Foofus.Net Security Stuff

While examining a Lexmark X656de multifunction printer awhile back I was pleased to “NOT” find any of the common information leakage vulns like passwords within the html source that you typically find on these type of devices. Which was a good sign. Although with a little more testing it was quickly found that the export setting feature was a total fail. Once I exported the system setting (settingfile.ucf) using the export function, it revealed the plain test password for the SMTP settings .

For the latest advisory on this click here

At Defcon 19 during my presentation we discussed a new attack method against printers. This attack method involved tricking the printer into passing LDAP or SMB credential back to attacker in plain text. We refer to this attack as a Pass-Back-Attack . So its been awhile, but we wanted to release a short tutorial discussing how this attack is performed. A PDF of the Tutorial can be downloaded from here

Ok now that we have showed you how to bypass authentication on a Toshiba eStudio MFP device. The next obvious step is what data can be extracted. Well it turns out that the Toshiba eStudio multifunction printers also leaks data. If you examine the HTML source code of any of the configuration pages you will find the passwords in plan text. Yes that ******* in the password configuration setting field is not really hiding anything.

For Latest Advisory click here

PercX will being speaking on printers, and embedded device information gathering attacks. Covering how the information is leveraged to gain access to other core network server systems. Also will be discussing the tool Praeda and its features, functions, and future. So join PercX at BSides Delaware. Registration is available here and schedule information is available here. Follow PercX on twitter at @Percent_X

Wow this one was so simple I still cant stop laughing. This was originally released at Shmoocon on January 29 2011 Thought it was time to follow up with an advisory because most end users still do not know about this vulnerability. The authentication on Toshiba eStudio MFP devices is easily bypassed by adding an extra / in the URL after TopAccess.

Example:
http://IP Address/TopAccess//Administrator/Setup/ScanToFile/List.htm

For Latest Advisory click here

Really easy as you can see. Iam looking for assistance to better map out devices with this issue. If you have a Toshiba eStudio please check out the request at http://praeda.foofus.net to give me a hand.

PercX will be presenting more printer hacking at the Bangalore, India security conference  Securitybyte on September 6th. This will coincide with an updated release of PRAEDA that will contain several new modules to test for default authentication credentials and information leakage on embedded network appliances.

Congratulations to our own percX for winning the moustache category at the Defcon Beard & Moustache Championship. Sunglasses and Fu Manchu FTW!
 

The latest release of Praeda is now available. This release coincides with percX’s Defcon talk and is updated with new modules and bug fixes. You can grab the latest version here.

A PDF copy of the Defcon presentation slides can be downloaded from HERE.

A quick post to let y’all know that both PercX and Foofus have speaking slots at this year’s Defcon. PercX will be speaking on Friday at 12:00. Foofus will be speaking at 18:30 on Saturday. Naturally, check your Defcon program to verify these times.

I discovered a single XSS finding, with the ability to pop-up only a numeric value. I was able to see that my variable was getting included inside of some javascript in the returned page. I started adding more commands with a semi-colon at the end and low and behold they worked! As long as I didn’t use a ‘>’ character and trigger the .NET validation routines. It’s interesting because you can inject just about any javascript you want, and that leaves a lot of room for client-side mischief like false web sites to harvest passwords, etc.

For the latest advisory Click Here