Feeds

Multifunction printer p0wnage just getting worse, researcher finds

Konica Minolta, Sharp, Dell, Canon and HP printers spew credentials when probed

Security for virtualized datacentres

It is now easier than ever to hack corporate networks through multifunction printers, which can even offer up access to Active Directory accounts according to security consultant Deral Heiland.

The moustachioed Rapid 7 tech veteran said his team now gains access to corporate active directory credentials through credentials stored in the latest printers in one in every two attempts. Four years ago they had only a 10 to 15 percent success rate.

High end Konica Minolta, Sharp, Dell, Canon and HP enterprise multi function printers spewed usernames, email addresses and passwords from address books, even after some vendors released fixes. They coughed up Active Directory usernames and application data and offered hostname information.

"We're able to gain access to Active Directory environments by extracting useable credential data from multi-function printers 40 to 50 percent of the time," Heiland (@percent_x) said.

"So I walk into a company (with about 1000 staff) and they have some fairly current business/enterprise printers and 40 to 50 percent of the time we're able to get Active Directory credentials off those printers to gain elevated access

"A lot of people don't realise these high end printers can store passwords in the address books."

The Canon hack worked because encryption of passwords in the POST request could be turned off, enabling an attacker, in Heiland's words, to just "ask nicely" for the passwords.


Deral Heiland

Deral Heiland


Data extractable from the printers included usage tracking, scanned-in files and emails, and LDAP credentials.

He said an LDAP pass-back attack worked on almost all enterprise printers since most allowed remote LDAP lookups which would send attackers plain-text passwords.

During one enterprise security test Heiland said he was able to access the payroll database for its 4000 staff through a human resources printer that was not isolated.

Development of a Metasploit module designed to making popping printers even easier is a boon for penetration testers, who, Heiland said, often overlook printers as an attack vector. The module would be built on Heiland's Praeda automated harvesting tool.

The Metasploit tool would allow users to contribute their own printer pwning modules to build out this penetration testing tool.

Heiland recommends enterprises turn off automatic firmware upgrades on printers, and change default passwords. The boxes should also be isolated by departments and be cut off from internet access.

This finding is the latest from his research into breaking multifunction printers, begun in 2010. ®

Secure remote control for conventional and virtual desktops

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.