SquatConf 2016: How to intercept your boss' print jobs

The code use in this deck can be found here: https://github.com/watson/talks/tree/master/2016/04%20SquatConf/code

Bonjour/Zeroconf is used to automatically configure and connect to networked devices like printers on a LAN and is widely deployed in offices and homes. This talk gives an introduction to the Zeroconf standard and shows how it’s vulnerable to a man-in-the-middle attack.

The talk will show how Zeroconf can be exploited to allow a man-in-the-middle attack on any Zeroconf enabled device. This allows you to intercept anything from print jobs to admin panel passwords.

Transcript

1. Thomas Watson @wa7son github.com/watson
2. Build your own printer in JavaScript … no hardware required!
3. AirPlay
4. AirPlay Bonjour / Zeroconf
5. AirPlay Bonjour / Zeroconf Multicast DNS
6. AirPlay Bonjour / Zeroconf Multicast DNS DNS Service Discovery (DNS-SD)
9. • Print Job • Print URI • Validate Job • Create Job • Get Printer Attributes • Get Jobs • Pause Printer • Resume Printer • Purge Jobs • Send Document • Send URI • Cancel Job • Get Job Attributes • Hold Job • Release Job • Restart Job Printer operations Job operations
10. • Print Job 0x02 • Print URI 0x03 • Validate Job 0x04 • Create Job 0x05 • Get Printer Attributes 0x0b • Get Jobs 0x0a • Pause Printer 0x10 • Resume Printer 0x11 • Purge Jobs 0x12 • Send Document 0x06 • Send URI 0x07 • Cancel Job 0x08 • Get Job Attributes 0x09 • Hold Job 0x0c • Release Job 0x0d • Restart Job 0x0e Printer operations Job operations
22. github.com / watson / ipp-encoder
34. • Print Job 0x02 • Print URI 0x03 • Validate Job 0x04 • Create Job 0x05 • Get Printer Attributes 0x0b • Get Jobs 0x0a • Pause Printer 0x10 • Resume Printer 0x11 • Purge Jobs 0x12 • Send Document 0x06 • Send URI 0x07 • Cancel Job 0x08 • Get Job Attributes 0x09 • Hold Job 0x0c • Release Job 0x0d • Restart Job 0x0e Printer operations Job operations
35. • Print Job 0x02 • Print URI 0x03 • Validate Job 0x04 • Create Job 0x05 • Get Printer Attributes 0x0b • Get Jobs 0x0a • Pause Printer 0x10 • Resume Printer 0x11 • Purge Jobs 0x12 • Send Document 0x06 • Send URI 0x07 • Cancel Job 0x08 • Get Job Attributes 0x09 • Hold Job 0x0c • Release Job 0x0d • Restart Job 0x0e Printer operations Job operations
36. github.com / watson / ipp-printer
37. NCFACP (NSA/CIA/FBI auto censoring printer)
39. printb.in
41. Attack vector: Zeroconf / Bonjour
42. Man in the middle • Attacker: Malicious mDNS announcement • Target: Forced name change • Clients: Update reference to new host/port • Attacker: Intercept and forward all jobs
43. github.com / watson / bcc
44. Thank you! -> Q&A @wa7son github.com / watson github.com / watson / bonjour github.com / watson / ipp-encoder github.com / watson / ipp-printer github.com / watson / printcat github.com / watson / bcc printb.in