Most networks have become harder to breach due to increased converged security operations; however there is still a gap that has never moved at the same pace; This issue lies in configuration management which largely is a key downer on most networks. Some of the most common misconfigured devices on any network that usually have default configurations include:
- Downstream switches
- Scanners etc.
Today we look at enablers that have attackers winning against your secure networks with very little effort. The start of the problem is with using default credentials on most of these support/downstream devices as they are seen as auxiliary and low risk. Today we focus on Printers.
Initially most printers were pretty rudimentary making them hard to truly exploit and leverage fully in such context ; Most worked in a standalone fashion but this has changed a lot. Most printers nowadays come with a 3 in 1 functionality.
This introduces a wider attack surface based on the following reasons:
- Need for an administrative interface to manage this multi-faceted functionality
- They are networked
- The ability to login to other networked devices
Printers are not your super computing devices and therefore when it comes to the 3rd functionality that deals with storing credentials to allow automated login to connected devices; they would use encryption that doesn’t consume a lot of computing resources.
The attack process against these advancements is quite simple; we will take a Kyocera case to showcase this:
- Login to the admin interface
- Scan Self In
- Print Password Out
System admins are known for having priority paralysis and most times “unimportant items/devices” would be unattended to; printers are at the top of the list. As long as there’s no printer connectivity issue then most times it is unmanned leaving an unguarded gate open. For an attacker at this point is find the printer version through a scan and then search for default credentials and the default administrative URL.
Scan Self In
The next step is that an attacker would scour through the configuration of the printer and identify if the scan to folder functionality is enabled; This is supported by the address book functionality which allows configuration of SMB credentials. The issue here is most networks are based on an Active Directory environment; In order for the system admin to configure a folder they wouldn’t know all the machine’s passwords. This would necessitate them to configure a single account with super user (Domain Admin) privileges to be able to login to all machines in the address book for purposes of scanning to folder.
In order to view the configuration it is possible to export the configuration via the print utility KNET Viewer; below is a sample exported address book.
Password encrypted; Attack thwarted or No?
Print Password Out
As mentioned earlier printers don’t have high computational power they would therefore utilise weaker algorithms that require less intensive computing power. In our particular case there are two enablers:
- Symmetric Key
- Weak Encryption algorithm i.e. DES
- Key Re-use across multiple models
This would give you access to one of the following:
- Local Admin
- Domain Admin
The code can be found here in event one would want to understand the inner workings of the utility.
The summarised attack workflow is as below:
The GitHub repo for this attack is available here.