The issue is that since this service binds to 0.0.0.0, which on Linux signifies all IP addresses and interfaces, it additionally discovers printers over the web if the port will not be blocked within the system firewall. How massive is that this drawback? Margaritelli scanned the web for a few weeks for units that listened on UDP 631 and located a whole bunch of 1000’s with peaks of 200-300K concurrent units.

Whereas there are probably a whole bunch of thousands and thousands of Linux units on the web, that quantity won’t appear excessive, nevertheless it’s actually sufficiently big for a really highly effective botnet in the event that they had been to be compromised. Additionally, as attackers have confirmed time and time in the past, getting a foothold inside a community will not be that arduous, and from there this difficulty can probably be exploited for lateral motion.

“Nicely it seems that when you might configure who can and who can’t join by enhancing the /and so on/cups/cups-browsed.conf configuration file… the default configuration file, on just about any system, is totally commented out and easily permits anybody,” the researcher mentioned.