We hacked 28,000 unsecured printers to raise awareness of printer security issues

[TownVirtuoso]

Source: https://cybernews.com/security/we-hacked-28000-unsecured-printers-to-raise-awareness-of-printer-security-issues/
 

Cybersecurity experts at CyberNews hijacked close to 28,000 unsecured printers worldwide and forced them to print out a guide on printer security

Most of us already know the importance of using antivirus, anti-malware, and VPNs to secure our computers, phones, and other devices against potential attacks. Printers? Not so much. We at CyberNews wanted to show users the importance of protecting printers from becoming easy prey for cybercriminals, so we decided to bring the message home.

In order to help as many people as possible secure their devices against potential cyberattacks, the CyberNews security team accessed 27,944 printers around the world and forced the hijacked devices to print out a short 5-step guide on how to secure a printer, with a link to a more detailed version of the guide on our website.

About this experiment

To perform the experiment, we used Internet of Things (IoT) search engines to search for open devices that utilized common printer ports and protocols. After filtering out most of the false positives, we were left with more than 800,000 printers that had network printing features enabled and were accessible over the internet.

While this does not mean that all 800,000 of these printers were necessarily vulnerable to cyberattacks, our estimates have shown that we could successfully target approximately 500,000 of these devices.

After selecting a sample of 50,000 open printers and creating a custom printing script, we managed to print out PDF documents on 27,944 unprotected devices.

How we did it

Before performing the attacks, our initial step was to gather the total number of available targets. To find out how many printers were on the menu for our experiment, we searched for IP addresses with open ports on specialized IoT search engines, such as Shodan and Censys. While performing the search, we made sure that the open devices we found were actual printers, as opposed to unrelated services that simply used those ports for other purposes.

Out of 800,000+ available printers, we selected a sample of 50,000 devices that we would try to access and force to print our guide on printer security.

Our selection was based on:

• Device location (to cover the entire globe)
• Device manufacturer
• Protocols used to access the printers

We then created our own custom script that was specifically designed to only target the printing process, without gaining access to any other features or data stored on the printers.

As soon as we launched the script, it began hijacking the printing processes in unsecured devices and forced them to print out the printer security guide.

The results

In the end, we managed to hijack 27,944 printers out of the 50,000 devices that we targeted, which amounts to a 56% success rate. Taking this percentage into account, we can presume that out of 800,000 internet-connected printers across the world, at least 447,000 are unsecured.

These numbers speak volumes about the general lack of protection of networked devices worldwide.

Example of available open printers on a single IoT search engine (Shodan.io):

As we can see, many users and organizations still use internet-connected devices without thinking about security, installing firmware updates, or taking into account the implications of leaving their devices publicly accessible. Which means that the humble printer remains one of the weakest links in the security of both organizational and home networks.

While security experts have been aware of printer vulnerabilities for quite a while, even previous large-scale attacks on printers like the Stackoverflowin hack in 2017 and the PewDiePie hack in 2018 did not seem to shock the public into securing their networked devices.

Even though securing each and every printer in the world might seem like a pipe dream, this does not mean that institutions and security experts should stop raising awareness about printer security and implementing stricter cybersecurity policies across organizations. Otherwise, the world might be just one massive cyberattack away from potential disaster.

Why printer security is important

While we were deliberately careful to only target the printing processes of the unsecured printers during the experiment, IoT hijacking attacks – when performed by bad actors without ethical limitations – can cause serious damage to organizations and individuals who neglect printer security.

From legal firms to banks to government departments, office printers are used by organizations of all types and sizes to print sensitive, confidential, and classified data. Not only that, these printers can also store copies of that data in their memory. Needless to say, attackers can easily exfiltrate this data by accessing unsecured office printers and use it for blackmail or corporate espionage, or simply sell it on the black markets of the dark web.

Bad actors can also take over unsecured printers and incorporate them into botnets in order to perform DDoS attacks, send spam, and more. What’s more, cybercriminals can use internet-connected printers to gain an initial foothold into the local or corporate networks and find more ways to cause more damage to the unsuspecting victims. Or they can simply use these printers to mine cryptocurrency, ramping up their victims’ electricity bills in the process.

Securing your printer

Our experiment has shown that printer security remains a serious concern for individuals and organizations across the world. With that said, most of the printers we managed to hijack could have been easily secured by following common security best practices and a few simple steps. 

To quote the security guide we printed on tens of thousands of unsecured printers, “here’s how”:

1. Secure your printing ports and limit your printer’s wireless connections to your router. Configure your network settings so that your printer only answers commands that come via specified ports on your network router. The standard protocol for secure printing on new printers is IPPS protocol via SSL port 443.

2. Use a firewall. This will protect unused protocols that can allow cybercriminals to remotely access your printer from outside the network.

3. Update your printer firmware to the latest version. Printer manufacturers regularly fix known vulnerabilities in the firmware for the devices they produce, so make sure your printer always stays up-to-date security-wise.

4. Change the default password. Most printers have default administrator usernames and passwords. Change it to a strong, unique password in the utility settings of your printer and make sure print functions require log on credentials.

For more detailed information on printer security, read our guide on securing your printer against cyberattacks here.

 

[mp68terr]

Good way to show people/companies that their printer/device is not secure. Let's hope that CyberNews will not be sued for its action.

[cosy]

Printers are always venerable to these attacks and that is not new in the IT Business 😁

Even when the printer is defect, am can read all the data on it

[mp68terr]

26 minutes ago, cosy said:

... that is not new in the IT Business ...

Indeed.

So how comes that big companies/organizations do have insecure printers?

[TownVirtuoso]

1 hour ago, mp68terr said:

Good way to show people/companies that their printer/device is not secure. Let's hope that CyberNews will not be sued for its action.

I don't think they will, it's not like they caused some damage to anyone. And covering the cost of printer ink should not be an issue 

[mp68terr]

I'm afraid that it's not about damages, it's more about rights/law.

Showing that a device is not secure is a good thing, but hacking it is another story. Some are very (too) picky 

[straycat19]

2 hours ago, mp68terr said:

I'm afraid that it's not about damages, it's more about rights/law.

Showing that a device is not secure is a good thing, but hacking it is another story. Some are very (too) picky 

 

Yes, what they did was illegal.  The fact that so many were accessed could lead to a class action suit on a civil case.  If anyone wanted to pursue it they could cause criminal charges to be filed in every country they accessed a printer in.  Personally, if one was mine I would pursue a civil case and then force everyone who was hacked to become a member in a class action suit.