6 ms·
Many, perhaps most network-connected printers, NAS units, and other devices (e.g., home-automation hardware) simply assume that the local network they connect t
by cs702 14y ago
Many, perhaps most network-connected printers, NAS units, and other devices (e.g., home-automation hardware) simply assume that the local network they connect to will be securely protected from external attack, so they're not configured to withstand even the simplest of attacks.
This is exactly the opposite of what many security experts recommend: ideally all devices should be secure regardless of whether the network they're on is secure or not. With more and more devices offering remote-Internet-access functionality every day, this principle of security is becoming ever more fundamental.
Bruce Schneier's personal WiFi network at home is fully open, because -- in his own words: "If I configure my computer to be secure regardless of the network it's on, then it simply doesn't matter. And if my computer isn't secure on a public network, securing my own network isn't going to reduce my risk very much."[1]
Like rachelbythebay, I'm also waiting for the great network printer security apocalypse.[2]
--
[1] http://www.schneier.com/blog/archives/2008/01/my_open_wireles.html http://www.schneier.com/blog/archives/2008/01/my_open_wirele...
[2] http://news.ycombinator.com/item?id=4412522 http://news.ycombinator.com/item?id=4412522
--
UPDATE: Just for the heck of it, I ran a fairly fast scan (nmap -T4 -A -v -PE [IP address]) on an HP all-in-one printer accessible over my LAN, and there were a LOT of open ports -- see pasted results below. I then pointed my browser to port 9100 on the printer, which instantly printed the HTTP headers without complaint. The printer's configuration page reports that it is "secured" by an administrative password.
PORT STATE SERVICE VERSION
80/tcp open http HP PhotoSmart/Deskjet printer http config (Virata embedded httpd 6_0_1)
139/tcp open netbios-ssn?
6839/tcp open tcpwrapped
7435/tcp open tcpwrapped
8089/tcp open tcpwrapped
9100/tcp open jetdirect?
9101/tcp open jetdirect?
9102/tcp open jetdirect?
9110/tcp open unknown
9220/tcp open hp-gsg HP Generic Scan Gateway 1.0
9290/tcp open hp-gsg IEEE 1284.4 scan peripheral gateway
9500/tcp open unknown
- zhoutong 14y agoEspecially with the development of IPv6, internal routing becomes transparent and the appearance of protection offered by NAT is gone. Possibly these printers all have been assigned a public-reachable IPv6 addresses.
- gergles 14y agoIt isn't an "appearance" of protection. NAT is the best thing to happen to security for home networks since their inception. The push to remove it with IPv6 and to force home users who don't care about these things to put their entire home network directly on the Internet is going to wreak havoc.
- agwa 14y agoThe security comes from the stateful firewall, not from the NAT. In all likelihood, IPv6-supporting home routers will ship with a stateful firewall enabled by default.
- kevinpet 14y agoThe stateful firewall is there because it is necessary for NAT. If it weren't necessary for NAT, consumers would not bother with it. Customers buy the router with the firewall to hook up multiple computers, they don't care about the security. You could argue that they should hire a security consultant to educate them on the need for a stateful firewall when setting up their home network, but you would be smoking crack.
- sciurus 14y agoIn all likelihood, IPv6-supporting home routers will ship with a stateful firewall enabled by default.
- csense 14y ago> In all likelihood, IPv6-supporting home routers will ship with a stateful firewall enabled by default. My thinking is router manufacturers will probably not do this. Because if you don't have a firewall and expose all your computers to the Internet via IPv6, Everything Just Works (assuming the rest of the world uses IPv6, which will be a close approximation to the truth in the future world we're talking about). Which means those insecure routers will have a better user experience for the vast majority people in the market, who don't have a clue about networking and would rather gouge their eyes out than learn about it. Routers currently don't do this for IPv4 for a good and simple reason: When you're assigned a single public IP by your ISP, there's no way to automagically tell which host is supposed to receive an inbound connection. The "good" news (from a security standpoint) is that the most clueless will probably be using IPv4 for a long time to come, helped along in their foot-dragging by the eventual release of IPv4 space by early adopters of IPv6-only.
- guard-of-terra 14y agoUnfortunately, trying to secure your hardware is a lesson in frustration and ruins the whole experience. This is because every device acts confused, hangs or produces cryptic errors when facing denied access; restricted resources prevent you from understanding why the access was denied and how to open it; changes in network topology lead to problems that only stumbled over much later; and it's extremelly hostile on guests who spend half a hour trying to configure. It's untractable. Most of user crypto has same set of problems btw.
- munin 14y agoit's worth noting, I think, that Schneier is pretty out of touch when it comes to the whole "open wireless" thing, because he leaves himself open to a bunch of local-only attacks. he's correct that your computer should be able to withstand being on the 'open' internet, since it is every time you take it to work or a coffee shop or something, but, don't be an idiot, just turn WPA2 on at your house. many access points (I think) now provide a feature where they can run multiple SSIDs. so if you're savvy, you can turn on a guest-only open wifi for when you have visitors, and turn it off when they leave. kind of like a guest key for your spare room!
- bad_user 14y agohe leaves himself open to a bunch of local-only attacks What kind of attacks might those be? Consider the case of a computer connected to the network with no open ports (other than say, 25 for SSH), with a properly configured firewall, that connects to the Internet through a VPN and with an operating system that auto-updates itself. What could you do to it from inside the network?
- hannibalhorn 14y agoI secure mine mostly so that a neighbor won't download torrents on my connection and thus negatively impact my experience. I imagine in an actual house it's not as necessary, but I live in a zone of large buildings and usually see 20+ networks visible.
- pasbesoin 14y agoWell, if his Internet connection is open, then he's open to being prosecuted for what other people might download on it. As a celebrity, he probably has some substantial de facto immunity against this. (One blog post, and "the Internet" will show up on his side.) The rest of us... not so much.
- bad_user 14y agoActually with an open wifi you're more protected agaist such instances because it's concrete proof that your IP was shared by other people, considering how ISVs assign these IPs dynamically and that their logs may not be accurate.
- Ixiaus 14y agoA friend of mine over here recently discovered that a certain printer manufacturer (very big one) had a complete SNMP service that runs on all the printers - they aren't protected and you can run any command on it. You can even tell the printer to download, load, and reboot with custom firmware. Amongst many other yucky things. This sounds somewhat similar.
- nodata 14y agoWhich printer manufacturer?
- dfc 14y agoRerun with "-sV --allports" --allports (Don't exclude any ports from version detection) . By default, Nmap version detection skips TCP port 9100 because some printers simply print anything sent to that port, leading to dozens of pages of HTTP GET requests, binary SSL session requests, etc. This behavior can be changed by modifying or removing the Exclude directive in nmap-service-probes, or you can specify --allports to scan all ports regardless of any Exclude directive. PS I think the "-A" and "-T4" is redendant. I think aggressive mode sets the timing to 4 among other things.
- deleted 14y ago[deleted]
- cs702 14y agodfc: running nmap with "--allports" could make the printer waste a lot of paper, so I won't do it. (FWIW, by pointing my browser to the jetdirect port, I was able to control the timing of the http request with more precision and cancel printing immediately after the first page came out.) PS. No, I was not trying to replicate what happened -- just trying to get a quick sense of how many ports are open. Sorry for the misunderstanding.
- dfc 14y agoDid you read what I posted? The man page excerpt that I included specifically mentions weird printer behavior. When you posted the nmap scan report I thought you were trying to replicate what had happened. Otherwise its not really news that print devices have a lot of ports open. In order to not waste paper you can just have one or two sheets in the tray...
- ArbitraryLimits 14y agoIt's not 1994, no one "points" a browser at anything any more.
- thisisblurry 14y agoLook for the good in that post, don't nitpick the phrasing that was chosen.
- MattGrommes 14y agoThank you for being nice and not resorting to snark against the original snark. That said, I tell people to point their browser all the time but maybe that's because I've been using browsers since 1994. :)
- ArbitraryLimits 14y agoThe good in the post is obvious, someone has to stand up for taking out the bad parts too.
- ktizo 14y agoYour stand is fairly unwarranted though. People know what "pointing your browser" means in this context as it is still a commonly used turn of phrase, even though it may date back into the long forgotten antiquity of almost 20 years ago.
- deleted 14y ago[deleted]