Aaron Weaver has made a discovery the world could probably do without: He's found a way to spam your printer from the Web.
By using a little-known capability found in most Web browsers, Weaver can make a Web page launch a print job on just about any printer on a victim's network. The Web site could print annoying ads on the printer and theoretically issue more dangerous commands, like telling the printer to send a fax, format its hard drive, or download new firmware.
Weaver, a security manager in the financial industry, based in Pottstown, Pennsylvania, described what he calls "cross site printing" in a research paper published Tuesday on the Ha.ckers.org Web site.
For a cross-site printing attack to work, a victim would have to visit either a malicious Web site or a legitimate page that suffers from a cross-site scripting flaw, which is a common type of Web programming error. The hacker would then send JavaScript code to the browser that would guess the location of the victim's printer and send it a print job.
Weaver has launched the attack successfully with both the Internet Explorer and Firefox browsers. Because the attack works only on network printers, a printer plugged directly into a PC would not be vulnerable.
Full report here
Source: www.infoworld.com
No comments:
Post a Comment