Several common attacks on network printers

The network printer is a good solution for small and medium-sized organizations to reduce the purchase cost of printer maintenance and provide a device usage rate (the network printer here refers to a single printer that does not require a print server) but as one of the network devices. Its security is often neglected by administrators. Administrators only pay attention to whether the printer is connected properly and whether supplies are complete, but they do not realize that it may also be one of the targets of the attack. The following is a common attack method for network printers that I collected through the OA emergency station. I hope that users will protect them from future attacks.

The following attacks may occur on a network printer configured with public network ip (or intranet ip)

1, printing supplies exhausted attacks (J0ker own name)

This should be regarded as a type of denial of service. After the attacker logs in using the default management password, the printer adds a lot of useless print jobs to the printer, exhausting the printer's consumables—users cannot print.

2, print log read

After the attacker logs in, he can read the situation where the network user uses the printer, and infer the user's use of the printer's frequency, network activity, and other specific information.

3, printer configuration changes

For malicious attackers, the simplest method of destruction is to mess up the configuration of the printer, and then change the management login password to a long, complex password. Haha, most administrators will be unable to help!

4, printer attack springboard

Some high-end network printers use the embedded Lniux operating system for control. If you use the default password to log in, it may become a springboard for attackers to jump from the external network to the internal network.

If the network printer has changed the administrator password, it will:

1, DDoS

This type of attack is effective for most network devices that have not been made security-proof.

2. Man-in-the-middle attacks

In theory, the content sent by the network user to the network printer through ARP spoofing can be sent to the machine controlled by the attacker, and then recorded and sent to the real network printer.

There is only one defense principle for the above attacks. Do not overlook network printers. Use it as a standard network device or network server for security configuration and protection. At the same time, fast recovery from network printers is also an administrator's consideration.