News for hackers. Stuff that matters.

A comment on Attacking Unix Systems via Cups, Part I. Parent comment

Re:Attacking Unix Systems via Cups, Part I by graemep on Friday September 27, 2024 @05:52AM (#41668251)
Would you also not block this at the firewall on individual nodes: if you block incoming incoming UDP on port 631 that would at least eliminate one of the two entry points, right?

There is no detail in the article about the other.

[ Parent | on HN ]
Re:Attacking Unix Systems via Cups, Part I by tsimionescu on Friday September 27, 2024 @06:35AM (#41668603)
The port has to be open on the node for the functionality to work - the whole point is that printers on the same LAN can auto-register. If you don't want that, disabling cups-browsed is much safer than just relying on the firewall. If you do want that, you can't firewall the port at all.
[ Parent | on HN ]