In the last few years the price of 3D printers fit for home use has fallen substantially. They have become cheap enough for people without advanced technical skills, especially security skills to venture into this market area. By default, most of the current 3D printers require being tethered to a PC full time via USB to configure and run print jobs.
Octoprint, a 3D printing application, makes life easier for non-technical users by removing this requirement. It can be installed on a device such as a Raspberry Pi and connected to your home network where it exposes a HTTP interface for interaction with the printer which greatly improves usability. During the Octoprint installation process, the user is prompted to enable authentication on the web interface although many people choose to disable the authentication for ease of use. This is not ideal but usually fine if the printer is exposed on the local network only.
As 3D prints can take upwards of 24 hours to complete many people don’t wait long before thinking ‘it would be great to monitor the progress remotely’. Therein lies the issues. In order to accomplish this, they must open a HTTP port in their network via port forwarding to access Octoprint from anywhere and typically forget to enable authentication first. This is how thousands of unsecured Octoprint instances ended up accessible from the internet.
There are MANY risks associated with having these web interfaces publicly exposed. The first is that Octoprint isn’t really designed as a secure web application. It was designed with advanced users in mind and as such can be tweaked and modified endlessly. In it’s default configuration, it is essentially an unauthenticated portal to your network as you can run arbitrary system commands from the web interface. By leveraging this feature an attacker could easily move to more sensitive machines in the network. The second major risk is that 3D printers are essentially simple robots with attached heaters. These heaters can reach extremely high temperatures very quickly. Most modern 3D printers have temperature limits enabled in the firmware to prevent thermal runaways from causing a fire. However, by modifying the firmware and flashing the printer from the Octoprint interface these limits can be removed. This could allow an attacker to start a fire with the printer in just a few clicks. While not as dangerous, an attacker could also possibly damage the machine by commanding the motors to move past their defined areas.
Octoprint has always stated to its customers that making the application available to the internet even with authentication enabled is a terrible idea. Many software applications designed for advanced users, and or experimentation don’t go through rigorous security assessments and aren’t meant to be exposed on the internet. Similar to a cheap lock, the authentication mechanisms are meant to keep the honest out. It is important to review the software’s security posture before opening a port in your network to access it remotely. Even better although not as convenient, using a VPN to access network services running in your home network is the best idea to reduce risk of exposure.
Sources: • https://www.csoonline.com/article/3303562/security/over-3700-exposed3d-printers-open-to-remote-attackers.html • https://octoprint.org/blog/2018/09/03/safe-remote-access/