back to article It's 2016 and Windows lets crims poison your printer drivers

Among the Microsoft messes addressed in latest round of Patch Tuesday updates is a real doozy that allows remote attackers to compromise Windows machines thanks to a critical security vulnerability affecting printer drivers. The flaw is found in all desktop Windows since Vista and Windows Server since 2008 and means …

  1. hplasm Silver badge
    Meh

    The headline-

    -is not a surprise...

    1. This post has been deleted by its author

    2. asdf Silver badge

      Re: The headline-

      >means malvertising or malicious or hacked sites could quietly deliver malicious printer drivers.

      Not if you are currently browsing this website with FF in a Solaris VM. Seriously especially IT nerds should be doing most of their web browsing in a VM guest (even a windows vm guest is better than nothing). Its not a panacea to say a determined state actor but it will stop 99.9% of this drive by malware (especially if guest is not the ripe target Windows). With VMs you can still use Windows say for work as your host and have the best of both worlds. Virtual Box for windows for example is free and with its Seamless mode the browser will feel almost like a native app especially if you match up themes.

  2. Anonymous Coward
    Anonymous Coward

    Software contains bugs

    Who'd have thought it?

    1. JassMan Silver badge
      Unhappy

      Re: Software contains bugs

      Yeah but is software which has been round for a very long time and Win10 has supposedly been re-written from the ground up.

      1. oldcoder

        Re: Software contains bugs

        Just because Microsoft keeps saying "rewritten from the ground up" doesn't mean Microsoft is telling the truth.

        It just means the lawyers and PR departments are flapping their lips again.

        1. Ken Hagan Gold badge

          Re: Just because...

          Just because it is obvious that MS are never telling the truth about how totally rewritten each new release is, doesn't mean we shouldn't pan them for it *every* *single* *time* we get *proof* that it isn't true.

      2. Anonymous Coward
        Anonymous Coward

        Re: Software contains bugs

        Win10 has supposedly been re-written from the ground up.

        .. which suggests that printer drivers have been living in the basement ..

        1. Roland6 Silver badge

          Re: Software contains bugs

          Win10 has supposedly been re-written from the ground up.

          Don't know about that, but MS did say that the printer system was 're-imaged' for Windows 8

          https://technet.microsoft.com/en-us/magazine/dn343775.aspx

          So whilst they may have changed the printer driver architecture (from v3 used in W2k-W7 to v4), they did not change the framework within which the drivers were managed.

      3. TheVogon Silver badge

        Re: Software contains bugs

        "Win10 has supposedly been re-written from the ground up."

        Says who? Even Microsoft don't claim that.

        What Microsoft actually said was "This new Windows must be built from the ground-up for a mobile-first, cloud-first world.”

        1. hplasm Silver badge
          Devil

          Re: Software contains bugs

          What Microsoft actually said was "This new Windows must be built from the ground-up for a mobile-first, cloud-first world.”

          Followed by-

          "Ah, sod it. Release!"

      4. adnim Silver badge
        Devil

        Re: Software contains bugs

        .."Win10 has supposedly been re-written from the ground up".

        Wasn't that Vista?

        1. captain veg

          Re: Software contains bugs

          > ."Win10 has supposedly been re-written from the ground up".

          > Wasn't that Vista?

          I never paid much attention to Bisto, but it was certainly part of the spiel for Windows 95.

          Perhaps they meant re-written from the ground up remains of DOS.

          -A.

    2. Roland6 Silver badge

      Re: Software contains bugs

      The flaw is found in all desktop Windows since Vista and Windows Server since 2008

      Suspect the flaw actually goes all the way back to when MS introduced the capability to load printer drivers from print servers, just that versions prior to Vista/2008 are out of support.

      1. boltar

        Re: Software contains bugs

        "Suspect the flaw actually goes all the way back to when MS introduced the capability to load printer drivers from print servers,"

        And what a good idea that turned out to be. Who'd have thought allowing the OS to download unverified code outside user control would be a problem? Well not the geniuses at MS, thats for damn sure.

      2. Anonymous Coward
        Anonymous Coward

        Re: Software contains bugs

        And I was hoping my XP boxes were immune.

      3. John Brown (no body) Silver badge

        Re: Software contains bugs

        "Suspect the flaw actually goes all the way back to when MS introduced the capability to load printer drivers from print servers, just that versions prior to Vista/2008 are out of support."

        What!!?!!?!?? Are you saying my WIndows XP might not be safe now?

  3. Mikel

    Or just uninstall it

    This works for Windows vulnerabilities as well.

  4. oldcoder

    "Organisations should assume the vulnerability will soon be used by criminals."

    That should actually be amended to replace "will soon be" by "has been".

    Do you REALLY think this hasn't already been found a LONG time ago?

  5. MR J

    If this does anything that works, then you know it is not a valid printer driver!

    1. ThomH Silver badge

      Bug filed: file received was less than 600mb, did not announce supply levels in a creepy mechanical voice, did not attempt to redirect me to the manufacturer's website to purchase anything, appeared not to add anything to the system tray, had no effect on computer boot time, indeed did not appear to use my network connection at all. Clearly not a printer driver.

      1. Anonymous Coward
        Anonymous Coward

        Clearly not a printer driver

        Just the embodied proof that "PRINTER DRIVERS ARE ACTUALLY IN P" quietly written by a mathematical genius hermit.

  6. Zippy's Sausage Factory
    Unhappy

    This is deja vu all over again

    ActiveX used to do this until MS realised that was a bad idea. So they did the same with printer drivers, because if you punch yourself once in the face and it hurts, the only sure cure is to punch yourself in the face again, right?

    1. LDS Silver badge

      Re: This is deja vu all over again

      How would you manage printers in a large network? Let user download drivers themselves, and give them permissions to install them? Much more secure, sure...

      The issue is not validating drivers and accepting them only from trusted sources, not deploying them.

  7. Mr Templedene

    I'd uninstall flash in a ... well, erm you know, but I still like to see BBC video :( come on Aunty Beeb, get your finger out.

    Also I have noticed that a lack of flash (it's set to run only on approval) triggers some websites annoying "anti-adblock" blockers.

    1. The Wegie

      I did uninstall Flash...

      And the web/desktop version of Virgin's TV Anywhere service stopped working. Sigh.

    2. Richard 12 Silver badge

      Uninstall Flash anyway

      You uaed to be able to set your Http headers to ask for the mobile site. Not sure if this still works.

      The sooner Auntie sees a drop in usage of their Flash iPlayer, the sooner they'll officially offer an alternative.

  8. Doctor_Wibble
    Trollface

    All absolute rubbish!

    This article puts forward the insane idea that there is such a thing as a standalone printer driver that isn't deeply inextricably entwined within a 600-meg super extra features package that monitors everything I've printed and tells me I should be buying ink from my nearest local supplier who is apparently the other side of the fckn Atlantic.

    A separate printer driver, what planet are you on?

    1. 9Rune5
      Coat

      Re: All absolute rubbish!

      "A separate printer driver, what planet are you on?"

      The planet that sells ink for your printer. Now, will that be 4 ml black for $50, or will you spring for our special package deal 4 ml black+cyan+magenta+lime (we are out of yellow, sorry, but lime should do the trick) for only $250? Now that should be enough ink to print two, maybe three whole post cards! You are welcome.

    2. LDS Silver badge

      Re: All absolute rubbish!

      Many miss that there are - incredibly - some "simplified" printer drivers, often supporting many printers models (after all many of them are no so different), designed exactly for remote deployment across a network. You may not find them for your average "consumer" inkjet printer, but they actually do exist for business-oriented printers, especially those using some common printing language like PCL or the like.

      1. Doctor_Wibble
        Devil

        Re: All absolute rubbish!

        > Many miss that there are - incredibly - some "simplified" printer drivers,

        And I've seen and used them too, but I'm not going to let that get in the way of a good whinge!

        On the other hand trying to convince Windows that you just want to print plain words on a plain bit of paper when for some reason printer model x is actually printer model x version b revision 12 which is incompatible with the only driver available, the one for printer model x version b revision 11 - and which doesn't have a 'just print the bastard thing' function anyway - is always a bit of a fun hobby to have. I blame the USB conspiracy because it wouldn't know otherwise.

        And I'm also painfully aware of 'you get what you pay for', so I'll be getting a USB-serial adapter (because they vanished that too) so I can plug in my ancient epson-compatible dot matrix printer once I exhume it from the garage and recharge the ribbon with some WD40. Possibly also requiring use of a hammer, a circuit board, some pepper, onions, and a small aubergine.

        And then copy it out by hand. If I can find the pencil sharpener.

  9. Stevie Silver badge

    Bah!

    To borrow a phrase from the FOSS community: Found and fixed, where's the problem?

  10. Graham Cunningham

    Win10 fixed this for me

    By not supporting any printer driver for my Canon printer.

    1. Sandtitz Silver badge

      Re: Win10 fixed this for me

      It's actually Canon's job to support their printers. Apart from generic device drivers the drivers (included within Windows or downloaded by Windows Update) are actually made by the device manufacturers.

      Which Canon model was it BTW?

      1. Graham Cunningham

        Re: Win10 fixed this for me

        MP600. I fudged it (for printing, at least) with some effort, but not before being browbeaten by a certain domestic user for having "chosen" to accept the unwanted OS "upgrade", when she then couldn't print or scan anything. Interestingly, I see the MP600 support page on Canon's uk website now seems to offer win10 32- & 64-bit drivers.

        Maybe I should check again and see whether the stupid machine now recognizes my Galaxy S5 too? Maybe too much to ask.

        1. Sandtitz Silver badge

          Re: Win10 fixed this for me

          Funny, I can't see Canon UK offering any Win10 drivers for the model.

          Canon didn't apparently even offer Windows 8 drivers for MP600 (bastards!) but installing the drivers in Win7 compatibility mode should do the trick and allow the Scangear software to install and work. YMMV of course.

          1. Mikel

            Re: Win10 fixed this for me

            No drivers on Canon UK

            They are still working on the British language support.

  11. Howard Hanek Bronze badge
    Happy

    Architecture

    ......resembles a pair of trousers with a trap door 'feature' you don't often see anymore.

    They must be popular in and around Redmond though.

  12. AndrueC Silver badge
    WTF?

    I've always been a little bit annoyed by the need for so many printer drivers. Sure different printers have different features but is it really beyond the wit of Humankind to come up with a generic printing interface? Sure there are a few different printing languages (Post Script, PCL et al.) but if all you want to do is chuck some letters and a few images at a sheet of paper where is the complexity?

    1. ThomH Silver badge

      Agreed — for home users all that's really needed is to query resolution and colour format, then to post an image. There are enough places like the USB forum where such a thing could have been established that I can only assume there's a market reason that each manufacturer wants to spend the money writing and maintaining their own drivers. Do they really gain that much from trying to force their own storefronts upon people, given that they've already put DRM into the ink? I don't think there's still any money in selling the hardware so the convenient obsolescence probably isn't that handy?

      1. John Brown (no body) Silver badge

        "Agreed — for home users all that's really needed is to query resolution and colour format, then to post an image."

        Don't forget all the code required to make sure you aren't printing banknotes ;-)

    2. LDS Silver badge

      Windows has a three generic printer drivers: Universal Printer Driver, PostScript Printer Driver, and Plotter Printer Driver. These can be customized even using "generic printer description" (GPD) files.

      But most printers have specific capabilities that may not be fully accessible without specific drivers - you may probably use a standard PostScript or PCL driver, if you can accept to lose some features (exactly the way the "generic" video driver for your card may be acceptable...).

      The biggest issue are all those printers, and are today many, especially in the consumer and entry level business markets, that expect the PC to do the bulk of image rendering, and accept just some proprietary usually simpler and low-level command set. These needs specific drivers because the printer is mostly a "dumb" device, and most processing happens in the driver.

  13. paulc
    Black Helicopters

    Obviously the TLA agencies have

    something better now for penetrating and owning targets?

  14. EveryTime Silver badge

    And printer "drivers" don't even need to be full device drivers...

    Printer drivers aren't complicated. Or rather they don't need to be complicated. The simple ones take an input document and translate it an output document. They might query the printer capabilities and configuration setting, and load font files. They shouldn't need full access to all parts of the system. In a security-focused OS they should run in an environment far more limited than a user.

    There was an excuse for screwing this up in the 1970s, but many systems got it close to right. Unix LPD was a good effort that was flexible enough to handle a wide variety of printers a decade later. Three decades further on and the worlds largest software company for two of those decades continues to do things that make it clear that getting software right is completely trumped by corporate politics and controlling a market.

    1. Anonymous Coward
      Anonymous Coward

      Re: And printer "drivers" don't even need to be full device drivers...

      That depends on what you mean by a printer "driver". If you include all the colour management, media profiling, etc then that stuff can get complicated - achieving the same results on matt / glossy / photo / cardboard media is fiddly, and may involve maths.

    2. LDS Silver badge

      Re: And printer "drivers" don't even need to be full device drivers...

      Not all code of a "printer driver" is actually a driver, but part of it may need to be a driver to communicate with the hardware and other low-level stuff - in some ways a printer is not much different from a graphic card - both drivers take a "description" of the desired output, and need to translate it into data the display hardware understands.

      Actually, since Vista the printer graphic DLL must be user mode, kernel mode ones are no longer installable. But direct access to some printer data (i.e. ink/toner level) may require direct communication with the hardware. Moreover (cheaper) printers without an on-board print processing engine (i.e. Postscript or PCL) rely on the PC to process and directly pilot the printer with "raw" data.

      LPD is a network protocol, and has nothing to do with printer drivers (Windows supports it as well).

      Who understood the issue years ago was Intel when it designed its x86 processors with four privilege rings instead of the two only used by most of the other processors. The idea was that the core kernel should be running at an higher privilege level than I/O code (i.e kernel at ring 0, I/O at ring 1). Just, because that architecture was specific to Intel, and because of ring transitions performance, nobody used it.

      Anyway, if the kernel didn't check what code is being loaded, it may be safe, but everything above would not.

  15. Dave P 1

    Updates

    So, thanks to the article I knew there were some new, and important, patches. My WIN 7 machine did not know there were new updates, so sent to search for such. After 15 minutes or so it did find 13 new patches. Started the update procedure. After another 15 minutes it finally seemed to get started downloading. Did the patches, and informed me that 12 were not needed. Not believing that rubbish, I re-started the update procedure. Sure enough, those same 12 were installed this time. Not the first time Update has lied to me.

  16. quxinot Bronze badge

    Re: It's 2016 and Windows lets crims poison your printer drivers

    HP - Now a criminal organization.

    Wait, that's not news.

    Oh, there's other bad guys involved? Besides the ones who need a @#%#$%@ 500 megs worth of driver for a frigging printer?!

  17. DavidJB

    Well, at least there's an upside to my printer not working.

  18. %%#root

    Printer hacked to play doom

    Haha remember that printer hacked by Michael Jordan to play doom.

  19. Anonymous Coward
    Anonymous Coward

    The quality of Microsoft patches has worsened after the new CEO had taken over.

    Rampant cost cutting and outsourcing?

    Oh, and lest I forget: Automatic Updates.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019