Path: utzoo!utgpu!watserv1!watmath!att!bellcore!bellcore-2!rutgers!usc!zaphod.mps.ohio-state.edu!rpi!batcomputer!mha From: mha@batcomputer.tn.cornell.edu (Mark H. Anbinder) Newsgroups: comp.sys.mac.misc Subject: Re: LaserWriter Password Message-ID: <10557@batcomputer.tn.cornell.edu> Date: 21 Jul 90 15:04:35 GMT References: <1216@surf.sics.bu.oz> Reply-To: mha@tcgould.tn.cornell.edu (Mark H. Anbinder) Organization: Baka Computers, Inc. - Ithaca, New York Lines: 65 In article <1216@surf.sics.bu.oz> gris@surf.sics.bu.oz (Dave Gris) writes: > >I saw an article about a Trojan horse program to change passwords on >LaserWriters. In fact anyone can manually as well. So I thought I would >try to change mine. Not too difficult, because I have done a little >PostScript and I have got PostScript the blue book and PostScript >the red book. > >Changing the passord is 3 lines of postscript and that works fine. >The problem is after I turn the printer off and on again I can't print >anymore :-(. The error I get is: > %%[Error:invalid access; Offending Command:exitserver] %% >... > >Does it mean I have to leave the PassWord set at 0? With about 30 >LaserWriters accessable on the net someone (not saying student) could >do a lot of damage changing names and passwords on printers. > >Another question which I think has been raised before but I did not >see an answer is: How to you go back to the defaults? Rip the board >out and put it in the microwave on medium for 2 minutes I suppose. :-) I believe in order to use a LaserWriter that has had its password changed from 0 to something else, you have to patch your Laser Prep file to tell it to send the new password. I don't know how to do this... I don't think it's a feature of the PostScript controller that Apple intended for people to use, so it is not well documented. I have the same info you do about setting the password through pure PostScript, but don't know how the drivers on the Mac end handle it. Using the password you set it to, you should be able to get access to the controller and change the password back to 0 (I strongly recommend this!). You'll then be able to print without modifying your Laser Prep and those of all the other users on your network. (Visualize for a moment the chaos that would ensue next time you upgrade to a new version of the LaserWriter driver and don't remember the password to patch the new driver files....) That trojan horse you mention is particularly insidious. There is NO way to return the printer to its default password without replacing the entire controller board unless you know the password. If a program has set the password without you knowing it, you're screwed. There are only 65536 possible passwords, so in theory you could write a program to try them all, but to prevent unauthorized people from doing just that, the PostScript controller waits eleven seconds (or was it minutes?) after an unsuccessful password attempt before letting you try again. (Sounds like the command console prefix code in Star Trek II! Sorry, ignore that. Just TrekBabble.) If that trojan spreads, it will be interesting to see whether Apple will let people affected by it replace the controller board in their printers under warranty or AppleCare, or whether they'll say such damage is not covered... I say all this as if I know what I'm talking about. :-) Much of this information I owe to Adam Engst: pv9y@vax5.cit.cornell.edu, local Mac consultant, virus expert, and one of the authors of TidBITS, that ultra-hoopy weekly Macintosh news update in HC stack format. We were discussing that LaserWriter trojan the other night (I hadn't heard about it before then), and he told me all this neat stuff about what happens after the password gets set. Thanks, Adam! -- Mark H. Anbinder ************************* mha@tcgould.tn.cornell.edu BAKA Computers * ******* ...!batcomputer!memory!mha 200 Pleasant Grove Rd. H: (607) 257-3480 ****** Ithaca, NY 14850 W: (607) 257-2070 ***** Memory Alpha BBS 607-257-5822