3

I just read the MS16-087 security bulletin and the articles by Vectra (who apparently discovered the vulnerability). As I understand it, MS Point and Print offered a delivery of print drivers from a printer or print server without UAC query to user.

I am concerned about a colleague using a Windows 7 Professional computer without the patch, but don't want to update that system unless absolutely required because it is running a critical business application that I don't want destabilized by Microsoft shenanigans (e.g., Win 10 forced updates).

It is a single workstation with directly attached printer (USB cable). They use Internet for business only, e.g., email, business related websites.

They are running Kaspersky AV and firewall.

If I warn them to be especially cautious about not visiting websites without business validation and even then to be cautious about printing from a web page, would they be unlikely to be hit?

It seems to me you would need to go to an Internet watering hole attack vector and agree to print or accept a printer driver to be hit with malware related to this vector. The internal network is only accessible to a DSL router with firewall.

  • Could you edit and add a link to the bulletin you are referencing? Thank you! – Anders Jul 13 '16 at 19:09
  • If you're concerned about the vulnerability why not simply install the patch off-hours and revert if things break? There are also at least two well documented ways of preventing the Windows 10 update so not updating a computer because of that is not really a valid excuse imo. – DKNUCKLES Jul 13 '16 at 19:42
  • Added that link, Anders (though was posted below later). DKNUCKLES I'm trying to avoid a lot of time, which I don't have (yes, if they are compromised it will be work, but it still looks low risk). MS is too tricky for me to be testing their current response to recent efforts to avoid their push. – Dalton Bentley Jul 13 '16 at 22:04
1

IMHO, the risk can be maintained reasonably low, because the attack vector needs that the user connects to an infected printer server or installs an infected driver on his machine.

That means that provided that the user is an educated one of has no administrative priviledge, either he will not even try to install a new printer on its machine, or will not be able to.

It can only be seen as a workaround and documented because if the machine should be reused later it would be critical to pass the patch. But it can be helpful if for any reason it is not possible to path a specific machine.

  • That was my conclusion also (low risk since user must connect to infected printer or agree to install payload laden print driver), but I was dismayed to discover months later that they had actually installed an Internet communicating printer (I ended up having to talk to the print service company about their remote software and am reasonably comfortable about it). If you work with small business clients you will know there are no educated users (i.e., capable of identifying a clever exploit) and they all have admin privilege, grin. – Dalton Bentley Jan 11 '17 at 17:51
0

See Microsoft's MS16-087 Security Bulletin for detailed information regarding alternative mitigation strategies.

CVE-2016-3238 requires a successful MitM attack where malicious print drivers are sent back to the client. Under Mitigating Factors it states that using Point and Print Restriction Policies may help.

CVE-2016-3239 requires the attacker to "log on to an affected system and run a specially crafted script or application." No mitigation here except to not allow an attacker to login.

The update is targeted at networks with a print server. Since the printer is attached via USB, perhaps it is the print server. If this is true, prevent it from contacting other print servers (even possible rogue print servers) and that should mitigate this vulnerability for that system. You could also implement IPsec to ensure MitM cannot occur if clients are using the printer over the network.

The best option is to back up the system and install the security update. It is impossible to suggest one can be "cautious" on the internet and not get hit with a vulnerability. There are too many variables (minimal privileges, OS version, browser version, plugins, browser configuration, DNS, etc.). It also prevents you from doing these one-off configurations which can become unmanageable over time.

Besides, if an attacker is able to carry out this attack they now have access to a business critical system. Backup, install update, test. Rollback if absolutely necessary.

  • The folks at Vectra describe a couple of different attack vectors at link, one involving Internet Printing Protocol, something I'm not really familiar with. If I was in active practice (IT) I would agree with you on the backup, update, test and rollback if necessary--and if you could get a decent drive image backup that didn't invade the system with junk I don't want. MS (and others) play so many games with marketing strategy any change is an unpleasant surprise. – Dalton Bentley Jul 13 '16 at 21:59
  • @DaltonBentley, the time you're spending researching this vulnerability would be better spent ensuring this business critical system is properly backed up. – user2320464 Jul 14 '16 at 0:47
  • You(user2320464) are undoubtedly correct, i.e., that disaster recovery and business continuity demands an efficient and comprehensive backup and recovery strategy. However, if you have ever dealt with actual small businesses, you know that is not a real world possibility most of the time. Folks are inevitably penny wise and pound foolish. – Dalton Bentley Jul 14 '16 at 16:52
  • All right. I just emailed the office in question that I want them to purchase a drive image backup program (I like True Image from years ago--simply cannot rely on MS) and external hard drive and setup disaster recovery (they already save business app backups on flash). The Kyocera multifcn is connected usb, but this has me concerned generally. – Dalton Bentley Jul 14 '16 at 23:41
0

Does MS16-087 imply Windows 7 computer vulnerable from Internet?

Yes , according to blog.vectranetworks ,an attack can be mounted using features known as the IPP (Internet Printing Protocol) and webpnp ( Web Point-and-Print)

Infecting Remotely Using Internet Printing Protocol and webPointNPrint

So far we have constrained ourselves to an internal network where a device was either inserted or infected and used to further infect devices connecting to it. Microsoft Internet printing protocol (IPP) and webpointNprint allow us to extend this issue outside the intranet to the internet. Microsoft IPP allow for the same mechanism to load driver from the printer. This can be done with following piece of code from the MS print server.

  • Thanks for the post. I had read the Vectra post (and did mention that in my original question) and was just trying to clarify whether you had to visit a watering hole or use IPP or Webpnp to be hit. Vectra seemed to agree with that, their example using an infected print driver delivered via webpnp. – Dalton Bentley Oct 18 '16 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.