Re: Printer exploit?

[sarnold () wirex com]

On Tue, Jun 26, 2001 at 02:32:05PM -0600, Brendan Murphy wrote:
>   More than a few of our networked HP Laserjet printers have been
> sporadically printing out entire trays of paper that have a '1', 'u', 'i'
[...]
> Some facts, just in case:
>       - Printers are using JetDirect cards over TCP/IP
>       - Some users connected through print server, others directly.
>       - Printers are NOT the same model

The second note is the source of your problem. By allowing users to
connect directly to the printer, you lose all possibilities of
convserving your resources.

It has been many years since I have had to work with HP JetDirect Cards
(Oh, how I hope they have improved :) but the thing to look for in their
setup utilities is a way to restrict connections to only a few IP
addresses -- the print servers on your NT/Unix machines that have
logging and much better access controls (tcpd aka tcp wrappers, or an NT
equivelent which I hope exists).

Of course, if the JetDirect cards don't have the ability to set a list
of IP addresses that are allowed to submit print jobs, you are in a bit
more troubling spot. My first thought is to set different RFC1918
addresses on the printer, and put two IPs on your print servers -- one
that the existing tcp/ip subnet knows how to speak to, one that can only
speak with the printers. This ought to keep idiots from doing it again,
though it will never deter a determined attacker.

Another possibility is to look into using OpenBSD as an ethernet bridge
thingy: bridge(4) brconfig(8)
http://www.obfuscation.org/ipf/ipf-howto.html#TOC_49

Sadly, this technique will require one OpenBSD box per printer. (It
might be able to work with other IPF-running unices, I don't know.)

Good luck.


----------------------------------------------------------------------------


This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see:

http://aris.securityfocus.com