Will Spammers resort to cutting down trees?

It’s clear that spammers are quite happy to clog up our bandwidth as spam makes up over 90% of all e-mail sent. However, would they resort to different tactics besides e-mail that could be wasteful of other resources? It’s now possible that spammers could resort to cutting down trees to get their advertisements across. How you ask…?

I recently read an interesting article by Aaron Weaver pointing out an attack vector to send printer spam. At first, it may seem unlikely that spam would be sent via this medium but just consider fax spam that has been received for years. The difference is that faxing and cold calling by phone typically have high costs associated with them whereas the costs of internet based techniques are orders of magnitude less and so can be of huge volume. Aaron describes his Proof of Concept as follows…

By using only JavaScript, an Internet web site can remotely print to an internal network based printer by doing an HTTP Post. The web site initiating the print request can print full text, enter PostScript commands allowing the page to be formatted, and in some cases send faxes. For the attack to succeed the user needs to visit a web site that contains this JavaScript.

For example, a web page could be created in html with a reference to a users local printer which commonly uses a well known port number, which is 9100: < form action=’http://local_printer_address:9100′ …..

The difficulty is that the local printer would need to be identified for every visitor to the page. As pointed out in the article this could be done by sending multiple requests to internal IP addresses (192.x.x.x or 10.x.x.x) or using an applet narrow it down to a specific subnet.

This would allow an attacker to send printer spam to your local printer if an administrator password hadn’t been set up or restrictions on IP addresses it should accept jobs from had not been defined. As the vast majority of printers do not have tight security settings this attack is quite feasible and could result in page upon page of printer spam. Very wasteful of paper but probably not the most major contributor to deforestation just yet!