Plunder, Pillage and Print presented at Notacon 2014

by Deral Heiland, Peter Arzamendi,

Summary : In this presentation I will go beyond the common printer issues and focus around penetration testing of internal networks by focusing on embedded devices such as multifunction printer (MFP). Discussing methods and techniques regularly used to plunder and pillage these devices for user credentials. Methods including authentication bypass, information leakage flaws, firmware attacks, and poorly designed security. By leveraging these methods and techniques I will discuss how we have successful gained access into core systems including email servers, file servers and Active directory domains on multiple occasions. Besides the manual methods and techniques a pentester can use to gather user credentials, I will also be discussing leveraging the open source tool Praeda for automated data harvesting. In conclusion I will also be discussing best practices for reducing risk while still effectively leveraging MFP devices within a business environment.

Deral Heiland: CISSP, Responsible for security assessment and consulting for corporations and government agencies. In addition, Deral is co-founder and President of Ohio Information Security a 501c3. Deral has worked in IT for 18+ years, 8 of those years in security.