« Cross-Site Printing » or how to attack printers from the Internet?
Date : February 28, 2008
This new attack called “Cross-Site Printing” is based on the well-established techniques used to carry out “Cross-Site Scripting” attacks.
However,
this threat is still limited because the attacker needs to know exactly the IP
address of an internal printer and moreover, the targeted printer’s behaviour
is quite unpredictable in relation to the attack code which is sent.
Analysis:
“Cross-Site
Printing” technique is based on the fact that an internal printer keeps open
the TCP port 9100. This port is associated to a printing service called
“JetDirect”, “Raw” or “AppSocket”. In most cases it is part of the standard
open ports on a network printer: 515/TCP – LPD – and 631/TCP – IPP.
The 9100
TCP port can be used to send printing jobs to the publishing equipment without
a preliminary authentication. Thereby a simple telnet connection on this port
allows printing the characters which are entered in the current session. The
actual impression is done at the end of the session.
This kind
of behaviour can also be reproduced from a Web browser by connecting to the
port 9100 of a network printer using HTTP (http://printer_ip_address:9100).
After that,
it becomes fully possible to reproduce this action using a Web page. In order
to accomplish such an action which is blind to the victim, the attacker can
insert an HTML image tag (<IMG>) containing an HTTP connection as
mentioned above in his Web page. As a consequence, when the victim visits a
malicious Web page located on a Web server or included in an HTML e-mail, a
connection is made on the port 9100 to the IP address hard-coded (in)on the
attacker’s page.
It can be
interesting to notice that, even at this level, the attacker absolutely needs
to know the IP address of the targeted equipment to carry out a suitable
attack.
At this
point, the attacker can only print text characters on the targeted publishing
equipment. Nevertheless, an attacker who uses the PCL language (“Printer
Control Language” [2] and [3]) in his attack code will be able to print
standard-looking pages. Nowadays, there are some tools allowing someone to
convert office or HTML documents to PCL commands ready to be submitted to a
printer.
In the PCL
language, there are also interesting commands which allow sending Fax. The use
of such commands in attack codes could be quite problematic if the targeted
equipment is an “All in one” printer (printer, copying machine, Fax). Then, it
is theoretically possible for a victim to be attacked by sending a Fax when
visiting the malicious Web page. However, the implementation of the PCL
commands related with Fax handling strongly depends on the type and model of
the targeted printer. This last thing has the consequence to limit the effects
of a massive attack.
The study on “Cross-Site Printing” also shows that other PCL commands could allow someone to include a header (banners) to each printed page.
Thus, these
techniques could be used by ill-intentioned persons to carry out spam
activities in a paper version.
Nevertheless,
these kind of attacks can only be used in a targeted way and requires a very
good knowledge of the victim’s environment.
However,
these techniques are still interesting because they complete the set of known
attacks which target networked printers and can be associated with “Cross-Site
Request Forgery” (XSRF [4]) attacks, which are usually possible on the
administrative Web interfaces of publishing equipments.
Some advice:
In order to
avoid these kinds of malicious actions, it is advisable to:
- Close
the TCP port 9100 on the printer where it seems to be unnecessary
-
Filter
access to printing services exported by printers : for example, allowing only
printing servers to access printers can be a good idea
- Update
printer’s firmwares in order to install last security patches.
To be protected against “Cross-Site Forgery”
attack, it is also advisable to:
- Filter
access to each printer’s administration service
-
Set
complex passwords on administration interfaces
-
Don’t
use desktop computers having access to the Internet (Web and e-mail) to manage
publishing equipment (use dedicated computers instead).
For more information:
[1]
– The study on "Cross-Site Printing" : http://aaron.weaver2.googlepages.com/CrossSitePrinting.pdf
[2] - HP PCL Printer Control Language : http://www.piclist.com/techref/language/pcls.htm
[3]
- PCL 5 Printer Language Technical Reference Manual : http://h20000.www2.hp.com/bc/docs/support/SupportManual/bpl13210/bpl13210.pdf
[4] - "Cross-Site Request Forgery" : http://en.wikipedia.org/wiki/Cross-site_request_forgery
