attachment-0001
<html><body bgcolor="#FFFFFF"><div>Agreed.<br><br>Sent from my iPhone</div><div><br>On Jul 28, 2011, at 9:51 AM, Ira McDonald <<a href="mailto:blueroofmusic@gmail.com">blueroofmusic@gmail.com</a>> wrote:<br><br></div><div><span></span></div><blockquote type="cite"><div>Hi Brian,<br><br>Sounds like a good addition to IDS agenda to me.<br><br>Cheers,<br>- Ira<br><br clear="all">Ira McDonald (Musician / Software Architect)<br>Chair - Linux Foundation Open Printing WG<br>Co-Chair - IEEE-ISTO PWG IPP WG<br>
Chair - TCG Embedded Systems Hardcopy SWG<br>IETF Designated Expert - IPP & Printer MIB<br>Blue Roof Music/High North Inc<br><a href="http://sites.google.com/site/blueroofmusic" target="_blank"><a href="http://sites.google.com/site/blueroofmusic">http://sites.google.com/site/blueroofmusic</a></a><br>
<a style="color:rgb(102, 0, 204)" href="http://sites.google.com/site/highnorthinc" target="_blank"><a href="http://sites.google.com/site/highnorthinc">http://sites.google.com/site/highnorthinc</a></a><br>mailto:<a href="mailto:blueroofmusic@gmail.com" target="_blank"><a href="mailto:blueroofmusic@gmail.com">blueroofmusic@gmail.com</a></a><br>
Christmas through April:<br> 579 Park Place Saline, MI 48176<br> 734-944-0094<br>May to Christmas:<br> PO Box 221 Grand Marais, MI 49839<br> 906-494-2434<div style="display:inline"></div><div style="display:inline">
</div><div style="display:inline"></div><div></div><br>
<br><br><div class="gmail_quote">On Wed, Jul 27, 2011 at 6:03 PM, Brian Smithson <span dir="ltr"><<a href="mailto:bsmithson@ricohsv.com"><a href="mailto:bsmithson@ricohsv.com">bsmithson@ricohsv.com</a></a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<u></u>
<div bgcolor="#ffffff" text="#000000">
Hello IDS people,<br>
<br>
In addition to the PWG F2F meetings, Black Hat is also happening
next week. One of the sessions that might be of interest to PWG
members is "Corporate Espionage for Dummies: The Hidden Threat of
Embedded Web Servers". Among the embedded web servers that
researchers found (accessible on the Internet, not properly
protected as one might hope) are in MFPs. The track that contains
this particular session is being made available as a live webcast,
free of charge. Unfortunately, it overlaps with the IDS meeting.<br>
<br>
Here is the session description:<br>
<blockquote type="cite">
<p>Today, everything from kitchen appliances to television sets
come with an IP address. Network connectivity for various
hardware devices opens up exciting opportunities. Forgot to
lower the thermostat before leaving the house? Simply access it
online. Need to record a show? Start the DVR with a mobile app.
While embedded web servers are now as common as digital displays
in hardware devices, sadly, security is not. What if that same
convenience exposed photocopied documents online or allowed
outsiders to record your telephone conversations? A frightening
thought indeed. </p>
<p>
Software vendors have been forced to climb the security learning
curve. As independent researchers uncovered embarrassing
vulnerabilities, vendors had little choice but to plug the holes
and revamp development lifecycles to bake security into
products. Vendors of embedded web servers have faced minimal
scrutiny and as such are at least a decade behind when it comes
to security practices. Today, network connected devices are
regularly deployed with virtually no security whatsoever. </p>
<p>
The risk of insecure embedded web servers has been amplified by
insecure networking practices. Every home and small business now
runs a wireless network, but it was likely set up by someone
with virtually no networking expertise. As such, many devices
designed only for LAN access are now unintentionally Internet
facing and wide open to attack from anyone, regardless of their
location. </p>
<p>
Leveraging the power of cloud based services, Zscaler spent
several months scanning large portions of the Internet to
understand the scope of this threat. Our findings will make any
business owner think twice before purchasing a 'wifi enabled'
device. We'll share the results of our findings, reveal specific
vulnerabilities in a multitude of appliances and discuss how
embedded web servers will represent a target rich environment
for years to come. Additionally, we'll launch BREWS, a crowd
sourcing initiative to build a global database EWS
fingerprinting data. Traditional security scanners largely
ignore EWSs and gathering appropriate fingerprinting data is a
challenge as most reside on LANs where external scanning is not
an option. As such, we're issuing a call to arms to collectively
gather this critical data.</p>
</blockquote>
<br>
Additional information, including a few MFP vendors mentioned by
name, is in this article:
<a href="http://www.darkreading.com/taxonomy/index/printarticle/id/231002364" target="_blank"><a href="http://www.darkreading.com/taxonomy/index/printarticle/id/231002364">http://www.darkreading.com/taxonomy/index/printarticle/id/231002364</a></a><br>
<br>
The session starts at 11:15am PDT and ends at 12:30pm. The IDS
meeting is schedule to go until 12:00pm and then start again at
1:00pm. If there is interest from others, I propose that we take a
break from the usual agenda and watch the webcast, then break for
lunch at 12:30~1:30. After all, we <i>are</i> the Imaging Device
Security WG ;-).<br>
<br>
To watch the webcast, you need to register here
<a href="https://www.blackhat.com/html/bh-us-11/bh-us-11-uplink.html" target="_blank"><a href="https://www.blackhat.com/html/bh-us-11/bh-us-11-uplink.html">https://www.blackhat.com/html/bh-us-11/bh-us-11-uplink.html</a></a>. <br>
<br>
What do you think? Please reply soon so we can make plans
accordingly.<br>
<br>
<br>
<br>
<pre cols="76">--
Regards,
Brian Smithson
PMP, CSM, CISSP, CISA, ISO 27000 PA
Security Research, Planning
Advanced Customer Technologies
Ricoh Americas Corporation
<a href="mailto:bsmithson@ricohsv.com" target="_blank"><a href="mailto:bsmithson@ricohsv.com">bsmithson@ricohsv.com</a></a>
<a href="tel:%28408%29346-4435" value="+14083464435" target="_blank">(408)346-4435</a></pre>
<br><font color="#888888">--
<br>This message has been scanned for viruses and
<br>dangerous content by
<a href="http://www.mailscanner.info/" target="_blank"><b>MailScanner</b></a>, and is
<br>believed to be clean.
</font></div>
<br>_______________________________________________<br>
ids mailing list<br>
<a href="mailto:ids@pwg.org"><a href="mailto:ids@pwg.org">ids@pwg.org</a></a><br>
<a href="https://www.pwg.org/mailman/listinfo/ids" target="_blank"><a href="https://www.pwg.org/mailman/listinfo/ids">https://www.pwg.org/mailman/listinfo/ids</a></a><br>
<br></blockquote></div><br><div style="visibility: hidden; left: -5000px;" id="avg_ls_inline_popup"></div><style type="text/css">#avg_ls_inline_popup{position: absolute;z-index: 9999;padding: 0px 0px;margin-left: 0px;margin-top: 0px;overflow: hidden;word-wrap: break-word;color: black;font-size: 10px;text-align: left;line-height: 130%;}</style>
<br>--
<br>This message has been scanned for viruses and
<br>dangerous content by
<a href="http://www.mailscanner.info/"><b>MailScanner</b></a>, and is
<br>believed to be clean.
</div><div><span>_______________________________________________</span><br><span>ids mailing list</span><br><span><a href="mailto:ids@pwg.org">ids@pwg.org</a></span><br><span><a href="https://www.pwg.org/mailman/listinfo/ids">https://www.pwg.org/mailman/listinfo/ids</a></span><br></div></blockquote><br />--
<br />This message has been scanned for viruses and
<br />dangerous content by
<a href="http://www.mailscanner.info/"><b>MailScanner</b></a>, and is
<br />believed to be clean.
</body></html>