Printers as vulnerabilityBack to blog
Poor security hygiene helps the bad guys in ways that you might not expect. Let’s talk about one of the secret techniques sometimes used by hackers to host malicious code and evade detection.
The secret is that thousands of unprotected printer hard drives are laying exposed on the Internet. That’s right, your office’s big HP printer probably has many gigs of internal storage space, and, if you don’t protect port 9100, you’re basically handing an anonymous FTP server to the hacker community.
There are a few free, open source pieces of software that can be used to upload and interact with HP printer hard drives over port 9100. After uploading to a printer, the file can be accessed by visiting http:///hp/device/ with any web browser.
This opens up a world of possibilities. A hacker can host malicious web pages and scripts on your printer and link it to potential victims. Maybe he needs to host an executable somewhere so it can later be served through a wget request. These printers are wonderful repositories. It doesn’t take much creativity to realize that even highly illegal materials could be stored this way.
After all, this kind of printer is usually powered up and online twenty-four hours a day. Even in sleep mode it will still host files. And who checks the contents of their printer’s hard drive? What are the odds of this hacker’s secret stash ever being discovered? Pretty low if you ask me.
Then you also have to consider that any organization leaving their printers exposed to the internet probably doesn’t have the greatest, if any, logging system in place. The chances of being caught are extremely low for the malicious actor.
Naturally, you may be wondering why I am highlighting this problem. Won’t it just help amateur hackers elevate their game? Disclosing vulnerabilities will always be a double-edged blade. Sure, some people will take advantage of the information, but it’s my sincere belief that anyone seeking tips on how to protect themselves should also be made aware.
So, if you’re concerned about security, put your printers are behind a firewall and, if it’s a Hewlett-Packard, make sure port 9100 isn’t open.
Attention - Portions of this article may be used for publication if properly referenced and credit is given to Kromtech Security Center.
Do you have security tips or suggestions? Contact: firstname.lastname@example.org