Blog: LANguard

During recent bank audits, our LANguard scans have been flagging some systems by saying “Administrator account with blank password”.  We would typically look at the systems it flagged, determine they were printers, and not worry about it too much.  After some unsuccessful poking around in LANguard, one of our network engineers and I could not figure out what tests it uses to determine that the admin password is blank.  My coworker recommended attempting to connect a shared drive the next time I see that scan result at a bank.  As usual, my coworker's intuition was right.  The next time LANguard came up with that finding, I was able to connect to share drives (\\printer name\ipc$) on multiple printers using the username “Administrator” and a blank password for authentication. [more]

So far, the only reason I have found that printers are using SMB file sharing is to allow access to any flash memory cards that might be in the printer.  At this point, it doesn’t seem like a big security risk, but there may be a time when printers will need to be setup with a telnet management password, an HTTP management password, and a Windows administrator password.


During a recent bank's information security audit, a coworker and I wrestled with LANguard for the better part of two days trying to figure out why LANguard would freeze during network scanning.  There were several potential culprits including a VLAN setting on the port I was using, a “switch” (which looked just like a little 4 port hub) the company had set up to allow me to use two laptops, etc.  I tried scanning from my laptop, from my VM, from the other laptop, skipping the “switch”, etc.  Finally, I set LANguard to a single thread and noted the scan stopped at the “Enumerate Trusted Domains” step.  The company had two domains, something we don’t often encounter.  I disabled this item in the scanning profile and, presto, the scan ran.  To eliminate any other variables, I turned “Enumerate Trusted Domains” back on and it stalled again.