Printers Gone Wild!

Printers Gone Wild!

A printer, who cares...HP's Printer Job Language(PJL)... sounds innocent enough. While researching into how to secure these devices some new malicious abuses have been discovered as well as some fun new uses for old attacks. We will cover how to send SNMP commands to HP printers and get back responses even if SNMP is disabled on the device. As well as discus some of the other fun that can be had with PJL and its lack of security like printer information gathering, control panel lockout, disk lockout, file uploads, file downloads, and mass LCD changing. PrintFS is the culmination of all of this research combined. Allowing for the printers in an enterprise to become a large storage receptacle for data ex-filtration, covert storage, and browser exploitation tactics. After the talk I will be releasing the printFS printer file- system tool as well as the python PJL library and another demo PJL python script.

Presented by