In the Middle of Printers: The (In)Security of Pull Printing Solutions

No ratings

Presented at HackInTheBox 2014 by

Jakub Kaluzny

Big corporations and financial institutions need secure pull printing services which guarantee proper encryption, data access controls and accountability. This research aimed to perform a Man-In-The-Middle attack on multifunction printers (MFPs) with embedded software from the most popular vendors. External managed print services are compatible with many MFPs (unlike OEMs), therefore the attack range is much wider and is not limited to only one printer producer. Pull printing solutions consist of printers with embedded software and often a proximity card reader, a print server and, in some cases, client software. Our penetration tests covered all three attack vectors. Man-in-the-middle attacks on printers required analysis of proprietary protocols with specific encryption solutions; different from standard SSL. One of the identified security risks was to break the encryption – this was done in multiple ways, from fully decrypting the traffic to analysis of PostScript files encrypted in ECB mode. Other critical vulnerabilities led to the possibility of collecting any print jobs from the server and printing at other’s expense. Tested solutions offered multiple modes of authentication – such as proximity card reader, PIN, LDAP account etc however PoC scripts proved that it is possible to bypass most of authentication methods.