Cross Site Printing: Now Printer Spamming

Aaron Weaver has found a way to spam printers on a local network. The vulnerability is called Cross Site Printing. Now just be careful while visiting web sites, because whenever you visit a malicious web site, it may try to connect to a printer on your local network without your knowledge and start sending data, meaning you've been spammed on your printer in a similar way you get spam on your fax. An excerpt from Aaron' paper:

By using only JavaScript, an Internet web site can remotely print to an internal network based printer by doing an HTTP Post. The web site initiating the print request can print full text, enter PostScript commands allowing the page to be formatted, and in some cases send faxes. For the attack to succeed the user needs to visit a web site that contains this JavaScript.

Many network printers listen on port 9100 for a print job (RAW Printing or Direct IP printing). You can telnet directly to the printer port and enter text. Once you disconnect from the printer it will print out the text that you send it. Network printers also accept PostScript, and Printer Control language. The security around this is usually minimal – connect to the port, send the print job, disconnect and the printer prints the page.

We have yet to see how much damage can be done with this vulnerability. So, get ready for even more spam in 2008!