Microsoft has updated its documentation around the “PrintNightmare” vulnerability that is impacting Windows PCs across the world. The company now says it is aware of the issue, which officially involves cases where the Windows Print Spooler service may perform privileged file operations and allow hackers into your device.
Though it’s not clear if all versions of Windows are impacted by this vulnerability, Microsoft says that the print spooler code that has the vulnerability is in all versions of Windows. The print spooler is what usually handles print jobs in Windows. Specifically, hackers can exploit that code to run arbitrary code with system privileges.
This can then be used to install programs, view, change, or delete data, or create new accounts with full user rights. Microsoft’s documentation makes it clear that the vulnerability has also been actively exploited, which means it is out in the wild and in use by hackers.
As a result, Microsoft is investigating if all versions of Windows are exploitable. If you’re worried, Microsoft urges uses who are concerned to stay tuned to a support page for updates. Microsoft also mentions that the vulnerability originated before this month’s June 2021 security update. It’s not clear if the update can patch this vulnerability, but it is still best to install the June 8 security updates just to be safe.
There are some workarounds for this matter, but most are up to system administrators to enable. The first workaround is to disable the print spooler service using Powershell. However, this might end up disabling the ability to print from a PC as well as through the network. A second temporary fix involves using Group Policy to disable remote printing, which will actually prevent the remote aspect of the vulnerability by preventing inbound remote printing operations. The U.S. Cybersecurity & Infrastructure Security Agency also recommends following these steps as well.
It’s not very uncommon for hackers to try and target printers and the printing service in Windows. Back in 2018, hackers were able to use old-school printers to invade home networks. PewDiePie supporters also hacked printers at the end of 2018 to send out messages of support for the YouTuber after a battle with another YouTube channel, T-Series.