面向网络打印机的脆弱性分析  

VULNERABILITY ANALYSIS FOR NETWORK PRINTERS

作　　者：王奕森[1] 沈建京[1] 林键[1] 董卫宇[1] Wang Yisen;Shen Jianjing;Lin Jian ;Dong Weiyu(State Key Laboratory of Mathematical Engineering and Advanced Computing, PLA Information Engineering University,Zhengzhou 450001,Henan,China)

机构地区：[1]解放军信息工程大学数学工程与先进计算国家重点实验室,河南郑州450001

出　　处：《计算机应用与软件》2018年第4期303-309,共7页Computer Applications and Software

基　　金：国家自然科学基金项目(61572516)

摘　　要：网络打印机处于网络中的关键节点,是许多敏感信息的处理介质。由于厂商对打印机安全关注度不高、设备固件更新周期长、用户安全意识弱等因素,导致黑客对打印机攻击易于成功。研究网络打印机工作原理及PJL、Post Script、PCL等打印机语言特点,利用打印语言的安全缺陷设计针对网络打印机的脆弱性测试脚本,测试拒绝服务攻击、保护绕过和远程代码执行攻击,设计并实现网络打印机脆弱性分析系统。该系统可以利用测试脚本对目标网络打印机进行攻击进而测试目标的脆弱性。最后利用常见品牌的打印机做实验,验证了系统的有效性。Network printers are the key nodes in the network and are the processing medium for much sensitive information.Due to the lack of security attention,long firmware update cycle and weak of user security awareness,hackers can hack printers easily.We studied the working principle of network printers and PJL,PostScript,PCL and other printer language features.We designed vulnerability testing systems for network printers by designing vulnerability testing scripts for network printers using printing language security flaws,testing denial of service attacks,protection bypassing and remote code execution attacks.The system used the test script to attack the target network printer to test the vulnerability of the target.The system used the common brand printer to verify the validity of the system.

关 键 词：网络打印机 PJL POSTSCRIPT 攻击脚本 拒绝服务攻击 脆弱性 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]