50

Don't leave your printer exposing port 9100 to the internet. This large-scale printer attack is nothing new. It's happened previously and is very simple to execute. The attacker likely used Shodan to scan the entire internet for printers with port 9100 open to the internet. Due to way RAW printing over port 9100 works, all is required after this is to ...


46

The answer entirely depends on implementation of scanning process in the printer. Modern printers are in essence computers and they are much more powerful than their predecessors from earlier days. So, the question boils down to "is it possible to hack a computer by using an image"? The answer is yes, because creating exploit-free software is almost ...


35

VL-80's answer is good, but there are conditions under which the answer would be a clear no for "is it possible to hack a computer by using an image?" - for example, if all the code processing the image has no branches or array offsets dependent on values from the content of the image. If all the printer did was copy the image or store it in uncompressed ...


11

As written in @Rob's comment, the scammer is trying to get the S/N of your printers (information gathering, the first step in a social engineering attack) so later on will place the real scam: either call and pretend he's your legitimate printer supplier (after all, he knows the S/N of your printers) and persuade you to order cheap paper and toner supplies ...


11

The EFF has a page describing how the information is encoded in those yellow dots: https://www.eff.org/issues/printers The Python program to decode can be found at: https://github.com/zackdouglas/docucolor.cgi They also published a list of printers which do not display those dots: https://www.eff.org/pages/list-printers-which-do-or-do-not-display-tracking-...


8

The attack you link to was against printers which were directly accessible from the internet. If you have a typical home network which is connected to the internet by some DSL or cable router you don't have to worry about this specific attack unless you've explicitly enabled access to the printer from the internet - by default direct access from the internet ...


7

The mechanisms applied when you "print" can be complex and depend a lot on the printer, the printer drivers and the OS. What you see as text will be translated into something that the printer can accept, and that's the role of the driver on the OS side. In any case, printers don't have infinite memory, so it is the role of some machine (in this case, yours) ...


6

Many printers, especially those used in businesses, support IPP over HTTPS. If you have access to the printer's control panel, you can enable HTTPS and install a certificate that you trust. On your computer, set up a printer manually and specify https://printer-domain or printer-domain:443 as the printer's address, depending on what operating system you are ...


6

From what I read here and after a quick look in the User's Guide this does not seem to be the case. Print jobs are stored in the local memory (RAM) of the printer, but this is not the same as a hard drive (see also forest's comment). This is true for the majority of modern printers. If the printer is turned off for a moment, there should be no more data ...


5

Sweet32 is probably not a problem for common usage of a printer. To cite from Sweet32: Birthday attacks on 64-bit block ciphers..: We show that a network attacker who can monitor a long-lived Triple-DES HTTPS connection between a web browser and a website can recover secure HTTP cookies by capturing around 785 GB of traffic. It is very unlikely that such ...


5

Your question is a good one. The basic issue is that a digital signature is associated with digital data. And (equally importantly), access to the original digital data is required in order to verify the signature or signatures. Therefore, the transmission medium needs to be digital. Three answers: The paper copy is a pointer to the real (digital) ...


5

That’s a good start, but know these problems aren’t limited to just printers. All kinds of smart-home devices, including security cameras, lamp controllers, thermostats, etc., can unintentionally expose your whole home’s network to risk of attack. One step you could take is to log in to your home router (or cable modem), find the settings for UPnP (...


5

It depends. Steganography is basically hidden information. It can be as simple as a picture that is mirrored versus a non-mirrored picture. This would convey one bit of information, and may not be easily detectable to an adversary. It would survive even extremely crude reproductions. If you however hide data in the least significant bit of the colorspace, ...


4

This functionality already exists in Nmap, in the pjl-ready-message NSE script. Here's an example usage: nmap -p 9100 --script pjl-ready-message --script-args pjl_ready_message="your message here" 192.0.2.0/24 The script already checks for a real PJL service before sending the command, so you probably don't have to check for OS fingerprint results.


4

There's 2 types of MFP's that I have seen: Those meant for SOHO/Consumer. Those does rarely have any permanent storage for documents, rather its a little flash area that stores configuration data only. If the configuration contains sensitive information, a factory reset is enough to clear information. They very often use standard SDRAM sticks (either SODIMM ...


4

Mostly they use multifunctional printers of major vendors (I worked for few and I installed printers in banks, government offices, police etc.). They have turned on every possible security features like HDD encryption, SSL communication, password/chip authentication, disabled USB ports etc. Sometimes even customized firmware. As "normal" installation took ...


4

In 2017 researchers at the Cyber Security Research Center at Ben-Gurion University in Israel demonstrated a scanner attack using lasers. Drone-mounted lasers controlled by an attacker were used to communicate with malware installed behind an air-gapped system, e.g. through a window into an office. Article here: https://arxiv.org/abs/1703.07751 This isn't ...


4

I will be the contrarian here. could it be hacked using malicious code written on a piece of paper? Absolutely not While bugs in image processing libraries do happen, writing code on a piece of paper, scanning it, and expecting it to execute on the scanner for hacking purposes is the kind of thing that only happens in (bad) movies. Especially when it ...


3

If the printer is behind a NAT, computers on the Internet can not connect directly to the printer. Whether or not the printer supports IPP makes no difference. The open ports and the missing default password do increase the attack surface, but do not indicate any vulnerabilities that can be used to access the printer. It may well be possible for an attacker ...


3

Best resource would be to ask the manufacturer. How much printers cache and how they secure it varies widely. For Consumer grade hardware, there is unlikely to be a mechanism for securely wiping the contents provided, since consumers don't need such a feature, so probably you'd need to look at physical destruction.


3

Here's a pretty helpful article in case you haven't seen it: http://www.techrepublic.com/blog/it-security/the-truth-about-copier-hard-drives-tips-for-securing-your-data/ The short version is that there are some loose standards but not every vendor will adhere, so YMMV. Either do some research before buying and make sure you know what you're getting into, or ...


3

I'd recommend Virtutech's SIMICS software. Note that Virtutech was bought by Intel and assigned to their subsidiary: Wind River. Simics is a SIMULATOR, which has important distinctions from an EMULATOR (like qemu). See https://stackoverflow.com/questions/1584617/simulator-or-emulator-what-is-the-difference for specifics on the differences. Simics simulates ...


3

Ideally, printers are to be seperated from their clients (and the internet) as much as possible. There seems to be some kind of confusion on your side between categories of network devices. I'm assuming you're coming from a COTS standpoint which usually means that a device called "Router" does carry the jobs of "Router", "Firewall", "Switch", "WiFi Access ...


2

You could consider putting the printer on a dedicated subnet in its own VLAN. In lots of enterprise networks there are dedicated 'Device' VLANs. Because all traffic will then need to traverse a router (and therefore probably a firewall) to get to the subnet the users are on you have the option to put some firewall rules in to make sure: The printer cannot ...


2

Multi-function printers have reasonable computing power, and many are in fact linux devices, so it is theoretically possible that someone could use it to bridge into a network. It would make little sense to try it though: Slow access: most faxing happens at 9600 baud, that's really slow. Even if you could negotiate faster the best you could realistically ...


2

It depends on how exactly the exploit on the website works. It is in fact not unconceivable that there might be an exploit which only works when the website is printed out, because it targets a vulnerability in the browser's print system. However, even that is very unlikely to result in an infective PDF. A "print to PDF" functionality is usually ...


2

As it seems there are a few bugs causing a remote code execution vulnerability. That kind of vulnerability would be able for your printer, because your printer is connected to your computer which is connected to a internet connection. I would recommand you to install the patches they'll release next week, cause they fix some other bugs, too. Don't be worry, ...


2

First of all, your premise that all tracking is done via micro-dots is incorrect. Recent developments show that tracking technology uses micro-shifts in pixels or other invisible steganography-like technology to include tracking information into print outputs. So smudging or backgrounds won't really be a 100% solution. You've lined up most available ...


2

Yes, it is still a problem. Printers are the first big "IoT" device and the problems that have plagued printers plague every other IoT device today. And the way to mitigate problems are similar: patch configure isolate Make sure the IoT device is fully patched (and because they may not tell you they need updating, you might have to manually check) Ensure ...


2

Giving the printer the password for the WiFi (which I assume you mean with "network password") is similar to connecting the printer directly with ethernet to the router: it allows the printer to be part of the network. The main difference is that bugs in the printer might make it possible for an attacker to extract and misuse your WiFi password even if the ...


Only top voted, non community-wiki answers of a minimum length are eligible