1

Our office has a number of printers which, according to nmap are running Linux 2.6.X with a whole bunch of open ports 80

  • 1
    Is there any specific reason on why do you think that this is something to be concerned about? If yes, please edit your question so that it reflects your thinking. – Steffen Ullrich May 8 at 16:05
  • Let me rephrase that for you: "are unmanaged computers, without any monitoring or alerting, running unsupported OSes and connected to the network so that anyone can interact with them something to be concerned about?" – schroeder May 8 at 16:06
  • 1
    Every device is something to be concerned about. That's why we have an information security field: to worry about these things. Can you be more specific? Are you concerned about the data they store? Are you concerned about vulnerabilities? Are you worried about backdoors? – schroeder May 8 at 16:08
1

The answer depends on how the printers are being used and who they are exposing themselves to. Assuming they are only listening on your local network, then the old kernel (and presumably other old software it runs) will be vulnerable to a variety of attacks. An attacker on your local network may be able to compromise the printer. If the printer is being exposed to the global internet, then there are bigger problems, and it may be possible for people all around the world to gain access to the printer and LAN.

While updating your printer's software is not likely to be possible, you can use a firewall external to the printer to block the open ports and only allow trusted connections from trusted sources.

1

It's worth bearing in mind that the nmap OS detection algorithm isn't perfect, and it may not have sufficient information available to it to accurately fingerprint the kernel version. It's likely that the open http port gives nmap enough information to reliably say that the device is running Linux, but determining the kernel version is more difficult and should be considered less reliable.

Linux 2.6.x is no longer supported, and it is generally not advisable to expose an unsupported OS to the network. But before being too concerned, I would suggest using a secondary source to confirm that nmap is accurately reporting the kernel version (in my experience, it can be a bit hit and miss). The manufacturer datasheet or web site would be a good starting point.

0

Could you provide more information? I'll start by talking about the kernel.

The kernel has multiple privilege escalation and denial-of-service vulnerabilities that could impact the confidentiality of data if they did gain access somehow. When the kernel is that low, often times there will be vulnerable services running at the operating system level.

Could you please run this nmap command and interchange 127.0.0.1 for your printer's IP address and post the output:

nmap -sS -p- -T4 127.0.0.1 -A -oA scan.out -Pn --open

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.