I learned PostScript and PDF libraries had security bugs with code-execution potential in the past; I expect more of those to be discovered. Yet I have so far not identified a printer vendor that offers any reasonable support contract promising to deal with such. Therefore, I may want to manage some risks locally for a handful of office printers.

Both attack vector and protected assets are PII-containing print jobs. Often times, print jobs consist of PDF files received from third parties. Among the printers are multi-function devices with access to network storage to store scans. The main concerns are a) exfiltration and b) using the printers to maintain persistence in company networks. Denial of service is mostly irrelevant (management of mechanical failures already covers that).

This is what I plan to do, and hope to have finalized before, if ever, printer malware becomes as common as today's cryptolocker-style malware (1.-4. being generic recommendations discussed before):

  1. apply firmware upgrades as recommended by vendor
  2. disable unused features & protocols (including WLAN)
  3. setup a password for the printers control panel
  4. reduce size of permanent storage to reduce potential for reading back old print jobs
  5. move printers into distinct network, with only one indirect link:
  6. all print jobs go to a CUPS queue rasterizing documents before forwarding image results

Is this a viable strategy of reducing my risks from documents containing attempts to exploit old library (e.g. ghostscript) bugs?

  • 1
    Especially #5 is important. Have a separate printer (v)LAN. Another concern could be that those printers have a fax as well. Dialing into one is also possible for remote maintenance. Some printer also can be managed using telnet, something you might want to block for regular users or in case it's not used at all to block it entirely. I've seen telnet interfaces that were vulnerable to buffer overflows which gave you full access by just sending large input to the the username / password fields. – Jeroen Aug 13 at 6:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.