Use drones or vacuum cleaners to black out enterprise wireless printers

Use drones or vacuum cleaners to black out enterprise wireless printers

 

 

A drone and a smartphone can intercept data transmitted by wireless printers outside the office building, as demonstrated by a group of iTrust researchers. In addition, the use of a vacuum in the building and a smart phone can also attack enterprise wireless printers.

Use drones to attack wireless printers

Recently, I wrote a blog at the Infosec Institute entitled "Modern Physical security awareness is not just a spam search." In this article, I explained how the concept of physical security evolved with science and technology. In particular, I also analyzed the threats posed by drones. In fact, these devices can easily bypass traditional physical defense systems and attack targets in various ways for different purposes.

A group of researchers from iTrust, a Research Center at the University of Science and Technology Design in Singapore, showed how drones could intercept data transmission from wireless printers outside the office building. The drone carries a smartphone that runs two custom apps. These two apps can intercept wireless traffic from the printer, which usually contains sensitive data. Researchers use a drone equipped with a smartphone to access the company's network and attack internal printers. In a demonstration provided by the researchers, they used a standard drone and a Samsung smartphone from the Chinese company DJI.

 

Attack Process

The researchers used two self-developed applications:

1. Once an open wireless printer is detected, the first application creates a false access point to simulate the printer, and then spoofs a computer inside the wireless network to send sensitive files to it.

2. network security patrols are designed to find open wireless printers and automatically notify the IT department of the organization. This program is designed to improve the security of the target organization. It uses drone access to find insecure printers in the target organization, instead of initiating attacks. It only takes photos of the affected printers, report it to internal staff. In addition, it sends a print job description to guide how to make a specific printer identified by the SSID more secure.

This attack is very concealed and difficult to find. Once the victim's documents are intercepted, it will connect to the victim's Dropbox account through a smart phone and send it to a real printer, in this way, the victim will not notice the attack.

The researchers demonstrated their drone-connected attack technology and explained that drones can easily bypass physical security measures and cover the whole building area. According to researchers, it is difficult for a person to hack into the network using their devices on several floors, but a drone can easily do this.

 

"After purchasing an HP6830 printer, They reversed the protocol used by the printer to communicate with the computer. Then they root the Samsung mobile phone and installed the Debian operating system on it. For apps, they have compiled Python code that simulates HP printers ."

The investigator also used an automatic vacuum to demonstrate the same attack. The blog post published by experts states:

"The researchers also demonstrated the feasibility of this attack in the building by hiding a cell phone in a self-made vacuum and allowing it to continuously automatically scan the network of the Organization, to search for insecure printers connected to the wireless network."

The project, executed by researchers, once again demonstrates the close connection between physical and logical security. Apparently, harmless devices such as vacuum cleaners can also be used to penetrate into the enterprise's network. Therefore, it is time to deal with physical security in a different way.