![]() ![]() Prior research has shown that the design flaws and vulnerabilities presented in this paper are found in other modern embedded systems. To show that firmware update signing is not the panacea of embedded defense, we present an analysis of known vulnerabilities found in third-party libraries in 373 LaserJet firmware images. We show vulnerable population data gathered by continuously tracking all publicly accessible printers discovered through an exhaustive scan of IPv4 space. We present a case study of the HP-RFU (Remote Firmware Update) LaserJet printer firmware modification vulnerability, which allows arbitrary injection of malware into the printer's firmware via standard printed documents. ![]() ![]() We discuss techniques for exploiting such vulnerable functionality and the implementation of a proof of concept printer malware capable of network reconnaissance, data exfiltration and propa-gation to general purpose computers and other embedded device types. We demonstrate how this feature can be exploited to allow attackers to inject ma-licious firmware modifications into vulnerable embedded devices. The ability to update firmware is a feature that is found in nearly all modern embedded systems. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |