14 DAY TRIAL // Hackers are always looking for vulnerabilities, no matter if we're talking about software glitches or weak security measures set up by the computer/network administrator. And if there's a vulnerability in your printer configuration, they exploit it too. Today's piece of news is about what security researcher, Adam Weaver, entitled "cross site printing": a new type of attack that may be launched by some malicious people, who intend to control a network printer and print whatever they want. The entire attack is based on a malicious JavaScript published on a website involved in the exploit. As you can see, the attacker has to lure people on their dangerous page, so avoiding visiting such websites may be a solution to stay on the safe side.
"By using only JavaScript, an Internet web site can remotely print to an internal network based printer by doing an HTTP Post. The web site initiating the print request can print full text, enter PostScript commands allowing the page to be formatted, and in some cases send faxes. For the attack to succeed the user needs to visit a web site that contains this JavaScript", Adam Weaver wrote in his research paper.
What's interesting is that this kind of attack is able to do more damages than printing pages using your network printer. Jake Soriano, of security vendor Trend Micro, explains that the 'cross site printing' can also be used to send fax messages, if such devices are available, and even worse - to download new firmware.
"Besides printing annoying messages, the malicious Web site is seen as capable of discharging potentially more dangerous commands, sending fax messages for instance if the device is available, formatting a printer's hard drive, or downloading firmware", he wrote in a blog post published on the TrendLabs Malware Blog.
In case you're afraid that you network may get compromised by such attackers, the solution is simple: don't leave your network printer unprotected - a hard-to-guess password should be enough to keep you away from hackers. Moreover, configuring the printer to accept commands from a 'centralized print server' would be very useful, Adam Weaver concluded.