Hello friends, this is the first of two, possibly three (if and when I have time to finish the Windows research) writeups. We will start with targeting GNU/Linux systems with an RCE. As someone who’s
Entirely personal recommendation, take it or leave it: I’ve seen and attacked enough of this codebase to remove any CUPS service, binary and library from any of my systems and never again use a UNIX system to print. I’m also removing every zeroconf / avahi / bonjour listener. You might consider doing the same.
Great advice. It would appear these developers don’t take security seriously.
If your router/firewall is configured to let these broadcasts through you have a problem. If it is working correctly and you have an attacker on your lan? You have already lost.
It depends. If you’re using a laptop and say you take it to university or work then you’re not on your LAN. You’re on someone else’s LAN and they may have no interest in trying to stop these types of attacks via any kind of client isolation or it may be incomplete.
I can imagine it’s a very normal scenario for university students to have CUPS running and available on all networks as they may need to print at their university.
Great advice. It would appear these developers don’t take security seriously.
Mdns is something most people have no idea exists.
Oh, neat, all my devices broadcast all their open ports, services, addresses, hardware and names? Cool!
No.
If your router/firewall is configured to let these broadcasts through you have a problem. If it is working correctly and you have an attacker on your lan? You have already lost.
It depends. If you’re using a laptop and say you take it to university or work then you’re not on your LAN. You’re on someone else’s LAN and they may have no interest in trying to stop these types of attacks via any kind of client isolation or it may be incomplete.
I can imagine it’s a very normal scenario for university students to have CUPS running and available on all networks as they may need to print at their university.
You’ve just described every enterprise who allows Linux in their environment.
Going to rely on security through obscurity instead?
Errr I use mdns all the time…
Someone doesn’t like apple
Nobody likes Apple. They’re just afraid to say they don’t.
They’re standardised zeroconnf protocols. Apple was part of the early development.
Bonjour is the apple implementation for mDNS.
Avahi is the GPL compliant implementation.
mDNS, llmnr (ms developed), have been known for ages to be vulnerable.
https://en.m.wikipedia.org/wiki/Zero-configuration_networking#Standardization
*I don’t like apple
To be vulnerable to what?
https://duckduckgo.com/?q=mdns+vulnerability&t=fpas&ia=web
https://book.hacktricks.xyz/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks
I could similarly link you an internet search for http or tls vulnerability, I fail to see your point