Plugin Spotlight: Samsung/Dell Printer Firmware SNMP Backdoor

Samsung Printers Contain an SNMP Backdoor

Samsung is not the most well-known printer manufacturer in the world (although they hold 28.5% of the consumer TV market). However, they manufacture a full line of printers and multi-function devices for both home and business use. Samsung also manufactures "some" printers for Dell, though an official list is currently unknown.

On November 28, 2012, US-CERT issued an advisory warning that select Samsung/Dell printers contained a hardcoded backdoor that could be accessed via SNMP. There are a lot of interesting facts surrounding this vulnerability, including:

• The backdoor SNMP service listens on a non-standard UDP port 1118
• The password for the backdoor is "s!a@m#n$p%c" and allows both SNMP reads and writes. This allows an attacker to change the configuration settings, including resetting the username/password to the device to gain full administrative access
• Researchers report firmware dating back to 2004 contains this same password for the SNMP community string
• If SNMP is disabled on the printer, it does not remove the SNMP backdoor on port 1118
• Before the vulnerability went public, Samsung pulled all the printer firmware from their download sites
• Dell printer firmware remains on Dell's website for download.

Samsung has stated that models released after October 31, 2012, are not affected by this vulnerability. However, a full list of vulnerable printer models and firmware revisions has yet to be published.

The Tenable plugin-writing team has pushed a new plugin into the Nessus feed, Samsung / Dell Printer SNMP Backdoor (plugin id 63136). This plugin allows you to scan your network for vulnerable Samsung/Dell printers, a handy tool since the vendor in this case is not specifying which devices and firmware contain the backdoor! Below is the plugin output:

Click above for larger image.

Note: You must configure your Nessus scan policy to scan printers. When creating the policy, be certain to go to "Preferences" -> "Do not scan fragile devices" and check the box labeled "Scan Network Printers."

This allows you to discover the vulnerable printers and multi-function devices on your network, even without a full list of vulnerable models from Samsung. To further enhance detection of this vulnerability, Passive Vulnerability Scanner (PVS) customers can utilize PVS plugin 6639, Samsung / Dell Printer SNMP Backdoor. Passively sniffing for this vulnerability allows you to detect vulnerable printers that may have slipped through the cracks of your active scanning (e.g., the printers were offline during the scan or blocked by a firewall).