Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm unsure if this should be asked here or over on security.stackexchange.com...

Over the Easter long weekend, a small office of ours had a network breach in that an old HP printer was used to print some very offensive antisemitic documents. It appears to have happened to a number of universities in Western cultures all over the world.

Anyway... I read that it's actually a pretty basic security exploit with most networked printers. Something to do with TCP port 9100 and access to the internet. I haven't been able to find much info on the specifics of how because everyone seems too concerned with the why.

The network setup is pretty simple for the office that was affected. It has 4 PC's, 2 networked printers, an 8-port switch and a residential modem/router running an ADSL2+ connection (with static internet IP and a pretty vanilla configuration).
Is the point of weakness in the modem/router or the printer?

I've never really considered a printer as a security risk that needs to be configured, so in an effort to protect this office's network, I'd like to understand how the printers were exploited. How can I stop or block the exploit? And check or test for the exploit (or correct block of the exploit) in our other much larger offices?

share|improve this question
6  
3  
"sent print job to every visible printer in North America"? Sounds like he hates trees almost as much as he hates people. – Peter Cordes Mar 30 at 16:03
3  
"Use a firewall and don't expose ports to the internet unless you WANT them open" would be a good start. – Shadur Mar 31 at 5:59
up vote 41 down vote accepted

This attack disproportionately affected universities because, for historical reasons, many universities use public IPv4 addresses for most or all of their network, and for academic reasons have little or no ingress (or egress!) filtering. Thus, many individual devices on a university network can be reached directly from anywhere on the Internet.

In your specific case, a small office with an ADSL connection and home/SOHO router and static IP address, it's most likely that someone at the office explicitly forwarded TCP port 9100 from the Internet to the printer. (By default, because NAT is in use, incoming traffic has nowhere to go unless some provision is made to direct it somewhere.) To remediate this, you simply remove the port forwarding rule.

In larger offices with proper ingress firewalling, you generally won't have any allow rules for this port at the border, except perhaps for VPN connections if you need people to be able to print over your VPN.

To secure the printer/print server itself, use its built in allow list/access control list to specify the range(s) of IP addresses allowed to print to the printer, and deny all other IP addresses. (The linked document also contains other recommendations for securing your printers/print servers, which you should also evaluate.)

share|improve this answer
16  
@ReeceDodds It's just HP PCL, which practically every operating system has drivers for already included, and has for more than a decade. – Michael Hampton Mar 29 at 23:34
3  
netcat can work. – ewwhite Mar 29 at 23:38
4  
Or it might have been opened up on the router by UPnP. Something that is often enabled in many SOHO routers. Check that this is turned off on your router. – Matt Mar 29 at 23:40
4  
You were right about the port forward. So simple eh! Someone had opened it up and directed to the printer - I'd assume for a managed print solution providers monitoring maybe. They've recently installed FMAudit. The other port forwards existing in the router were set up by me a few years ago and are limited to the WAN IP of the office I reside in. i.imgur.com/DmS6Eqv.png I've contacted the provider for a static IP and will lock it down to only that WAN IP. – Reece Dodds Mar 30 at 0:24
6  
Turns out it wasn't forwarded for FMaudit. One of the staff has an RDP login to a remote server that required direct print via port 9100. I've set up an ACL in the printer and limited the WAN IP's that can use the port forward rule. He can still print and now they don't have to go on a man-hunt to find out which one of the four staff was a closet neo-nazi. – Reece Dodds Mar 30 at 2:22

To extend on Michael Hampton's answer. Yes it's likely a port forward rule. But usually that's not something someone would expose deliberately. However it can be added by UPnP devices. Most likely by having UPnP enabled on your residential grade router.

Universities probably have their printers hacked for other reasons as corporate grade routers usually don't support UPnP and if they did it'd be disabled by default. In those situations universities are big and have lots of public IP's and very complex networks and sometimes multiple IT departments with numerous sub-schools and campuses. And don't forget the student hackers who like to poke around.

But, back to my UPnP theory which could fit your case.

It's unlikely someone would deliberately open up port 9100 on your router to enable your printer to be open to the world. Not impossible, but somewhat unlikely.

Here is some info on the more likely culprit UPnP:

UPnP flaws expose tens of millions of networked devices to remote attacks, researchers say

This is how we had thousands of IP cameras hacked into despite being behind NAT routers.

More here: Exploiting Universal Plug-n-Play protocol, insecure security cameras & network printers These articles are a few years old, but are still relevant. UPnP is just plain broken and unlikely to be fixed. Disable it.

The last part of the first paragraph in the second article really sums it up:

Lastly, your network printer is just waiting to be hacked.

And lastly, follow Michael Hampton's advice and add an access control list if possible.

share|improve this answer
    
Does the JetDirect even support UPnP? – Michael Hampton Mar 30 at 0:17
    
I used to have one that had UPnP. UPnP isn't the only flaw though. Crazy! irongeek.com/i.php?page=security/networkprinterhacking – Matt Mar 30 at 0:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.