I know what you printed last summer: network printers as an element of uncertainty

No ratings

Presented at IT-DefenseStuttgart 2019 by

Jens Müller

The paperless office has been predicted for decades. Still, a lot of companies and private households cannot do without a printer. Instead of having been abolished, however, printers have turned from simple machines into complex computer systems that are directly integrated into the corporate network and process sensitive information. This makes them an attractive target for attackers.Different vulnerabilities in standard printer languages such as PostScript, which are supported by almost any laser printer, will be discussed during this presentation. They allow various attacks, from DoS and access to the file system or other users’ print jobs to the execution of random program code. An evaluation of 20 printers from different manufacturers has shown that all tested devices are prone to at least one attack.Additionally, it is demonstrated how systems exceeding the classic printer can be attacked with similar techniques, for instance, cloud printing or document processing websites. The presentation is accompanied by live demonstrations.