{"id":13498,"date":"2018-10-02T14:19:05","date_gmt":"2018-10-02T22:19:05","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/10\/02\/news-7265\/"},"modified":"2018-10-02T14:19:05","modified_gmt":"2018-10-02T22:19:05","slug":"news-7265","status":"publish","type":"post","link":"https:\/\/www.palada.net\/index.php\/2018\/10\/02\/news-7265\/","title":{"rendered":"SSD Advisory \u2013 Android Printing Man in the Middle Attack"},"content":{"rendered":"

Credit to Author: SSD \/ Ori Nimron| Date: Tue, 02 Oct 2018 10:03:44 +0000<\/strong><\/p>\n

\n
\n

Vulnerabilities Summary<\/strong>
Android 8.1 has introduced the new feature of a default printing service. This service, based on the very similar, freely available Mopria Alliance Print Service on the Google Play Store, suffers from a lack of validation which can lead to both man in the middle attacks and subsequent interception of print jobs, as well as an issue that results in potentially unsafe printing devices to be used without any sort of warning or confirmation.<\/p>\n

Credit<\/strong>
An independent security researcher,\u00a0Matt Parnell, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.<\/p>\n

Affected systems<\/strong>
Android 8.1 Default\u00a0Printing Service<\/p>\n

Vendor Response<\/strong>
“The Android Security Team has conducted an initial severity assessment on this report. Based on our published severity assessment matrix (1) it was rated as not being a security vulnerability that would meet the severity bar for inclusion in an Android security bulletin. If you have additional information that you believe we should use to reassess this report, please let us know.
The Resolution Notes label has been set to NSBC (Not Security Bulletin Class) to reflect this assessment.”
<\/span>
Vulnerability Details<\/strong>
Lets look at the\u00a0New Android 8.1 Default Printing Service:<\/p>\n

\"\"<\/a><\/p>\n

When a user uses the \u201cadd manual printer\u201d feature, such as with an IPP printer, they may assume that the system is context aware. This is however not the case, and so should the device connect to a malicious network, or to a man in the middle network, such as a Pineapple, all that operator has to do is either:
1. Spoof a hostname that is known to be the printer used by the target and provide an IPP compatible service in it\u2019s place
2. Provide an IPP service at the device\u2019s expected IP address.<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

Both of these options will work on ANY connected network, and as such, as long as they have been configured, an attacker can simply be on the same network providing the proper hostname or IP, and intercept print jobs. Of course, in such situations, penetrating the target\u2019s usual network for printing, or using a pineapple in between the target and the network would be the most successful method. That said, Android by default will preselect the last used printer, even if it is not detected\/connected, or connected to the network the printer was added or used on, and as such, careless users are likely to simply select print without even looking. In the test above, we printed using the IPP service here. The only modification was to change it to use the default IPP port 631: https:\/\/github.com\/watson\/ipp-printer<\/p>\n

Any printer will do – As a secondary attack vector, the new print service is nice enough to aggregate a list of available printers using mDNS, which can be poisoned, or an attacker can simply provide one or more realistic virtual printers using the Common Unix Printing System (CUPS). Using names that sound like real printers, or by using devices named such as \u201cHotel Business Center Printer,\u201d an attacker is sure to show up in the selectable list of printers when a user goes to print on their Android 8.1 device. No validation is performed whatsoever, and the user does not have to confirm the use or addition of a given printer before they can print. Fire and forget!<\/p>\n

Below: our fake, autodetected CUPS printers in action<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

In either case, once the fake devices are active, an attacker may either capture the print jobs and leave, or to add an extra level of stealth, actually print the jobs once intercepted so that the target is none the wiser. Imagine the possibilities!<\/p>\n

\"Print<\/a><\/div>\n<\/div><\/div>\n

https:\/\/blogs.securiteam.com\/index.php\/feed<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/p>\n

Credit to Author: SSD \/ Ori Nimron| Date: Tue, 02 Oct 2018 10:03:44 +0000<\/strong><\/p>\n

Vulnerabilities Summary Android 8.1 has introduced the new feature of a default printing service. This service, based on the very similar, freely available Mopria Alliance Print Service on the Google Play Store, suffers from a lack of validation which can lead to both man in the middle attacks and subsequent interception of print jobs, as … Continue reading SSD Advisory \u2013 Android Printing Man in the Middle Attack<\/span><\/a><\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10643,10754],"tags":[10757],"class_list":["post-13498","post","type-post","status-publish","format-standard","hentry","category-independent","category-securiteam","tag-securiteam-secure-disclosure"],"_links":{"self":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/13498","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=13498"}],"version-history":[{"count":0,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/13498\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=13498"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=13498"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=13498"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}