDirect printers had an FTP service running... Nor does that article on securing them mention one :(

I had implemented the Admin password for the HTTP interface and Telnet interfaces but had no idea it also had a FTP interface... Thanks deftones12 for the telnet disable command, before running this it was allowing anyone to ftp into my printer (internal to Lan only). Now its nice and secure.

Glad this was brought up...

RRP

bpiedlow: It was in the article that Agent_Steal posted.
http://www.hp.com/cposupport/network...99.html#N1016A

Quote:

---

Use any of the following commands in Telnet to disable protocols or services:

To disable the Internet Printing Protocol, type ipp-config: 0

To disable the File Transfer Protocol, type ftp-config: 0

To disable HP Jetdirect?s Embedded Web server, type ews-config: 0

To disable the Service Location Protocol, type tl-slp: -1

To disable SNMP, type snmp-config: 0

When finished, type quit and press Enter to exit and save the configuration.

---

I read right over it the first time, but then caught it went to disable everything.

deftones: thanks for the advise and for posting the vulnerability.
Somehow I do remember reading about that ddos or something funky with the printer... I don't quite remember where though... the hacker challenges maybe?
Maybe thats what made me thought of posting this thread? dunno... the subconcience does weird things. I'm looking back over that hacker's challenge book and I don't see it in there... but I DO remember it... this is gonna bug me.

D'oh - didn't even notice it there, even when going through and securing it...

I guess I own agent_steel a thanks also - :D - thanks

In either case - glad to find out about this and to lock it down...

Now I just have one question, if I were going to enable FTP - say to allow my UNIX system to directly put files to it for printing, how does one go about adding username/password security to its FTP interface, or can you???

RRP

bpiedlow: my understanding is the password you set to protect itelnet t is the password you use for ftp too. At least with my 300x. It didn't require a username though. just leave that blank and then enter the password.

I'm looking over and it doesn't look like you can setup separate usernames and passwords...

In fact:

Quote:

---

HP Jetdirect Printer FTP Service Lets Any Remote User Print

Description: A security issue was reported in HP Jetdirect printers. Any remote user can print by sending files to the printer's FTP server.

HP reports that a remote user can send files to the printer via FTP. Any file sent to the Jetdirect FTP service will be printed.

HP also notes that because the FTP service provides writable directories to allow this function, some security vulnerability scanners will identify the Jetdirect printers as containing a vulnerable FTP server configuration.

Impact: Any remote user can print on the printer.

Solution: The vendor reports that users that want to restrict printing can disable the FTP service by telnetting to the Jetdirect device and typing the following:

ftp-config: 0

This change will not permit you to upgrade firmware via FTP, according to HP. You can update firmware using the HP Download Manager or Web Jetadmin applications.

---

Source

agent_steal....thats a very good link. At least HP has some official info on securing their devices. Although most of the info most network admins should know. its better when you have something from the vendor of the product.

i'll be lookin tonight for the article where i read about the DDoS and about loading malicious stuff onto printer FTP services. I'll post a page or link if i find any info. Are u gonna play with the FTP at all and see if its possible? that'd be a cool deal to do and have fun with...lil testing. Keep me updated.