Exploiting corporate printers 2023

In this article we will discuss about Exploiting corporate printers.

Information about Exploiting corporate printers:

Printer abuse and printer vulnerabilities are serious problems similar to those faced by computers and other devices with hard drives because they are connected to the network like other devices. Nowadays, most corporate offices or organizations have a large number of printers in their buildings that print sensitive information that can be hacked and exploited. In earlier times, printers only had the function of printing the required data. As technology evolved, new printers with built-in memory and various security features were used.

The abuse or vulnerability of printers results in an increase in corporate espionage and the collection of highly sensitive information. The latest survey shows that more than two-thirds of leading companies are using 3D printing applications.

Technological progress has led to a great improvement in printers, which has many advantages, but also various downsides. Corporate organizations use printers ranging from various offset or digital printers to 3D printers. These printers installed on corporate networks have no security by default. The worst case scenario is that most MFPs provide full management access until the network administrator reconfigures the network once in a while. This results in serious data compromise and misuse, creating a platform for attacks on all network-connected systems. Therefore, unsecured MFPs create a threat that can be exploited by spies or hackers.

Multifunction printers

An MFP is a device that can provide multi-device functionality. It is used in the home for small dimensions, in a small business environment or in a large corporate company. A typical MFP is a mix of different devices such as fax, e-mail, copier, scanner and printer.

MFPs are divided into two types: inkjet and laser. Inkjet printers are exceptional at producing high-quality color graphics, while laser printers excel at printing large volumes of documents. Multifunction devices are also divided into different segments. There are four types depending on the features offered: (i) All-in-one for small office; (ii) SOHO MFP for a large desktop computer in a small office; (iii) office multi-functional equipment for the central office system; (iv) production, which is the equipment of the printing MFP-reprographics department.

Also Read:Everything you need to know about Ethical Hacking as a Career by Blackhat Pakistan 2023

Multi-functional devices include many features such as SDK, advanced LCD panels with optical mouse and keyboard connection, wireless data transfer option, IPv6 support, storage capacity (HDD), active directory, SNMP support, editing options, completion options, send and receive options of faxes, forwarding to email (via SMTP), color fax option, DPI resolution, direct printing of labels on CD/DVD, automatic document feeder (ADF), security of scanned documents, cordless phone, TCP/IP fax methods, answering machine and many others.

Interior architecture

Hardware: RAM, processor, digital copier, storage memory – Flash memory or hard disk.

Software: Runs on a set of platforms such as PC operating system: Linux, VxWorks, Windows (embedded NT 4.0 and embedded XP). MFP devices provide various functions along with firmware. These software manage functions such as network service clients and servers, user input using the MFP control panel, image processing and conversion, remote management functions using a web server, raster image processing functions, internal hosting of third-party applications using Bytecode interpreters or virtual machines. , device configuration and management, document display and management, input mode selection, resource monitoring, etc.

Connecting printers to a network

Normal connection:

Using printers with built-in network capabilities:
As you know, printers are very easy to install. The connection provided will be either wired or wireless. The setup process is different for each network printer. Network printers can be accessed using either a DHCP (Dynamic Host Configuration Protocol) server or static network addressing. Static addressing is mainly used in small offices, while dynamic addresses automatically address each network in large corporate offices. After connecting from workstations, a direct connection can be established. For example: In Windows OS, select Control Panel>Devices and Printers>Add Printer, then the wizard will start searching for printers.

Some network infrastructure printers are:

Inkjet printers: Epson B-510DN, HP OfficeJet Pro 8000 Wireless, etc.

Laser: Dell 5130cdn, HP CP4025dn, etc.

Connect the printer to a dedicated print server or network endpoint:
These processes include printers that do not have network connectivity. Non-network printers can be accessed through the USB ports on the server, as well as through a parallel port that is connected to the network on a different port. Server settings depend on the features included by the manufacturer and the complexity of the device. The advantage of this type of printer is that, after setup, the workstation appears similar to network printers. Some of these printers are low-cost and high-end types, depending on their functional status:

Low-end: Netgear WGPPS606, Dlink DPR-1260, etc.

High-end: HP JetDirect EW2500, EdiMax PS-3103P, etc.

Connect to a computer workstation and share with other users:

Another way to connect printers to a computer workstation is to connect to a computer sharing network. Its advantage is that it is easily accessible from existing equipment and its disadvantage is that even if the main workstation is down, others will have connectivity to the printers, which can be considered a vulnerability in some cases.

How do attacks occur in printers?

Printers are more vulnerable to attack these days as most companies place emphasis on securing computers in their offices. However, the truth is that most of the highly sensitive data stored in PCs when printing is stored in printers that can be used from internal sources to reproduce prints. Attacks can be carried out in a variety of ways. Some of them are listed below:

Skipped authentication processes:

Many MFPs in enterprise settings have authentication mechanisms to control which users will access the device. Each company can thus keep records of employees using the printer. To unlock the MFP, they must log in with their credentials to use it, i.e. RFID key, fingerprint, swipe card, LDAP (Light Directory Accessories Protocol). However, most of them can be bypassed by the MFP’s network access, allowing hackers to bypass security and print information.

Work assigned to system users

A hacker can exploit a printer vulnerability and modify the data predefined in the printer. The permissions assigned to different users may vary. Once omitted, this information can be modified depending on the hacker’s requirements.

Personal device with OS

The combination of mobile apps, cloud printing technology and the continued penetration of OS-based personal devices in companies makes it easy for any attacker. An attacker could develop malware for such a device, which he could use to gain access to network-connected printers. Once access is gained, the entire network can be easily bypassed.

SQL injection

This is a type of attack where an attacker installs SQL functionality into the spyware firmware. Continued use of many web functions or applications can lead to a phishing attack, through which the attacker deploys malware at the desired location. The threat level of a printer is the same as that of a PC. Any person can physically or electronically access the MFP if it is not securely controlled or protected, resulting in information leakage from the MFP stack or malicious access to print data from the network.

Denial of Service

The amount of data to print varies according to the user’s requirement. Since they are all processed through the networks in the MNC, an attacker could destroy the device by increasing the traffic on such networks. A large number of requests from the intruder can be a bit difficult to handle. The printer could malfunction.

Putting the device into operation

Most enterprise MFPs handle large amounts of information and integrate disk drives. Access by unauthorized persons provides sensitive information that is revealed by scanning. Eg: The NYPD sold its multifunction devices and revealed details of an ongoing investigation in 2010.

Network monitoring device

The chip can be replaced on the printer circuit board and also by modifying the firmware. It can be plugged into the network port of multifunction devices, which can be used to store or transmit data packet information.

HTTP attack

These management services have highly documented security issues. Cross-site scripting tricks the user into connecting to the printer’s web server, but is actually communicating with the attacker.

PJL attack

The print job language sends printer status information to the programming application. Manages the file system along with printer settings. It can be easily hacked by brute force attack. There are also many hacking tools available to grant full system access by changing settings.

FTP bounce attack

Anonymous FTP servers are used to store print jobs on the MFP. Passive FTP mode provides passive FTP forwarding, making it vulnerable. This helps us to use it as a proxy server that allows the attacker’s IP address to be hidden, making it untraceable and redirects without revealing network attacks.

SNMP attack

Most MFPs have backdoor administrator access. Attackers can access the default password using simple network management protocol (SNMP) because it is stored in an SNMP variable, from which anyone can access if they know the location of the variable or the address of the MFP. Network structure can be obtained by simply sniffing SNMP traffic.

Some of the threats that hackers pose when they misuse printers are:

• Captured unencrypted information and stored data.
• Spam and disabling services.
• Investigate passwords and manage networked devices.
• Data or information may be altered or corrupted.
• Vulnerable printers.
• It can retrieve previously printed data and information.
• Print information when a job is queued; then the information is vulnerable and unencrypted, leading to espionage and theft.
• Remaining residual data can also pose a risk.
• A hacked printer can also create a path to infect computers on the network.
• The MFP blocks firmware updates to ensure the infection is not removed.
• APT (advanced persistent threats).
• JavaScript can be inspected and intercepted by hackers.
• Editing parameters by inserting an unexpected character can even cause printers to shut down, leading to a manual reset.
• Hackers can use touch screen technology in printers simply by changing FTP settings.

Safety and security measures

Printer configuration varies by model and manufacturer, but the security steps are pretty much the same for all of them. There are many steps that can be taken to strengthen the security of multifunction devices. These could be divided mainly into three:

• Secure remote MFP management
• Secure printer network interfaces
• Secure access and data

Steps to secure your printer:

• Configure by default deny policy and secure password reset.
• Protect your network with effective firewall hardware.
• Allow communication only with secure or trusted networks and hosts.
• Periodically update printer firmware by administrator.
• Available tools such as digital governance tools should be used to secure sensitive data and information from loss or theft.
• Inclusion of MFP in standard policies and regulations.
• Unused protocols (eg AppleTalk) or services (eg telnet, web, ftp and SNMP) should be disabled. Also use secure printing options if available.
• The use of an access control list (ACL) in the product can limit the use of the MFP to a predefined set of clients.
• Changing the password of a network printer and transmitting it as plain text over the network.
• MFP access control as well as level of operation for individuals, groups, activities, etc.
• MFP with direct software integrated device working with whitelisting method. This means enabling approved files and built-in system protection to ensure time tracking with the origin of the attack.
• Allow all enabled remote access services to generate strong passwords.
• Enable SSL status for network management in case of https for encrypted network data transfer.
• Configure syslog that supports remote logging by connecting to a network security server or department monitoring server.
• Changing the default community string.
• Allow sending logs with true authentication.
• Using remote control services such as FTP.
• Use only the corporate network address so that the MFP is not accessible to the Internet or the Web.
• Audit logging integrates real-time monitoring with an intrusion detection system and captures potential risks.
• Vendors only use digitally signed firmware.
• SNMPv3 for data encryption components with extensive security features for remote management.
• Mutual separation of fax/network.
• Using the NTP protocol for clock synchronization.
• TCP connections and port filtering.
• Control network traffic using encryption and authentication.
• TLS for LDAP security and security templates.
• Automatic insertion of e-mail addresses causing the eradication of anonymous e-mails.

• Confidential Print will help remove print jobs from RAM after a set time.
• Hard disk encryption with AES key and physical lock support.
• Both automatic disk wipe and idle disk wipe should be configured.
• A permanent memory wipe helps clean up forms of flash memory.
• Check the security of data transfer across the workflow.

Normal steps for hacking network printers

MFPs can be hacked by focusing on the security issues of most brands. The most commonly used protocols are Appstock/RAW, PCL, PJL, PS, IPX, etc. For most printers, when we search for the address (not technical) http://your-printers-ip:9100, it does not lead to any location, but it will read the print job. Makes a request for the root document using https. This exposes the LCD display through which the attacker enters. This proves that you don’t need any tools or code to access. For telnet access: telnet 192.169.1.2 9100. NetCat access: e.g. echo @PJL RDYMSG DISP=’Text’ netcat –q 0 192.168.1.2 9100.

The next step is to get the password as both telnet and device password are similar for both software and web interface. All passwords entered are registered in the registry when you use it, so sniffing and brute-force attack tools help to retrieve the password from the printer registry. The SNMP vulnerability also allows the password to be obtained by simply hitting the community name on the network.

Many printers on the network could be found using Nmap and SNMP tools along with UDP scanning. Printers can also be obtained from the Internet, as most administrators store data on the intranet, eg inurl:brand/device/this.LCDispatcher. Spam can be used to iterate data using access to the tool in Windows and Linux. Network printers are easily exploited to gain unauthorized access to data and Wi-Fi pin settings.

Conclusion

The subject of network printer security is really a growing concern in corporate offices or organizations. MFPs may have many vulnerabilities, threats or risks, but only a few safeguards. An effective method is to provide an assessment or analysis of critical threats of individual corporate organizations and their solutions according to the occurring risk. Therefore, it is necessary to consider the security of the printer as well as the security of the PC, since both contain a large amount of sensitive data and information.

Sources

• Security flaws leave networked printers open to attack
• Network printers an overlooked security threat
• Hidden IT security threat multifunction printers
• Chicago
• Hacking HP printers vulnerability wifi password
• Tens of millions of hp laserjet printers vulnerable to hacking
• Exploit cloud literally allow hackers to set HP printers
• Vulnerabilities and threats 

All About Carding, Spamming , And Blackhat hacking contact now on telegram : @blackhatpakistan_Admin

Blackhat Pakistan:

Subscribe to our Youtube Channel Blackhat Pakistan. check our latest spamming course 2023 Learn from BLACKHATPAKISTAN and get master