Demonstrating the New Linux Exploit (9.9 CVSS)

[@TylerRamsbey]

Awesome stuff. Thank you for covering this!

[@MalwareCube]

@@TylerRamsbey thanks for watching Tyler!! 🙏

[@MartinWoad]

Rather than trying to come up with a printer brand just call it "Print to PDF". I guarantee most enteprise workers would fall for it. You can even make the command actually produce a pdf file and they wouldn't notice the impact.

[@MalwareCube]

@@MartinWoad fantastic idea, you're right.

[@muqsitbaig]

Amazing video man. Loved the way you went into detail and explained everything.

[@pierrecolin6376]

31:58 Your telnet expects " " newline sequences while the remote terminal only prints " ". After skimming the manpage, I think the onlcr option in stty can address that.

[@MalwareCube]

@pierrecolin6376 nice catch :)

[@Abhinav-MR]

Dude, I was watching this video 2 days ago when you had 999 subscribers. Now you have 1.41k. Nice!! Great explanation indeed. Loved it

[@MalwareCube]

@@Abhinav-MR thank you so much!

[@royalcanadianbearforce9841]

Loved the lab demo. Great video!

[@DalBileAbas]

Thanks for the thorough demo.

[@readysetexploit]

I was a bit confused on how this exploit worked. But this video really helped me out to understand it. Thanks again!

[@MalwareCube]

Thanks man! 😀 I'm glad you enjoyed it.

[@alignedfibers]

Proper NAT, and keeping your local network secure is important, obviously port 631 should be blocked on your public network facing nics.

[@praisong7475]

Great video and explanation

[@erglaligzda2265]

Why this is so highly rated? Well I could bet on "now printers work fine, we will fix issue later". Later comes never and everybody forgets about it. :)

[@MalwareCube]

@@erglaligzda2265 considering one of the CVEs has basically been around since 2011, you're probably right 😅

[@sirseven3]

Actually yes. I've found clues of this attack style at an enterprise and ive spot checked all of the printers and some managers reported this issue a year ago and nothing happened.

[@JuanBotes]

thx for the nice explanation and POC \o/

[@Mcohen20]

Really great explanation!

[@aalekhmotani3877]

great explanation, thank you

[@regisu85]

Nice explanation! Thanks

[@neotokyo98]

hey congrats on hitting 1000 subscriber. I'm the 1000th subscriber

[@MalwareCube]

Woot! that's huge, thank you for being 1k. 🥳

[@YousefNein]

Great video. Thanks for sharing

[@phillydee3592]

Great vid and POC

[@comosaycomosah]

this channel is such a gem bro hope you get more subs soon! Edit: btw do you know your site is down it may be my filters but i dont think so

[@MalwareCube]

Thank you so much! me too :) lol

[@mohammedmuzammilali320]

awesome poc. thanks for the video

[@kenlen8029]

Thank you dude. First time messing with commands in the terminal. Cups-browsed service removed. This happened at a strange time. Kind of new to Linux and someone else in the house just bought a printer which I noticed popping up in the network lol. I didn't feel very at risk although the status command did indicate vulnerable.

[@twr4641]

Awesome demo. Great narration. Thank you! I am not a linux person, what surprised me is that apparently it seems common practice that network printers located outside your LAN can simply advertise themselves to your linux box. Mitigation imho would be fixing firewall settings or adding OS specific protection against accepting IPs outside your home turf. If this exploit is based on mDNS, I would doubt though that mDNS would be sble to cross your subnet in the first place. Or did I miss a crucial point? I have to admit I have definitely blind spots when it comes to Linux 😊 Thanks anyway for taking the time & explaining the mechanics behind this in such a well paced way, I am sure it helps many people better judge their personal risk.

[@MalwareCube]

@twr4641 thanks! Yeah there is a way to exploit internet facing systems that doesn't use the mDNS method just by sending over a UDP port 631 packet. This video demonstrates that LAN / local network method since it was a bit easier to lab, but the original blog I linked shows the WAN entry point method as well :)

[@twr4641]

@@MalwareCubeThat makes sense. I am sure the service might be triggerable in a variety of ways. Thanks for demoing this vulnerability at just the right pace.

[@JamalHiggins23]

Great video, earned a sub bro!!!

[@stanislavsmetanin1307]

Awesome. Thanks. 🥲

[@ADudeOnTheInternet]

You didn't really do anything wrong except not align xterm with your terminal sizing. You I believe were using xterm-256-color but regardless you can fix it with exporting the terminal size with stty rows and columns. Good video.

[@MalwareCube]

@ADudeOnTheInternet ahhh yes, that's what it was. Good catch lol. And thank you :)

[@seba19762]

So, for a user behind NAT, there's nothing to worry about?

[@DarkSw0rD]

thanks

[@javabeanz8549]

Ubuntu had the patched CUPS packages out early that morning ( West Coast US )

[@animusdsouza9718]

hey malwarecube, awesome explanation. I am trying to replicate the same on my mac m2 pro, running a vmware fusion with ubuntu server, but am not able to do it. Can you help with that ? Also, how do you have your lab setup ( i need help setting this up on m2 arm chips, as some packages don't work on arm the way it works on x64 processors ).

[@Thiccolo]

subbed

[@ramseyibe2844]

Great video

[@MalwareCube]

@ramseyibe2844 thank you :)

[@alientec258]

wow cool 😀 please more like that Stuff(P😀C) please

[@drtechno-v3e]

CUPS is the generic print system. I purposely uninstall it. Since I use HP printers, I use HP Linux Imaging and Printer system (HPLIP) and foomatic is not installed either.

[@testu1testu294]

Very nice! Thanks for sharing. Still: please put your image/cam on your lower right instead as it covers up stuff that you are trying to present and it beats the point of presenting something since only you can see it while presenting it.

[@MalwareCube]

Yeah, I've since found a way to record the screen and camera separately so I can manually hide it in editing as needed.

[@OfflineSetup]

The vulnerability is concerning, but of more concern is THE LINUX COMMUNITY (not the developers) trying to play down the seriousness.

[@MalwareCube]

I think it will be interesting to see how it plays out. The CVEs have already been downgraded slightly from what it was originally hyped up to be.

[@-iIIiiiiiIiiiiIIIiiIi-]

The devs HAVE played this down. I get where they are coming from. It's a lot o work to fix this. They just don't have the will or resources to tackle this fix.

[@drkwrk5229]

Not interesting really. Problem is.. cups.. desktop.. NAT.. != normally on public IP... So it makes it incredibly boring.. and no one in their right mind put it on the internet.. But as a horizontal vector.. sure

[@MalwareCube]

correct, but at least 75k had put it on the Internet. Actually, according to Marcus Hutchins' research, he found 107,287 Internet exposed cups-browsed instances. Not really a nothingburger but I wouldn't clock it as a 9.9 either.

[@clivewi9103]

Totally over rated, Most distributions have fixed it by ether removing the daemon, or disabling it. This is not Windows were it takes them for weeks to fix anything.

[@yudiokta5881]

Apakah bisa menolong kami yang kena penipuan kak. 🥹🙏🙏