Secure by Default Initiative

Transcription

1 Technical Whitepaper Secure by Default Initiative Device Settings and Features Table f cntents Overview 2 Changes t Device Security Settings Defaults 2 SNMP v1/v2 write access disabled 2 Printer Jb Language (PJL) / Pstscript (PS) Drive Access 3 PJL Device Access Cmmands 3 TLS Ciphersuites 4 New FutureSmart 4 Security Features 5 HP Cnnectin Inspectr 5 Crss-Site Request Frgery Prtectin 5 Administratr Passwrd Cmplexity and Minimum Length 6 Accunt Lckut 6 New Device Security Settings & Firmware Upgrade Behavir 6 Settings Defaults 7 Appendix A Print Slutin and Fleet Tl Impacts 8 Appendix B Web Jetadmin SNMP Cnfiguratin fr FutureSmart Appendix C PJL Device Access Cmmands 11 References 11 December 2017 Public Versin 1.2

2 Overview This dcument lists the security settings changes fr the Secure by Default initiative beginning in Fall f The fllwing settings are affected by the initiative: (default settings changes) SNMP v1/v2 defaults File System Access thrugh PJL and Pstscript PJL Device Access Cmmands Ciphersuites cntaining RC4 and Triple DES (CBC3, 3DES) The fllwing new security features are enabled by default: Crss-Site Request Frgery (CSRF) preventin HP Cnnectin Inspectr (Netwrk Behaviral Anmaly Detectin) Changes t Device Security Settings Defaults SNMP v1/v2 write access disabled Simple Netwrk Management SNMP versin 1 & 2 (v1/v2) is a legacy cnfiguratin prtcl intrduced in SNMP v1/v2 is nt cnsidered a secure cnfiguratin prtcl fr the fllwing reasns: SNMP v1/v2 cmmunicatins are sent in the clear thrugh the netwrk. Encryptin is nt available fr v1/v2 cnnectins. SNMPv3 prvides encryptin capabilities. SNMP v1/v2 is secured with a cmmunity name passwrd string. The Set cmmunity name is als sent in the clear due t lack f encryptin. SNMP supprts cnfiguratin OIDs frm the management Managed Infrmatin Database (MIB) structure. All cnfiguratin settings available in the management MIB can be set r changed using SNMP SET cmmands. Even when a SET cmmunity name is cnfigured and required fr write peratins, it can be captured frm the unencrypted SNMP data streams. New Default: The Secure by Default initiative disables the SNMPv1/v2 write capabilities and enables the device setting Enable SNMPv1/v2 read-nly access. This disables SNMPv1/v2 Sets (writes) while allwing SNMPv1/v2 Gets (reads). The Get Cmmunity Name is used if cnfigured. 2

3 EWS Setting Cnfiguratin Path: Netwrking Tab -> Management Prtcls menu -> SNMP page Figure 1: SNMP v1/v2 settings in the Embedded Web Server (EWS) Nte: Printer drivers, Fleet management tls and printing device slutins that require SNMNP access t query the device fr print capabilities are nt affected by disabling the SNMPv1/v2 write access, requiring nly read access. Nte: See the Appendix A Print Slutin and Fleet tl Impacts sectin fr effects n device slutins and fleet management tls. Printer Jb Language (PJL) / Pstscript (PS) Drive Access The PJL and Pstscript print languages supprt cmmands prviding access t the device mass strage device; typically a HDD. This access is cmmnly used t install nbard printing slutins and specialized fnts. New Default: The Secure by Default initiative disables the Enable PJL Drive Access and Enable PS Drive Access settings. EWS Setting Cnfiguratin Path: Security Tab ->General Security Menu Figure 2: File System Access Settings in the Embedded Web Server (EWS) Nte: See the Appendix A Print Slutin and Fleet tl Impacts sectin fr effects n device slutins and fleet management tls. PJL Device Access Cmmands The Enable PJL Device Access Cmmands setting enables PJL management cmmand structures ver the PJL prtcl. This includes changing the printing device cntrl panel messages, changing printer default settings and sending SNMP cmmands ver PJL. 3

4 Nte: See Appendix B fr additinal infrmatin regarding PJL management cmmands. New Default: The Secure by Default initiative disables the Enable PJL Device Access Cmmands setting. EWS Setting Cnfiguratin Path: Security Tab -> General Security Menu Figure 3: PJL Device Access Cmmand in the Embedded Web Server (EWS) This setting may need t be temprary re-enabled t allw PJL scripting fr installatin and management. Nte: See the Appendix A Print Slutin and Fleet tl Impacts sectin fr effects n device slutins and fleet management tls. TLS Ciphersuites The RC4, DES and 3DES prtcls have knwn vulnerabilities and are n lnger recmmended fr HTTPS encryptin. RC4 (Rivest Cipher 4) was designed in 1987 and 3DES was apprved in New Default: The RC4 and 3DES (DES-CBC3-SHA) based cipher suites are disabled as in the Secure by Default security prfile. EWS Setting Cnfiguratin Path: Security Tab -> Secure Cmmunicatin menu Figure 4: HTTPS Ciphersuite Selectin in the Embedded Web Server (EWS) Nte: These prtcls may be needed fr Windws XP, Windws Server 2003 and Internet Explrer 8 legacy installatins. 4

5 New FutureSmart 4 Security Features The FutureSmart 4.5 FutureSmart bundle includes several new security features. All new security features are enabled by default when intrduced t ensure the mst secure printing device state. These features may include a cnfiguratin setting t be disabled fr specific netwrking envirnments. HP Cnnectin Inspectr HP Cnnectin Inspectr is a new intelligent embedded security feature. The technlgy is unique in that it can inspect utbund netwrk cnnectins typically abused by malware, determine what is nrmal and stp suspicius activity. If the printer is cmprmised, it will autmatically trigger a rebt t initiate HP Sure Start self-healing prcedures. This feature is enabled by default. It can be disabled and has user cnfigurable settings t tune the feature t specific netwrking envirnments and reduce false psitives. EWS Setting Cnfiguratin Path: Netwrking Tab -> TCP/IP Menu -> Netwrk Identificatin Page Figure 5: HP Cnnectin Inspectr in the Embedded Web Server (EWS) Please see the HP Cnnectin Inspectr Technical Whitepaper mre infrmatin. Nte: See the Appendix A Print Slutin and Fleet tl Impacts sectin fr effects n device slutins and fleet management tls. Crss-Site Request Frgery Prtectin Crss-Site Request Frgery (CSRF) is an explit which hijacks the authenticated user sessin t send unauthrized requests t a server. When the device administratr authenticates t the EWS server, it generates a sessin authenticatin tken. The CSRF feature prvides fr generating an additinal cryptgraphic randmly generated CSRF tken which prtects against an attacker sending cmmands as the authenticated administratr. When enabled the CSRF feature prevents sending cmmands t the device thrugh the EWS cnfiguratin interface withut first having initiated a EWS sessin, which establishes the CSRF Tken. This methd is referred t as web scraping as the cmmands are captured and replayed t cnfigure device settings thrugh scripting. This feature is enabled by default. It can be disabled if required. EWS Setting Cnfiguratin Path: Security Tab -> General Security Figure 6: Crss-Site Request Frgery (CSRF) Prtectin in the Embedded Web Server (EWS) Nte: See the Appendix A Print Slutin and Fleet tl Impacts sectin fr effects n device slutins and fleet management tls. Please see Preventing Crss Site Request Frgery (CSRF) Attack using CSRF-Tkens n HP Printing Devices fr mre infrmatin. 5

6 Administratr Passwrd Cmplexity and Minimum Length The administratr passwrd cmplexity feature requires cmplex passwrds requiring 3 f the 4 fllwing categries: Upper case characters Lwer case characters Numbers Special characters The minimum passwrd length feature requires an administrative passwrd between 1-16 characters lng. The default setting is 8 characters. A Zer (0) minimum passwrd length disables the minimum passwrd length feature. This feature is enabled by default. It can be disabled if required. Accunt Lckut The Accunt lckut feature prtects the device administrative accunts by prviding safeguards t prevent brute frce hacking attempts. After a set number f failed authenticatin attempts the system prevents further authenticatin attempts fr a specific interval. The accunt lck feature applies t the fllwing passwrds: EWS passwrd Remte cnfiguratin passwrd SNMPv3 authenticatin and privacy passphrases This feature is enabled by default. It can be disabled if required. EWS Setting Cnfiguratin Path: Security Tab -> Accunt Plicy Figure 7: Accunt Lckut, Cmplexity & Minimum Length in the Embedded Web Server (EWS) New Device Security Settings & Firmware Upgrade Behavir All devices delivered with FutureSmart firmware bundle 4.5 will include the new security features and security settings defaults. Devices upgraded t FS 4.5 will switch t the new settings defaults nly after a full device reset as listed belw. The fllwing scenaris apply: Devices purchased with FutureSmart bundle 4.5 (after Nvember 2017) New security defaults apply New security features present and enabled by default Devices updated t FutureSmart bundle 4.5 frm FutureSmart 3 bundles r FutureSmart 4 bundles befre versin 4.5 Security settings are nt update the security settings t the new defaults and maintain their current setting. New security features are present and enabled by default 6

7 Perfrming the fllwing device resets update the security settings t the new defaults, verwriting any previusly cnfigured setting Frmat Disk Partial Clean Cld Reset Imprtant: Device Resets fund in the EWS Trubleshting Tab d nt fully reset security settings t the Secure by Default security prfile. The fllwing resets shuld nt be used t enable Secure by Default settings: Reset Factry Defaults Firmware Reset Settings Defaults The fllwing tables cntain the Secure by Default settings current and updated defaults. Security Setting FutureSmart 3 and FutureSmart pre-4.5 Defaults FutureSmart 4.5 Defaults SNMPv1/v2 Enable SNMPv1/v2 Read-Write access Enable SNMPv1/v2 Read-nly access PJL/PS File Access Enabled Disabled PJL Device Access Cmmands Enabled Disabled TLS Ciphersuites cntaining RC4 and 3DES Active (enabled) Available (nt enabled) Security Feature Default Can be disabled Affected Technlgies Crss-Site Request Frgery Preventin HP Cnnectin Inspectr Administrative Passwrd Min Length and Cmplexity Enabled Yes Print slutins frm specific vendrs may need t disable setting until cmpliant. Enabled Yes Nne MPS and custmer scripting tls may need t temprarily disable CSRF t execute. Enabled Yes Defaults may need t be changed t accmmdate existing passwrds used fr print slutins and fleet tls. Accunt Lckut Enabled Yes Defaults may need t be changed t accmmdate WJA. 7

8 Appendix A Print Slutin and Fleet Tl Impacts This sectin describes knwn impacts resulting frm the new security features and updated security default settings. Fleet Tl r Print Slutin Minimum Cmpatible Slutin versin if impacted Impact t Custmers New device deplyment OR Upgraded devices after perfrming a Frmat Disk, Partial clean r Cld Reset Available Wrkarunds HP Web Jetadmin (WJA) 10.4-SR2 FP6 r 10.4-SR3 FP6 FP6 required fr new cnfiguratin item SNMP Credential (FutureSmart Versin 4.0 and higher) See Appendix B Web Jetadmin SNMP Cnfiguratin Optins fr FutureSmart 4.5 fr additinal infrmatin. Fr WJA versins befre 10.4SR2 FP6 Use HP SM v3.1r EWS t enable write access fr SNMPv1/v2 r Cnfigure SNMPv3 WJA requires PJL Disk Access t manage fnts and macrs. Use WJA t enable PJL Disk Access WJA requires PJL Device Access Cmmands t be enabled fr device cnfiguratin with PJL files sent frm WJA. Use WJA t enable PJ Device Access Cmmands HP JetAdvantage Security Manager (HP SM) HP SM 3.1 Versin 3.1 required fr SNMPv1/v2 cmpatibility Fr HP SM versins befre 3.1 Use WJA 10.4-SR2 w/fp6 r EWS t enable SNMPv1/v2 write access r Cnfigure SNMPv3 CSRF must be disabled fr any plicy mdifying LLMNR and 802.1x, r ther settings using HTTP POST cnfiguratin methd Include disabling CSRF in any HP SM plicy mdifying these settings Fleet Deplyment Tl (FDT) FDT Versin required fr CSRF cmpatibility FDT may be impacted and requires TC t verify all Wrkflws against device. May need t enable features via EWS based n the task r recrding. Fr FDT versins befre Use WJA10.4 w/xtp ticket, HP SM r EWS t disable CSRF HP Access Cntrl (HP AC) All versins f HP AC impacted. PJL disk access and PJL Device Access Cmmands required fr installatin and cnfiguratin f HP AC. Use WJA, HP SM r EWS t enable PJL disk access and PJL Device Access Cmmands fr installatin and cnfiguratin f HP AC IRM agent. Fllwing installatin/cnfiguratin, PJL disk access can be disabled again. HP Capture and Rute (HP CR) All versins f HP CR impacted. SNMP write access required fr slutin installatin. Use WJA 10.4-SR2 w/fp6, HP SM 3.1 r EWS t enable SNMPv1/v2 write access fr installatin and cnfiguratin f HP CR n the device. Fllwing installatin/cnfiguratin, SNMP write access can be disabled again. HP Embedded Capture (HP EC) All versins f HP EC impacted CSRF must be disabled fr slutin installatin and cnfiguratin. Use WJA, HP SM r EWS t disable CSRF fr installatin and cnfiguratin f HP CR n the device. Fllwing installatin/cnfiguratin, CSRF enabled again. 8

9 Fleet Tl r Print Slutin Minimum Cmpatible Slutin versin if impacted Impact t Custmers New device deplyment OR Upgraded devices after perfrming a Frmat Disk, Partial clean r Cld Reset Available Wrkarunds JetAdvantage Management /Smart Device Services /JAMC r later SDS features that require SNMP write access (ex: Remte Rebt r Supplies Message Suppressin) must turn n SNMPv1/v2 writes r SNMPv3 credentials. Use WJA 10.4-SR2 w/fp6, HP SM 3.1 r EWS t enable SNMPv1/v2 write access JAM/SDS LRS MFPsecure All versins f MFPsecure are impacted. PJL disk access and PJL Device Access Cmmands required fr installatin and cnfiguratin f MFPsecure. Use WJA, HP SM r EWS t enable PJL disk access and PJL Device Access Cmmands fr installatin and cnfiguratin. Fllwing installatin/cnfiguratin, PJL disk access can be disabled again. Safecm Latest SafeCm Agent *31.25 r Newer Basic testing shws n impact. Cntact the Slutin Partner fr cnfirmatin f Supprt befre deplying. Equitrac Equitrac 5.7 WITH Htfix(v ) r newer nly Basic testing shws n impact. Cntact the Slutin Partner fr cnfirmatin f Supprt befre deplying. Try Custmer/Accunt team shuld cntact Try fr cmpatibility infrmatin TROY has stated that depending n the custmer and cnfiguratin f their slutin they shuld perfrm a POC and then wrk with TROY Grup t further diagnse. Phars and Celive The changes have been cmmunicated t Partners. Cntact the Slutin Partner fr cnfirmatin f Supprt befre deplying. Partner Slutins (Silver) The changes have been cmmunicated t Partners. Cntact the Slutin Partner fr cnfirmatin f Supprt befre deplying. DSS N impact eprint N impact JetAdvantage Cnnect N impact 9

10 Appendix B Web Jetadmin SNMP Cnfiguratin fr FutureSmart 4.5 Web Jetadmin feature pack 6 adds an SNMP cnfiguratin ptin SNMP Credentials FutureSmart 4 fr the cnfiguratin f FutureSmart 4.5 and higher. The setting allws cnfiguring SNMP ver the Cmmn Data Mdel (CDM) prtcl, which is new in FutureSmart 4.5. Fr lder FutureSmart versins the WJA SNMP cnfiguratin setting is SNMP Credentials FutureSmart 3 and Nn-FutureSmart devices (befre 10.4SR3 this ptin was called SNMP Versin Access Cntrl ) The ptin SNMP Credentials FutureSmart 4 must be used instead f the ptin SNMP Credentials FutureSmart 3 and Nn-FutureSmart devices t cnfigure SNMP thrugh WJA when SNMP is set t read-nly (r disabled) n the device. Figure 8: WJA SNMP cnfiguratin ptins in batch mde with Feature Pack 6 This table describes the WJA SNMP cnfiguratin ptin t use fr specific FutureSmart versins and SNMP cnfiguratins. Device family and SNMP state Required WJA Name f Cnfiguratin ptin t cnfigure SNMP FutureSmart 4.5 with SNMPv1/v2 set t read-nly and SNMPv3 nt cnfigured FutureSmart 4.4 and lder devices and nn FutureSmart devices FutureSmart 4.5 with SNMPv1/v2 set enabled and/r SNMPv3 cnfigured FutureSmart 4.4 and lder and nn FutureSmart devices 10.4-SR2 w/fp SR3 w/fp6 (r higher) 10.4-SR2 w/fp SR3 w/fp6 (r higher) Legacy WJA Legacy WJA SNMP Credentials - FutureSmart Versin 4.0 SNMP Versin Access Cntrl SNMP Credentials FutureSmart 3 and Nn-FutureSmart devices SNMP Versin Access Cntrl SNMP Versin Access Cntrl 10

11 Appendix C PJL Device Access Cmmands The PJL Device Access Cmmand setting cntrls access t PJL management cmmands. The fllwing table lists which PJL cmmands are cntrlled with this cmmand. PJL Cmmand Cntrlled by PJL Device Access Cmmand setting Descriptin DEFAULT Yes Sets default values fr envirnment variables. OPMSG, RDYMSG, STMSG Yes Ready, Status and Operatr messages DMINFO, DMCMD Yes SNMP ver PJL cmmands INITIALIZE Yes Resets PJL values t factry default SET Yes Sets envirnment variable t specified value fr duratin f a PJL jb. File system cmmands (FS*) N Cntrlled by PJL File Access cmmand UEL, COMMENT, ENTER, JOB, EOJ, RESET INQUIRE, DINQUIRE, ECHO, INFO USTATUS, USTATUSOFF N Jb cntrl and jb status cmmands References Preventing Crss Site Request Frgery (CSRF) Attack using CSRF-Tkens n HP Printing Devices HP FutureSmart 4 Administrative Passwrd Security Features Discvering And Cnfiguring FutureSmart Devices Versin 4.5 And Later with HP Web Jetadmin Additinal dcuments TBD Get cnnected hp.cm/g/getcnnected Current HP driver, supprt, and security alerts delivered directly t yur desktp Cpyright 2017 Hewlett-Packard Develpment Cmpany, L.P. The infrmatin cntained herein is subject t change withut ntice. The nly warranties fr HP prducts and services are set frth in the express warranty statements accmpanying such prducts and services. Nthing herein shuld be cnstrued as cnstituting an additinal warranty. HP shall nt be liable fr technical r editrial errrs r miss ins cntained herein. December 2017, Versin 1.2 Public 11