4 ms·

The analysis in TFA is of the previous generation OfficeJet Pro 8720 which was introduced in 2016. This is fascinating but I'm looking forward to folks poking

by reid 6y ago

The analysis in TFA is of the previous generation OfficeJet Pro 8720 which was introduced in 2016. This is fascinating but I'm looking forward to folks poking around at the current generation of printers because HP changed a lot about the firmware security lately. I recently purchased an HP OfficeJet Pro 9015 which was introduced in early 2019. This newer printer has automated firmware updates enabled by default. The new generation OfficeJet Pro 8025, 8035, 9015, 9025 and similar offers several security benefits over the previous generation according to a report [1]: - Firmware Integrity and Secure Boot - Automatic Firmware Recovery/Self-Healing BIOS - Run-Time Code Integrity - Automatic Firmware Update Agreed: HP is the most secure printing company from what I can understand. Nobody else in the printer business has these security features in their products. Security elements like secure boot, firmware integrity, and automatic updates are things I expect now. [1]: https://www.keypointintelligence.com/media/2240/hp-officejet-pro.pdf https://www.keypointintelligence.com/media/2240/hp-officejet...

eyalitki 6y ago
Glad to hear that they took our advice, and enabled automatic firmware updates by default. We suggested this feature when we helped them fix the fax vulnerabilities (DEFCON 26 - What The FAX?!), happy to see they listened.
- reid 6y ago
  Awesome! I really enjoyed your talk! Great work.
- unixhero 6y ago
  That was an amazing talk. Thank you so much.
- reid 6y ago
  And speaking of printer vulns, I believe it'd be really interesting to investigate IPP over USB as a attack vector to pwn otherwise secured hosts. Despite using a VPN which forwards all of my network traffic on macOS, I can still access my printer's web server because of the automatically configured IPP-USB connection which provides a reverse proxy to the printer's embedded web server over USB. I haven't seen many articles detailing how this works and how it's secured...
soberman 6y ago
Shlomi from JSOF here. The firmware we looked at was an OfficeJet Pro 8720 with a relatively new firmware version From latest 2019. We've seen some of the features that you're talking about including Automatic firmware update, and others we weren't looking for. The firmware can be downloaded from the web For the purposes of reverse engineering for security research. We will be going into further details and more information in the next post in the series.
- reid 6y ago
  Cool, looking forward to your next posts! My understanding is the 2019 hardware has secure boot -- which the 2016 hardware cannot support. The 2016 era hardware has relatively modern firmware versions available, but the hardware security is likely different and therefore the potential hacks will be different. Lots of opportunity to explore.
  - sobermanman 6y ago
    You can now find the second post in the series here- https://jsof-tech.com/unpacking-hp-firmware-updates-part-2/ https://jsof-tech.com/unpacking-hp-firmware-updates-part-2/

by reid 6y ago

eyalitki 6y ago

Glad to hear that they took our advice, and enabled automatic firmware updates by default. We suggested this feature when we helped them fix the fax vulnerabilities (DEFCON 26 - What The FAX?!), happy to see they listened.

reid 6y ago
Awesome! I really enjoyed your talk! Great work.
unixhero 6y ago
That was an amazing talk. Thank you so much.
reid 6y ago
And speaking of printer vulns, I believe it'd be really interesting to investigate IPP over USB as a attack vector to pwn otherwise secured hosts. Despite using a VPN which forwards all of my network traffic on macOS, I can still access my printer's web server because of the automatically configured IPP-USB connection which provides a reverse proxy to the printer's embedded web server over USB. I haven't seen many articles detailing how this works and how it's secured...

soberman 6y ago

Shlomi from JSOF here. The firmware we looked at was an OfficeJet Pro 8720 with a relatively new firmware version From latest 2019. We've seen some of the features that you're talking about including Automatic firmware update, and others we weren't looking for. The firmware can be downloaded from the web For the purposes of reverse engineering for security research. We will be going into further details and more information in the next post in the series.

reid 6y ago
Cool, looking forward to your next posts! My understanding is the 2019 hardware has secure boot -- which the 2016 hardware cannot support. The 2016 era hardware has relatively modern firmware versions available, but the hardware security is likely different and therefore the potential hacks will be different. Lots of opportunity to explore.
- sobermanman 6y ago
  You can now find the second post in the series here- https://jsof-tech.com/unpacking-hp-firmware-updates-part-2/ https://jsof-tech.com/unpacking-hp-firmware-updates-part-2/