Akamai finds many systems with exposed CUPS vulnerability [LWN.net]

Akamai released a report pointing out that the recently-reported CUPS vulnerability (original disclosure) could be used to drive distributed denial-of-service (DDoS) attacks as well. Even if an attacker cannot gain remote control over a computer, they can still cause it to fetch a URL of their choice — potentially getting free DDoS amplification.

The Akamai Security Intelligence and Response Team (SIRT) found that more than 198,000 devices are vulnerable to this attack vector and are accessible on the public internet; roughly 34% of those could be used for DDoS abuse (58,000+).

to post comments

Security?

Posted Oct 6, 2024 18:54 UTC (Sun) by clugstj (subscriber, #4020) [Link] (8 responses)

Really, this many people put their print servers on the Internet?

Security?

Posted Oct 6, 2024 20:27 UTC (Sun) by Wol (subscriber, #4433) [Link]

And that's how many households?

The UK has a population of 60M, give or take. Let's call that 30M households. Assuming all those printers are in the UK, that's one per 150 households. That's not many!

And once you start assuming Europe, or America, we're probably looking at one in a thousand. That's peanuts.

Cheers,
Wol

Security?

Posted Oct 6, 2024 20:27 UTC (Sun) by iq-0 (subscriber, #36655) [Link] (1 responses)

I presume many routers that have a builtin print server function.

Security?

Posted Oct 6, 2024 20:56 UTC (Sun) by intelfx (subscriber, #130118) [Link]

> I presume many routers that have a builtin print server function.

I would have hoped that all routers that have a builtin print server function also have a builtin firewall function! :-)

Security?

Posted Oct 6, 2024 21:44 UTC (Sun) by dilinger (subscriber, #2867) [Link] (1 responses)

These aren't necessarily traditional print servers; a large portion of them are probably Linux machines (bare metal and virtual) that just happen to have cupsd installed by default, likely related to dependencies.

You install Debian and choose the gnome desktop during the installer, you're going to get cups-daemon and cups-browsed installed and enabled by default. I suspect it's the same for many other distributions.

Security?

Posted Oct 13, 2024 13:36 UTC (Sun) by mathstuf (subscriber, #69389) [Link]

FWIW, it is only Debian that enables services just because they were installed. I would expect systemd presets to be used instead, but, IIRC, Debian aims to support more than systemd…so that's probably why it isn't used.

Security?

Posted Oct 6, 2024 21:45 UTC (Sun) by iabervon (subscriber, #722) [Link]

The vulnerability is about attackers advertising supposed printers to devices that might want to know about a printer, not a flaw in devices that offer printing capability to other devices. I think article is probably about IoT devices that mostly don't even ever print anything, but share a base firmware image with a device that could usefully print something to the owner's printer.

Security?

Posted Oct 7, 2024 6:42 UTC (Mon) by epa (subscriber, #39769) [Link]

Yes, apparently they do. Knowingly or otherwise. Which is why it’s foolish to downplay vulnerabilities by saying they’re exposed only over the local network.

Security?

Posted Oct 7, 2024 9:19 UTC (Mon) by Heretic_Blacksheep (guest, #169992) [Link]

Tyranny of the default. Some Linux distros never got the word to limit exposure by default, even on versions it can be reasonably assumed the administration should know what they're doing enough to turn on services necessary for the environment.

Yet we still have a lot of administrators that don't care, aren't qualified to manage Linux servers (all OSes are the same right? at least according to management & HR), or just don't have the time to properly secure them.

Akamai vs Linode

Posted Oct 7, 2024 1:57 UTC (Mon) by LWN-net23 (subscriber, #164757) [Link] (2 responses)

I wonder how many are Akamai VM's as apposed to Linode nodes (which is now Akamai)

Akamai vs Linode

Posted Oct 7, 2024 5:34 UTC (Mon) by willy (subscriber, #9762) [Link] (1 responses)

You should probably read the article. They didn't specifically scan their network; they scanned public IPs. These are just random machines with bad firewalls.

Akamai vs Linode

Posted Oct 7, 2024 13:21 UTC (Mon) by raven667 (subscriber, #5198) [Link]

Out of the billions of machines connected to the Internet, a few hundred thousand with any kind of misconfigured or poorly firewalled service is probably normal. Listening for IPP service-advertising broadcasts packets is one of the things which makes printing from Linux, Mac, Chrome, Android, tolerable. If you have a PCL or PostScript compatible printer broadcasting its IPP service then it _just_ _works_ automagically from everything, except Windows clients which need manual configuration.

The cups-browsed service isn't bad, but it really should only be exposed to local trusted networks and that's where something like firewalld can help track security zones and insert appropriate rules for the network your mobile device is connecting to. Linux has perfectly decent built-in packet filtering that is robust enough to connect directly to the public Internet, but some people don't know when their security filtering is turned off and some mistakenly believe that "Linux is secure" and that means they don't need to take appropriate precautions, which is false, and somethings are just incompetently designed IoT that only exist to part people from their money and do not demonstrate engineering excellence.

That's the real problem

Posted Oct 7, 2024 15:06 UTC (Mon) by wtarreau (subscriber, #51152) [Link]

For me from the initial release of the vulnerability, the main problem was definitely the fact that anyone could ask such devices to fetch a URL from anywhere on the net. The reporter initially mentioned finding something like 300k exposed devices which would fetch from his server (which is how he counted them). That's a serious concern for the internet's health that there are so many distros installed with everything turned on and connected to the net.