Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

In the Middle of Printers: (In)security of Pull Printing Solutions


Published on

Published in: Technology
  • Be the first to comment

  • Be the first to like this

In the Middle of Printers: (In)security of Pull Printing Solutions

  1. 1. In The Middle Of Printers (In)security of Pull Printing Solutions Jakub Kałużny PHDays IV, Moscow, 2014
  2. 2. 22 #whoami • IT Security Consultant at SecuRing • Consulting all phases of SDLC • Previously worked for ESA and online money transfers company • Bug bounty hunter
  3. 3. 33 Why hack pull printing? • Widely used • Confidential data • Getting popular
  4. 4. 44 Pull Printing Solutions
  5. 5. 55 Pull Printing Solutions
  6. 6. 66 Threat modelling – key risks sniffing print queues accountability users’ data
  7. 7. 77 Attack vectors Other users’ data Access to other print queues Sniffing, MITM Authorization bypass User/admin interface vulnerabilities
  8. 8. 88 Sniffing documents • No encryption • No challenge • Only documents encrypted • ECB mode for PostScript ? • Encryption layer over the traffic • Network level – IPsec, SSL • Proprietary protocol ?
  9. 9. 99 What is needed ?
  10. 10. 1010 Ex 1: Secure Pull Printing “is a modern printing solution that safeguards document confidentiality and unauthorized access to print, scan, copy and e-mail functions. Its user- authentication provides air-tight security on your shared MFPs that function as personal printers.”
  11. 11. 1111 Vendor ensures „Documents are delivered only into the right hands” „Information is kept confidential. No risk of being left unattended at the printer” „Document collection is safe anytime and anywhere — no “print and sprint”.” „Integration with other enterprise applications and workflows is kept secure through single sign-on”
  12. 12. 1212 Ex 1: Proprietary protocol First look on communication: • TCP, 2 ports • No cleartext, no SSL • Seems to follow some scheme…
  13. 13. 1313 Ex1: Deeper sight on traffic S E R V E R P R I N T E R constant 263B 96B, “X” B, 128B always different 64 B many identical 16B blocks HELLO HELLO, CERTIFICATE SESSION KEY PostScript, ECB mode
  14. 14. 1414 PoC script for MITM
  15. 15. 1515 Ex 1: Reverse-engineered • Hardcoded RSA certificate in printer embedded software • No trust store • AES-128 ECB used for traffic encryption • Same protocol in admin interface
  16. 16. 1616 Ex 1: Consequences sniffing print queues accountability users’ data
  17. 17. 1717 “Many of the devices does not have the CPU power that allows a fast login response and at the same time establish a high security level” For example changing ECB to CBC mode encryption will be more CPU intensive and introducing that may cause slower performance of the devices, which the customers are very reluctant to see implemented.” Ex 1: Vendor gets notified “(…) system has been deployed at many high security customers and has passed internal audits.”
  18. 18. 1818 Ex 2: Responsible vendor “With its roots in education and the full understanding that college kids “like to hack”, our development processes continually focus on security.” “Secure print release (…) can integrate card-swipe user authentication at devices (…) ensuring jobs are only printed when the collecting user is present.”
  19. 19. 1919 Ex 2: Another binary protocol S E R V E R P R I N T E R HELLO USER: user1 token HASH(password + token) Password ok Release my print queue OK Just copied 100 pages
  20. 20. 2020 Charge user “guest-xyz” for copying 100 pages Ex 2: Detailed communication Release my print queue Just copied 100 pages User permissions beginDeviceTransaction (…) guest-xyz Release print queue for user “guest-xyz” S E R V E R P R I N T E R
  21. 21. 2121 Ex 2: Consequences sniffing print queues accountability users’ data
  22. 22. 2222 Ex 2: Vendor gets notified • Gave access to KB and support service • And all versions of software • Responded in few hours and patched in few days • Was happy to be pentested
  23. 23. 2323 Ex 3: Secure Print Solutions “The Secure Print technology offers: High Security - Jobs only print when released by the user”
  24. 24. 2424 Ex 3: Architecture design • Network level protection • IP whitelist • Stateless HTTP service, no session token, no cookie
  25. 25. 2525 Ex 3: Authentication request S E R V E R P R I N T E R POST /AuthenticateLogin2 HTTP/1.1 (...) param1=username&param2=password
  26. 26. 2626 Ex 3: Hacking without any tools
  27. 27. 2727 Ex 3: Tampering accountability S E R V E R P R I N T E R POST /LogJob HTTP/1.1 (…) data=<job><job-id>1073741847</job- id><name>_Print_____1073741847</name><type>103</type>< type-string>Print</type-string><page-cnt>0</page- cnt><color-page-cnt>0</color-page- cnt><color>0</color><duplex>0</duplex><page- size>0</page-size><page-size- string>Unknown_Size</page-size- string><media>Unknown</media><dest>UNKNOWN</dest> <user-name>USER1</user-name><email- address></email-address></job> Just printed a job, note it and charge
  28. 28. 2828 Ex 3: Consequences sniffing print queues accountability users’ data
  29. 29. 2929 Ex 3: Vendor gets notified Received, and will look it over with engineers. I'll come back to you shortly. Discussed with engineers, and the reason why communication was non-SSL, was to support older Lexmark devices which cannot do SSL.
  30. 30. 3030 Other vulnerabilities • Logs and printed files on a default web server • Brute-force attack in admin/user interfaces, no logs • XSS and CSRF in web interfaces • Predictable session identifiers • DoS attack vulnerability
  31. 31. 3131 Get the software Pentests Report Get the software Pentests Report vulnerabilities Research process What we thought How does it really look like
  32. 32. 3232 Research problems Why do vendors fear pentests? • no direct profit • risk of finding criticals • implies a lot of patching
  33. 33. 3333 Cheat sheet - developers Encryption between server and printer/user: • Avoid writing your own crypto • Avoid writing your own proto • Authenticate both side
  34. 34. 3434 Cheat sheet - developers Behind the proprietary protocol: • Access control • Separate interfaces • MITM protection is not enough
  35. 35. 3535 Cheat sheet - testers Look for vulnerabilities in: • Encryption and authentication • Access control in proprietary protocols • Infrastructure design
  36. 36. 3636 Cheat sheet - owners While deploying a pull printing solution: • Get it pentested • Network layer security - IPsec, VLANs • Verify vendor claims
  37. 37. 3737 What’s next ? • CVEs disclosure • A follow-up paper • Ready to fight new proprietary protocols
  38. 38. 3838 Q&A e-mail: tel. +48 (12) 4252575 Jakub Kałużny