Hacker News Reader

Comment by marcodiego | Hacker News Reader

Resuming:

  1 - cups-browsed is able to install printers automatically (without the requirement of user confirmation) by listening to UDP packets on port 631.
  2 - Attacker uses this "feature" to install a fake printer with a custom driver (which is also installed without user confirmation and can be downloaded from an arbitrary host) which specifies the "command to run" when a print job is sent.
  3 - User prints something in the fake printer and the "command to run" is executed.

View on HN

> without the requirement of user confirmation

I suppose CUPS was introduced in 1999 so it probably made sense then. But why is it still a thing today?

I would rather expect this kind of change came later, when there has been a huge push to make the "linux desktop" more user-friendly.

1999 sounds like the time when people were a bit more expected to mess with config file and somehow always had a root terminal around. If anything, keep in mind that in 1999 it was still a rite of passage to have to learn how to write the X11 configuration file (what used to be xorg.conf)

Used to be XF86Config (even on non-*86). Xorg came in something like 2005. These things are really pretty young still.

I’d shift that a little earlier (XF86 autoprobing worked for a lot of hardware by the turn of the century) but especially also recognize the competitive environment. Mac, Windows, OS/2, etc. users had been using local network discovery since the 80s, and the people trying to popularize Linux on the desktop were all too aware of the “by and for computer nerds” reputation they were trying to shake, and a lot of people still thought about corporate networks as isolated enclaves where nothing too dangerous happened. The threat model for a lot of people, even server admins who should have known better, was more along the lines of “someone will print a picture of their butt on your desktop printer” rather than “your workstation is now being used to attack the accounting system”.

Reply on news.ycombinator.com