Cross-site printing - Revision history

Admin at 12:00, 24 March 2017

2017-03-24T12:00:20Z

Admin at 11:11, 24 March 2017

2017-03-24T11:11:21Z

Admin at 11:08, 24 March 2017

2017-03-24T11:08:49Z

Admin: /* Proof-of-concept */

2017-03-24T11:08:28Z

‎Proof-of-concept

Admin: Added port numbers

2017-02-24T15:47:32Z

Added port numbers

84.153.135.37: /* Proof-of-concept */

2017-01-31T08:33:14Z

‎Proof-of-concept

134.147.202.176 at 13:01, 30 January 2017

2017-01-30T13:01:33Z

Admin at 17:26, 28 January 2017

2017-01-28T17:26:42Z

Admin at 17:25, 28 January 2017

2017-01-28T17:25:54Z

Admin at 16:47, 28 January 2017

2017-01-28T16:47:54Z

@@ Line 72: / Line 72: @@
 A proof-of-concept implementation demonstrating that advanced cross-site printing attacks are practical and a real-world threat to companies and institutions is available at [http://hacking-printers.net/xsp/ hacking-printers.net/xsp/]. It was successfully tested on Firefox 48, Chrome 52, Opera 39 and Internet Explorer 10. It is worth noting that the [https://torproject.org/projects/torbrowser.html.en Tor Browser] blocks the attack because it tries to connect to all addresses – including local ones – through the Tor network meaning XSP requests never reach the intranet printer.
-<span style="color:red">Update: To prevent cross-site printing, port 9100/tcp may be blocked in future releases of Firefox <ref>''[https://bugzilla.mozilla.org/show_bug.cgi?id=1335688 Bug 1335688 - Cross-Site Printing (XSP) and CORS Spoofing]'', Bugzilla@Mozilla, 2017</ref> and Chrome <ref>''[https://bugs.chromium.org/p/chromium/issues/detail?id=687530 Issue 687530 - Security: Cross-Site Printing (XSP) and CORS Spoofing]'', Chromium Bug Tracker, 2017</ref>.</span>
+<span style="color:red">Update: To prevent cross-site printing, port 9100/tcp may be blocked in future releases of Firefox <ref>''[https://bugzilla.mozilla.org/show_bug.cgi?id=1335688 Bug 1335688 - Cross-Site Printing (XSP) and CORS Spoofing]'', Bugzilla@Mozilla</ref> and Chrome <ref>''[https://bugs.chromium.org/p/chromium/issues/detail?id=687530 Issue 687530 - Security: Cross-Site Printing (XSP) and CORS Spoofing]'', Chromium Bug Tracker</ref>.</span>
 → ''Related articles:'' [[Fundamentals#High-level_overview|Fundamentals]], [[Attack carriers]], [[Port 9100 printing]], [[BeEF]]

@@ Line 72: / Line 72: @@
 A proof-of-concept implementation demonstrating that advanced cross-site printing attacks are practical and a real-world threat to companies and institutions is available at [http://hacking-printers.net/xsp/ hacking-printers.net/xsp/]. It was successfully tested on Firefox 48, Chrome 52, Opera 39 and Internet Explorer 10. It is worth noting that the [https://torproject.org/projects/torbrowser.html.en Tor Browser] blocks the attack because it tries to connect to all addresses – including local ones – through the Tor network meaning XSP requests never reach the intranet printer.
-<span style="color:red">Update: To prevent cross-site printing, port 9100/tcp may be blocked in future releases of Firefox <ref>''[https://bugzilla.mozilla.org/show_bug.cgi?id=1335688 Bug 1335688 - Cross-Site Printing (XSP) and CORS Bugzilla@Mozilla, 2017</ref> and Chrome <ref>''[https://bugs.chromium.org/p/chromium/issues/detail?id=687530 Issue 687530 - Security: Cross-Site Printing (XSP) and CORS Spoofing]'', Chromium Bug Tracker, 2017</ref>.</span>
+<span style="color:red">Update: To prevent cross-site printing, port 9100/tcp may be blocked in future releases of Firefox <ref>''[https://bugzilla.mozilla.org/show_bug.cgi?id=1335688 Bug 1335688 - Cross-Site Printing (XSP) and CORS Spoofing]'', Bugzilla@Mozilla, 2017</ref> and Chrome <ref>''[https://bugs.chromium.org/p/chromium/issues/detail?id=687530 Issue 687530 - Security: Cross-Site Printing (XSP) and CORS Spoofing]'', Chromium Bug Tracker, 2017</ref>.</span>
 → ''Related articles:'' [[Fundamentals#High-level_overview|Fundamentals]], [[Attack carriers]], [[Port 9100 printing]], [[BeEF]]

@@ Line 70: / Line 70: @@
 == Proof-of-concept ==
-A proof-of-concept implementation demonstrating that advanced cross-site printing attacks are practical and a real-world threat to companies and institutions is available at [http://hacking-printers.net/xsp/ hacking-printers.net/xsp/]. It was successfully tested on Firefox 48, Chrome 52, Opera 39 and Internet Explorer 10. It is worth noting that the [https://torproject.org/projects/torbrowser.html.en Tor Browser] blocks the attack because it tries to connect to all addresses – including local ones – through the Tor network meaning XSP requests never reach the intranet printer. <span style="color:red">Update: To prevent cross-site printing, port 9100/tcp may be blocked in future releases of Firefox <ref>''[https://bugzilla.mozilla.org/show_bug.cgi?id=1335688 Bug 1335688 - Cross-Site Printing (XSP) and CORS Bugzilla@Mozilla, 2017</ref> and Chrome <ref>''[https://bugs.chromium.org/p/chromium/issues/detail?id=687530 Issue 687530 - Security: Cross-Site Printing (XSP) and CORS Spoofing]'', Chromium Bug Tracker, 2017</ref>.</span>
+A proof-of-concept implementation demonstrating that advanced cross-site printing attacks are practical and a real-world threat to companies and institutions is available at [http://hacking-printers.net/xsp/ hacking-printers.net/xsp/]. It was successfully tested on Firefox 48, Chrome 52, Opera 39 and Internet Explorer 10. It is worth noting that the [https://torproject.org/projects/torbrowser.html.en Tor Browser] blocks the attack because it tries to connect to all addresses – including local ones – through the Tor network meaning XSP requests never reach the intranet printer.
 → ''Related articles:'' [[Fundamentals#High-level_overview|Fundamentals]], [[Attack carriers]], [[Port 9100 printing]], [[BeEF]]

@@ Line 70: / Line 70: @@
 == Proof-of-concept ==
-A proof-of-concept implementation demonstrating that advanced cross-site printing attacks are practical and a real-world threat to companies and institutions is available at [http://hacking-printers.net/xsp/ hacking-printers.net/xsp/]. It was successfully tested on Firefox 48, Chrome 52, Opera 39 and Internet Explorer 10. It is worth noting that the [https://torproject.org/projects/torbrowser.html.en Tor Browser] blocks the attack because it tries to connect to all addresses – including local ones – through the Tor network meaning XSP requests never reach the intranet printer.
+A proof-of-concept implementation demonstrating that advanced cross-site printing attacks are practical and a real-world threat to companies and institutions is available at [http://hacking-printers.net/xsp/ hacking-printers.net/xsp/]. It was successfully tested on Firefox 48, Chrome 52, Opera 39 and Internet Explorer 10. It is worth noting that the [https://torproject.org/projects/torbrowser.html.en Tor Browser] blocks the attack because it tries to connect to all addresses – including local ones – through the Tor network meaning XSP requests never reach the intranet printer. <span style="color:red">Update: To prevent cross-site printing, port 9100/tcp may be blocked in future releases of Firefox <ref>''[https://bugzilla.mozilla.org/show_bug.cgi?id=1335688 Bug 1335688 - Cross-Site Printing (XSP) and CORS Bugzilla@Mozilla, 2017</ref> and Chrome <ref>''[https://bugs.chromium.org/p/chromium/issues/detail?id=687530 Issue 687530 - Security: Cross-Site Printing (XSP) and CORS Spoofing]'', Chromium Bug Tracker, 2017</ref>.</span>
 → ''Related articles:'' [[Fundamentals#High-level_overview|Fundamentals]], [[Attack carriers]], [[Port 9100 printing]], [[BeEF]]

@@ Line 50: / Line 50: @@
 {| class="wikitable" style="text-align:center"
 |-
-! Channel !! No Feedback !! Unsolicited printouts !! Standardized !! Blocked by
+! Channel !! Port   !! No Feedback !! Unsolicited printouts !! Standardized !! Blocked by
 |-
-| Raw    || -           || ✔                     || ✔            || -
+| Raw    || 9100    || -           || ✔                     || ✔            || -
 |-
-| Web    || ✔           || -                     || -            || -
+| Web    || 80      || ✔           || -                     || -            || -
 |-
-| IPP    || ✔           || -                     || ✔            || -
+| IPP    || 631     || ✔           || -                     || ✔            || -
 |-
-| LPD    || ✔           || -                     || ✔
+| LPD    || 515     || ✔           || -                     || ✔
 | style="text-align:left;" | FF, Ch, Op
 |-
-| FTP    || ✔           || -                     || ✔
+| FTP    || 21      || ✔           || -                     || ✔
 | style="text-align:left;" | FF, Ch, Op, IE
 |-

← Older revision		Revision as of 13:01, 30 January 2017
Line 6:		Line 6:
	== Enhanced cross-site printing ==		== Enhanced cross-site printing ==

−	Instead of Iframes, we use XMLHttpRequest (XHR) JavaScript objects as defined in <ref>''[https://www.w3.org/TR/XMLHttpRequest/ The XMLHttpRequest Object]'', A. van Kesteren and D. Jackson, W3C, Working Draft, 2007</ref> to perform HTTP POST requests to internal printers. A limitation of the cross-site printing approach discussed so far is that data can only be send to the device, not received because of the same-origin policy <ref>''[https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy The Same Origin Policy]'', J. Ruderman, 2001</ref>. This opts out all information disclosure attacks. To bend the restrictions of the same-origin policy, cross-origin resource sharing (CORS) <ref>''[https://www.w3.org/TR/cors/ Cross-Origin Resource Sharing]'', A. van Kesteren and others, W3C, Working Draft, 2010</ref> can be used – if the web server explicitly allows it by sending a special HTTP header field. In the scenario of cross-site printing, however, we have full control of what the requested ‘web server’ – which actually is a printer [https://en.wikipedia.org/wiki/Raster_image_processor RIP] accessed over port 9100/tcp – sends back to the browser. By using PostScript output commands we can simply emulate an HTTP server running on port 9100/tcp and define our own HTTP header to be responded – including arbitrary CORS <code>Access-Control-Allow-Origin</code> fields which instruct the web browser to allow JavaScript access to this resource and therefore punch a ~~whole~~ into the same-origin policy. A schematic overview of the attack is given below:	+	Instead of Iframes, we use XMLHttpRequest (XHR) JavaScript objects as defined in <ref>''[https://www.w3.org/TR/XMLHttpRequest/ The XMLHttpRequest Object]'', A. van Kesteren and D. Jackson, W3C, Working Draft, 2007</ref> to perform HTTP POST requests to internal printers. A limitation of the cross-site printing approach discussed so far is that data can only be send to the device, not received because of the same-origin policy <ref>''[https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy The Same Origin Policy]'', J. Ruderman, 2001</ref>. This opts out all information disclosure attacks. To bend the restrictions of the same-origin policy, cross-origin resource sharing (CORS) <ref>''[https://www.w3.org/TR/cors/ Cross-Origin Resource Sharing]'', A. van Kesteren and others, W3C, Working Draft, 2010</ref> can be used – if the web server explicitly allows it by sending a special HTTP header field. In the scenario of cross-site printing, however, we have full control of what the requested ‘web server’ – which actually is a printer [https://en.wikipedia.org/wiki/Raster_image_processor RIP] accessed over port 9100/tcp – sends back to the browser. By using PostScript output commands we can simply emulate an HTTP server running on port 9100/tcp and define our own HTTP header to be responded – including arbitrary CORS <code>Access-Control-Allow-Origin</code> fields which instruct the web browser to allow JavaScript access to this resource and therefore punch a hole into the same-origin policy. A schematic overview of the attack is given below:

@@ Line 51: / Line 51: @@
 |+ Comparison of cross-site printing channels
 |-
-! Method !! No Feedback !! Unsolicited printouts !! Standardized !! Blocked by
+! Channel !! No Feedback !! Unsolicited printouts !! Standardized !! Blocked by
 |-
-| Raw    ||             || ✔                     || ✔            ||
+| Raw    || -           || ✔                     || ✔            || -
 |-
-| Web    || ✔           ||                       ||              ||
+| Web    || ✔           || -                     || -            || -
 |-
-| IPP    || ✔           ||                       || ✔            ||
+| IPP    || ✔           || -                     || ✔            || -
 |-
-| LPD    || ✔           ||                       || ✔            || FF, Ch, Op
+| LPD    || ✔           || -                     || ✔
 |-
-| FTP    || ✔           ||                       || ✔            || FF, Ch, Op, IE
+| FTP    || ✔           || -                     || ✔
 |-
 |}

@@ Line 71: / Line 71: @@
 A proof-of-concept implementation demonstrating that advanced cross-site printing attacks are practical and a real-world threat to companies and institutions is available at [http://hacking-printers.net/xsp/ hacking-printers.net/xsp/]. It was successfully tested on Firefox 48, Chrome 52, Opera 39 and Internet Explorer 10. It is worth noting that the [https://torproject.org/projects/torbrowser.html.en Tor Browser] blocks the attack because it tries to connect to all addresses – including local ones – through the Tor network meaning XSP requests never reach the intranet printer.
-→ ''Related aricles:'' [[Fundamentals#High-level_overview|Fundamentals]], [[Attack carriers]], [[Port 9100 printing]]
+→ ''Related aricles:'' [[Fundamentals#High-level_overview|Fundamentals]], [[Attack carriers]], [[Port 9100 printing]], [[BeEF]]
 ----