#HITB2012AMS D2T1 - Andrei Costin - PostScript - Danger Ahead - Hacking MFPs, PCs and Beyond

### Overview In this presentation, Andrei Costin explores the security risks associated with PostScript and how it can be weaponized against multi-function printers (MFPs), client PCs, and network infrastructure. Drawing on research conducted between 2010 and 2012, Costin highlights that network printers are inherently trusted, often expose sensitive internal credentials (LDAP, SNMP), and frequently lack robust vulnerability and patch management. Furthermore, thousands of enterprise MFPs were discovered directly exposed to the public internet, creating severe security exposures.

### Key Topics - **Nature of PostScript**: Unlike static document formats, PostScript is a dynamically typed, concatenative, stack-based, and Turing-complete programming language introduced by Adobe. Because it is Turing-complete, general-purpose computation (such as cryptographic cracking or network exploitation) can be implemented directly within print streams. - **Obfuscation and Detection Evasion**: PostScript programs can build and execute code on the fly by concatenating strings and converting them to executable procedures at runtime. As a result, static signature-based security controls (traditional antivirus, IDS/IPS) fail to detect malicious PostScript streams. - **Widespread Interpreter Attack Surface**: Interpreters are embedded across multiple ecosystems—including client software (Ghostscript, Microsoft Office via Access Softek), print servers (CUPS), cloud/web services processing document conversions (including Google services), and embedded print engines from various vendors. - **Exploitation via Environment Detection**: PostScript files can query their environment using operators like `product` (e.g., detecting GPL Ghostscript). Attackers can trigger different behavior depending on execution context, such as displaying a social engineering error on a PC while delivering malicious exploitation routines when processed by an MFP.

### Technical Details - **Client and Denial of Service Attacks**: The speaker demonstrates that a trivial recursive loop or infinite loop in PostScript or Encapsulated PostScript (EPS) can freeze Microsoft Office or crash interpreters, requiring application termination or hardware resets. - **Decompilation of Xerox Firmware Updates**: Analyzing Xerox firmware update files (which were distributed with `.PS` extensions) revealed proprietary PostScript API extensions. These exposed powerful internal features, including VxWorks operating system hooks, QA/debugging hooks, socket controls, and direct memory/RAM interfaces. - **PostScript Memory Dumping**: Costin wrote a memory dumper in PostScript targeting port 9100. Despite web administrative passwords, memory dumping bypassed authentication restrictions entirely. - **Credential and Document Extraction**: Cleartext administrator passwords from HTTP GET requests, Base64-encoded basic authentication headers, private SSL keys, user PINs (such as `pjL SET HOLD KEY`), and full document print streams were recovered directly from RAM because buffers were freed without being cleared. - **Network Reconnaissance and Pivoting**: Printers running discovery protocols (like UPnP) retain local network topology in memory. The dumper extracted IP addresses and software versions of surrounding network devices (e.g., a Linux router running miniupnpd and other network printers). Costin noted that with Turing completeness, BSD-like socket support, and raw RAM access, PostScript payloads can be weaponized to launch exploits against other internal hosts or even spread as a self-propagating worm.

### Takeaways Costin emphasizes that printers and MFPs suffer from severe architectural shortcomings: a lack of privilege separation between print jobs and administrative interfaces, improper memory wiping, and unprotected super-APIs. Because static inspection cannot evaluate dynamic PostScript code, defensive tooling must shift toward dynamic sandboxing environments that trace interpreter operations. Organizations need stronger network segmentation and rigorous embedded security evaluations, while developers must avoid passing sensitive data in URL GET parameters or leaving cryptographic keys and sensitive print jobs uncleared in device memory.