Samsung printers have secret admin account
Patch primed to prevent printer p0wnage
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Some Samsung printers, including models the Korean company made for Dell, have a backdoor administrator account coded into their firmware, says US CERT.
The brief vulnerability notice does not mention which models have the account, but does say “The vendor has stated that models released after October 31, 2012 are not affected by this vulnerability.” Which will be welcome relief for those who acquired a printer in the last month.
US CERT says that someone who gains access to the administrator account could “ … access an affected device with administrative privileges” and that “Secondary impacts include: the ability to make changes to the device configuration, access to sensitive information (e.g., device and network information, credentials, and information passed to the printer), and the ability to leverage further attacks through arbitrary code execution.”
US CERT advises Samsung “... has also indicated that they will be releasing a patch tool later this year to address this vulnerability in affected devices.”
The Register has asked Samsung representatives to confirm the existence of the back door and to explain which devices will need the patch. ®
COMMENTS
Experimental downvote
Is it possible to expunge someone's gold badge?
Careful Now. Down with that Sort of Thing!
“The vendor has stated that models released after October 31, 2012 are not affected by this vulnerability.” Which will be welcome relief for those who acquired a printer in the last month.
Except the chances are that that device has been sat in a warehouse/shipping container/factory for a while and may still be vulnerable. I'm not sure if Samsung printers have a 'built on' date printed on them, but id be worried on any new Samsung printers for at least the next year.
I wonder how happy people would be if their car manufacturer did something similar. Not very I suspect. With all these smart TVs and devices being able to do more it's a serious concern.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
