Open port issues with Direct Print functionality

[gooberdude]

Hi, I have been fighting with HP call support about the Photosmart 7525 printer.

Originally I setup and had performed all the functions to enable both web support and WIFI.

Within an hour the printer would not respond to wireless communication, though it had its wireless indecator showing it was connected.

I was told by HP support that the issue will be resolved in March, as there will be a firmware update to fix the issue.

Now that I had the printer install the new firmware I still get the issue.

Though I found through some sniffing, that there are a number of ports enabled and open that are over and beyond print requirements.

Funny thing I can send my printer into instant lockup with all lights flashing with a simple UDP ping sniff. I would think I can do this with other new HP printers using Eprint functions. I will find HP web based printers that are open for public printing and test my theory that HP Eprinters are open to hacking and denyal of service attempts.  My Hp print app on andriod list three in my area, and one is at my local Walmart. This would be cool to find this, as I am usually not the first to point such matters out.

I assume some are for Apple devices to print.

Here is my sniffing report:

Starting Nmap 6.40 ( http://nmap.org ) at 2014-03-21 07:57 Central Daylight TimeNSE: Loaded 110 scripts for scanning.NSE: Script Pre-scanning.Initiating ARP Ping Scan at 07:57Scanning 192.168.223.1 [1 port]Completed ARP Ping Scan at 07:57, 0.23s elapsed (1 total hosts)Initiating Parallel DNS resolution of 1 host. at 07:57Completed Parallel DNS resolution of 1 host. at 07:58, 16.50s elapsedInitiating SYN Stealth Scan at 07:58Scanning 192.168.223.1 [1000 ports]Discovered open port 445/tcp on 192.168.223.1Discovered open port 139/tcp on 192.168.223.1Discovered open port 80/tcp on 192.168.223.1Discovered open port 443/tcp on 192.168.223.1Discovered open port 8080/tcp on 192.168.223.1Discovered open port 9220/tcp on 192.168.223.1Discovered open port 6839/tcp on 192.168.223.1Discovered open port 631/tcp on 192.168.223.1Discovered open port 7435/tcp on 192.168.223.1Discovered open port 8089/tcp on 192.168.223.1Discovered open port 9100/tcp on 192.168.223.1Completed SYN Stealth Scan at 07:58, 1.71s elapsed (1000 total ports)Initiating UDP Scan at 07:58Scanning 192.168.223.1 [1000 ports]Discovered open port 5353/udp on 192.168.223.1Completed UDP Scan at 07:58, 1.82s elapsed (1000 total ports)Initiating Service scan at 07:58Scanning 20 services on 192.168.223.1Discovered open port 161/udp on 192.168.223.1Discovered open|filtered port 161/udp on 192.168.223.1 is actually open


Starting Nmap 6.40 ( http://nmap.org ) at 2014-03-21 07:51 Central Daylight TimeNmap scan report for 192.168.223.1Host is up (0.0025s latency).Not shown: 93 closed portsPORT     STATE SERVICE     VERSION80/tcp   open  http        HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)139/tcp  open  tcpwrapped443/tcp  open  ssl/http    HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)445/tcp  open  netbios-ssn631/tcp  open  http        HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)8080/tcp open  http        HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)9100/tcp open  jetdirect?MAC Address: A0:D3:C1:BD:C8:34 (Unknown)Device type: printer|general purposeRunning: HP embedded, Wind River VxWorksOS CPE: cpe:/h:hp:laserjet_cm1415fnw cpe:/h:hp:laserjet_cp1525nw cpe:/h:hp:laserjet_1536dnf cpe:/o:windriver:vxworksOS details: HP LaserJet CM1415fnw, CP1525nw, or 1536dnf printer, VxWorksNetwork Distance: 1 hopService Info: Device: printer; CPE: cpe:/h:hp:photosmart_7520OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 34.11 seconds

[gooberdude]

https://www.youtube.com/watch?v=IDopfwFNIIE

[gooberdude]

OK now I am able to run a full scan on TCP ports without causing a lock up of the printer.

I found that having the printer connect to a router that has been setup to use channel 5, 6 or 7 will cause port scanning issues with the printer.

It is obvious that there are 18 ports that are seen as open, whether they are used or not. Two of which are active but have no service connected to them. Some are just dead like port 25, but over half are active enough to recieve data and lock network connectivity within the printer.

As the firmware states some other laser jets may be affected depending on how the configuration can be set.

I moved my routers channel to channel 1 as it is the only other option I have in a highly congested location. It is not as good as channel 6, but the printer seems to have channel 6 locked in for direct printing.

Here is the latest full scan with UDP enabled, it is the furthest and most complete scan I am able to complete, with UDP ports enabled. The TCP port scan has a bit more and I have placed a simple list below the information given here:

Starting Nmap 6.40 ( http://nmap.org ) at 2014-03-21 13:27 Central Daylight Time

NSE: Loaded 110 scripts for scanning.

NSE: Script Pre-scanning.

Initiating ARP Ping Scan at 13:27

Scanning 192.168.1.211 [1 port]

Completed ARP Ping Scan at 13:27, 0.44s elapsed (1 total hosts)

Initiating Parallel DNS resolution of 1 host. at 13:27

Completed Parallel DNS resolution of 1 host. at 13:27, 0.03s elapsed

Initiating SYN Stealth Scan at 13:27

Scanning 192.168.1.211 [1000 ports]

Discovered open port 443/tcp on 192.168.1.211

Discovered open port 80/tcp on 192.168.1.211

Discovered open port 139/tcp on 192.168.1.211

Discovered open port 8080/tcp on 192.168.1.211

Discovered open port 445/tcp on 192.168.1.211

Discovered open port 631/tcp on 192.168.1.211

Discovered open port 9100/tcp on 192.168.1.211

Discovered open port 7435/tcp on 192.168.1.211

Discovered open port 9220/tcp on 192.168.1.211

Discovered open port 6839/tcp on 192.168.1.211

Completed SYN Stealth Scan at 13:27, 5.25s elapsed (1000 total ports)

Initiating UDP Scan at 13:27

Scanning 192.168.1.211 [1000 ports]

Discovered open port 137/udp on 192.168.1.211

Completed UDP Scan at 13:27, 4.46s elapsed (1000 total ports)

Initiating Service scan at 13:27

Scanning 16 services on 192.168.1.211

Discovered open port 161/udp on 192.168.1.211

Discovered open|filtered port 161/udp on 192.168.1.211 is actually open

Completed Service scan at 13:29, 82.51s elapsed (17 services on 1 host)

Initiating OS detection (try #1) against 192.168.1.211

NSE: Script scanning 192.168.1.211.

Initiating NSE at 13:29

Completed NSE at 13:30, 82.29s elapsed

Nmap scan report for 192.168.1.211

Host is up (0.023s latency).

Not shown: 1983 closed ports

PORT     STATE         SERVICE      VERSION

80/tcp   open          http         HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)

|_http-favicon: Unknown favicon MD5: 76C6E492CB8CC73A2A50D62176F205C9

| http-methods: GET POST PUT DELETE

| Potentially risky methods: PUT DELETE

|_See http://nmap.org/nsedoc/scripts/http-methods.html

|_http-title: Site doesn't have a title (text/html).

139/tcp  open          tcpwrapped

443/tcp  open          ssl/http     HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)

|_http-favicon: Unknown favicon MD5: 76C6E492CB8CC73A2A50D62176F205C9

| http-methods: GET POST PUT DELETE

| Potentially risky methods: PUT DELETE

|_See http://nmap.org/nsedoc/scripts/http-methods.html

|_http-title: Site doesn't have a title (text/html).

| ssl-cert: Subject: commonName=HPPS7525/organizationName=HP/stateOrProvinceName=Washington/countryName=US

| Issuer: commonName=HPPS7525/organizationName=HP/stateOrProvinceName=Washington/countryName=US

| Public Key type: rsa

| Public Key bits: 1024

| Not valid before: 2014-02-25T10:12:24+00:00

| Not valid after:  2034-02-20T10:12:24+00:00

| MD5:   9144 ca3b 557e 09cc aba0 8387 2732 2375

|_SHA-1: a6b2 95c0 b72a 7201 578c 32de 662a e6fe b082 48ca

|_ssl-date: 2014-03-21T13:30:09+00:00; -4h59m12s from local time.

445/tcp  open          netbios-ssn

631/tcp  open          http         HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)

| http-methods: GET POST PUT DELETE

| Potentially risky methods: PUT DELETE

|_See http://nmap.org/nsedoc/scripts/http-methods.html

6839/tcp open          tcpwrapped

7435/tcp open          tcpwrapped

8080/tcp open          http         HP Photosmart 7520 series printer http config (Serial TH3AS711XZ05YZ)

|_http-favicon: Unknown favicon MD5: 76C6E492CB8CC73A2A50D62176F205C9

| http-methods: GET POST PUT DELETE

| Potentially risky methods: PUT DELETE

|_See http://nmap.org/nsedoc/scripts/http-methods.html

|_http-title: Site doesn't have a title (text/html).

9100/tcp open          jetdirect?

9220/tcp open          hp-gsg       HP Generic Scan Gateway 1.0

137/udp  open          netbios-ns   Samba nmbd (workgroup: HPPS7525)

138/udp  open|filtered netbios-dgm

161/udp  open          snmp         SNMPv1 server (public)

| snmp-hh3c-logins:

|_  baseoid: 1.3.6.1.4.1.25506.2.12.1.1.1

| snmp-interfaces:

|   Wifi0

|     IP address: 192.168.1.211  Netmask: 255.255.255.0

|     MAC address: a0:d3:c1:bd:c8:32 (Unknown)

|     Type: ethernetCsmacd  Speed: 10 Mbps

|     Status: up

|_    Traffic stats: 6.16 Mb sent, 3.43 Mb received

| snmp-netstat:

|   TCP  0.0.0.0:7435         0.0.0.0:0

|   TCP  192.168.1.211:56076  15.201.145.52:5222

|   UDP  0.0.0.0:3702         *:*

|   UDP  127.0.0.1:666        *:*

|_  UDP  192.168.223.1:67     *:*

| snmp-sysdescr: HP ETHERNET MULTI-ENVIRONMENT

|_  System uptime: 0 days, 3:34:23.28 (1286328 timeticks)

| snmp-win32-shares:

|_  baseoid: 1.3.6.1.4.1.77.1.2.27

1022/udp open|filtered exp2

1023/udp open|filtered unknown

3702/udp open|filtered ws-discovery

5355/udp open|filtered llmnr

MAC Address: A0:D3:C1:BD:C8:32 (Unknown)

Device type: general purpose

Running: Wind River VxWorks

OS CPE: cpe:/o:windriver:vxworks

OS details: VxWorks

Uptime guess: 0.150 days (since Fri Mar 21 09:55:04 2014)

Network Distance: 1 hop

TCP Sequence Prediction: Difficulty=255 (Good luck!)

IP ID Sequence Generation: Busy server or unknown class

Service Info: Hosts: HPA0D3C1BDC832, HPPS7525; Device: printer; CPE: cpe:/h:hp:photosmart_7520



Host script results:

| nbstat:

|   NetBIOS name: HPA0D3C1BDC832, NetBIOS user: <unknown>, NetBIOS MAC: <unknown>

|   Names

|     HPA0D3C1BDC832<00>   Flags: <unique><active><permanent>

|     MSHOME<00>           Flags: <group><active><permanent>

|     HPA0D3C1BDC832<20>   Flags: <unique><active><permanent>

|     HPPS7525<00>         Flags: <unique><active><permanent>

|_    HPPS7525<20>         Flags: <unique><active><permanent>

| smb-security-mode:

|   Account that was used for smb scripts: guest

|   User-level authentication

|   SMB Security: Challenge/response passwords supported

|_  Message signing disabled (dangerous, but default)



TRACEROUTE

HOP RTT      ADDRESS

1   23.26 ms 192.168.1.211



NSE: Script Post-scanning.

Read data files from: F:\Progs\Nmap

OS and Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .

Nmap done: 1 IP address (1 host up) scanned in 180.90 seconds

           Raw packets sent: 2030 (74.829KB) | Rcvd: 2921 (149.377KB)

+++++++++++++++++++++++++++++++++++++++++++++++++++++===

Full TCP port scan without UDP scanning of all ports, showing up as open... * designates open and active.

192.168.223.1Discovered open port 25/tcp on
*192.168.223.1Discovered open port 80/tcp on
*192.168.223.1Discovered open port 110/tcp on
*192.168.223.1Discovered open port 119/tcp on

*192.168.223.1Discovered open port 139/tcp on
192.168.223.1Discovered open port 143/tcp on

*192.168.223.1Discovered open port 443/tcp on
*192.168.223.1Discovered open port 445/tcp on
192.168.223.1Discovered open port 465/tcp on
192.168.223.1Discovered open port 563/tcp on
192.168.223.1Discovered open port 587/tcp on
*192.168.223.1Discovered open port 631/tcp on
192.168.223.1Discovered open port 993/tcp on
192.168.223.1Discovered open port 995/tcp on

*192.168.223.1Discovered open port 7435/tcp on

*192.168.223.1Discovered open port 6839/tcp on
*192.168.223.1Discovered open port 8080/tcp on

192.168.223.1Discovered open port 8089/tcp on
*192.168.223.1Discovered open port 9100/tcp on

*192.168.223.1Discovered open port 9220/tcp on

[gooberdude]

Here is a copy of what I posted in another issue with the printer...

OK, I dove into connecting to the printer's direct print via laptop. HP really messed up with adding a configureation page to direct print, but it is able for me to show that the printer's firmware is not properly programed.

What I found out as well, is that the printer thinks it is still connected on my WIFI but Eprint is disabled.

Well I am not able to connect to the printer through WIFI, and Eprint does show active on the HP app on my phone.

Also web interface to the Priner only works on the Direct print connection. So looking at what I have, only the Eprint ports are active on the HP printer. All other ports have shut down or some how firewalled at the printer during sleep.

Direct print connection has port 80 active but as for port 9100 and 9200 are not active and  will not print as well.

So I guess the only ports active on wireless, when sleep mode is active is port 80 on direct print connection.

Here is a picture below of Direct print web interface on Direct Print connection.

[gooberdude]

Since HP has not bothered to contact me about this issue, I guess it is not important or they want me to prove that there is an issue.

So today, I will run my port scan on  all 3 businesses that have Public printing  available to see if the printer goes off the network.

Will post my findings when I get back.

This seems to be a critical security risk having open configuration page on Direct Print connection, along with open ports available that are undocumented and can cause printer freeze with all lights flashing.

Redit may find this interesting.