Is A Network Printer Increasing Your PCI Vulnerability?

Written by Walter Conway
February 9th, 2011

A 403 Labs QSA, PCI Columnist Walt Conway has worked in payments and technology for more than 30 years, 10 of them with Visa.

From a purely PCI perspective, network printers pose a network risk if they connect to any in-scope systems. At the least, your PCI penetration testing should identify any multi-function printers or scanners and make sure any usernames and passwords are protected. Such a printer should be treated like a server that contains sensitive data, because that’s exactly what it is.

The problem with these multi-function printers is that—in some cases—they store credentials, including usernames and passwords, in cleartext. That is, this critical information is not securely stored on the device. That means a hacker can access the printer’s address book to extract usernames and passwords. If one of these passwords is for a domain administrator, for example, the hacker can access potentially all other folders, files and servers in that domain. Imagine the cyberthief using these credentials to look at files with names like “payroll backup” or “corporate travel cards,” and you begin to get the picture.

Has anyone ever installed a computer workstation and not connected it to a local or network printer? I doubt that has been the case very often, and it’s likely the connection was made without much thought. But today’s printers do much more than just print; they are multi-function machines that print, fax and scan documents, and then transmit them to addresses stored in their address books. These devices are usually networked (including wireless), and they may have access to the Internet, too. This practice exposes a potentially dangerous attack vector, whereby a hacker can gain access to domain credentials and other systems by compromising your networked printer.

Today’s network printers are essentially full-function servers, lacking security features and with few options for hardening them.

The vulnerabilities I am talking about are not theoretical; they are real. Because I work for a security company, I get to spend time with some pretty smart white hat (i.e., good guy) hackers and penetration testers. One of my colleagues has looked at the most commonly installed printers and identified significant vulnerabilities that could lead to a data compromise.

The risks from networked printers are certainly not new, but the concern is typically centered on the documents stored in the device’s extensive memory and the threat of compromise through physical access to the storage media.

Two things are different here.


4 Comments | Read Is A Network Printer Increasing Your PCI Vulnerability?

  1. jml Says:

    I’m hazy on what’s being discussed here, and don’t seem to find a definitive reference.

    Are you saying that there are domain-aware multifunction devices that cache domain credentials in cleartext, or are you working the angle that all other things considered, people are likely to use their domain credentials in some local store of passwords on the multifunction device?

  2. the other anonymous Says:

    Search youtube for “shmoocon printer pwnd” to a presentation on leveraging weak security controls on printers to gain network access.

  3. Walt Conway Says:

    Thanks for the comments and questions. To jml’s quetion: I was saying that these multi-function devices do indeed store credentials in cleartext, and that sometimes these are domain credentials. Since the devices are frequently open to the Internet this means the device can provide a pathway to compromise other systems.

    To “the other anonymous”: Here are some sources for additional insights. MSNBC picked up the story ( as did Technology Review ( If you want to see the presentation made at Shmoocon, here is a UTube link (

  4. SoftwareDeveloper Says:

    I wouldn’t think the devices would just go out and get the indormation. How about discussing where the information is coming from. Do you think that if a person writes this information on a piece of paper that the same problem exists? I can either copy what I find on the paper or scan it, OMG not its on a multifunction device.

    Do you think I need to shoot my partner because she has access to information that I have secured in my desk?

    This is getting insane.


StorefrontBacktalk delivers the latest retail technology news & analysis. Join more than 60,000 retail IT leaders who subscribe to our free weekly email. Sign up today!

Most Recent Comments

Why Did Gonzales Hackers Like European Cards So Much Better?

I am still unclear about the core point here-- why higher value of European cards. Supply and demand, yes, makes sense. But the fact that the cards were chip and pin (EMV) should make them less valuable because that demonstrably reduces the ability to use them fraudulently. Did the author mean that the chip and pin cards could be used in a country where EMV is not implemented--the US--and this mis-match make it easier to us them since the issuing banks may not have as robust anti-fraud controls as non-EMV banks because they assumed EMV would do the fraud prevention for them Read more...
Two possible reasons that I can think of and have seen in the past - 1) Cards issued by European banks when used online cross border don't usually support AVS checks. So, when a European card is used with a billing address that's in the US, an ecom merchant wouldn't necessarily know that the shipping zip code doesn't match the billing code. 2) Also, in offline chip countries the card determines whether or not a transaction is approved, not the issuer. In my experience, European issuers haven't developed the same checks on authorization requests as US issuers. So, these cards might be more valuable because they are more likely to get approved. Read more...
A smart card slot in terminals doesn't mean there is a reader or that the reader is activated. Then, activated reader or not, the U.S. processors don't have apps certified or ready to load into those terminals to accept and process smart card transactions just yet. Don't get your card(t) before the terminal (horse). Read more...
The marketplace does speak. More fraud capacity translates to higher value for the stolen data. Because nearly 100% of all US transactions are authorized online in real time, we have less fraud regardless of whether the card is Magstripe only or chip and PIn. Hence, $10 prices for US cards vs $25 for the European counterparts. Read more...
@David True. The European cards have both an EMV chip AND a mag stripe. Europeans may generally use the chip for their transactions, but the insecure stripe remains vulnerable to skimming, whether it be from a false front on an ATM or a dishonest waiter with a handheld skimmer. If their stripe is skimmed, the track data can still be cloned and used fraudulently in the United States. If European banks only detect fraud from 9-5 GMT, that might explain why American criminals prefer them over American bank issued cards, who have fraud detection in place 24x7. Read more...

Our apologies. Due to legal and security copyright issues, we can't facilitate the printing of Premium Content. If you absolutely need a hard copy, please contact customer service.