Xerox WorkCentre
5735/5740/5745/5755/5765/5775/5790
Information Assurance Disclosure Paper
Version 2.0
Prepared by:
Larry Kovnat
Xerox Corporation
1350 Jefferson Road
Rochester, New York 14623
XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper
1. INTRODUCTION ..................................................................................................................................5
1.1.
1.2.
1.3.
Purpose ....................................................................................................................................................................................5
Target Audience...................................................................................................................................................................5
Disclaimer ...............................................................................................................................................................................5
2. DEVICE DESCRIPTION.......................................................................................................................6
2.1.
Security-relevant Subsystems.........................................................................................................................................6
2.1.1. Physical Partitioning.......................................................................................................................................................................6
2.1.2. Security Functions allocated to Subsystems ........................................................................................................................7
2.2.
Controller ................................................................................................................................................................................8
2.2.1. Purpose ................................................................................................................................................................................................8
2.2.2. Memory Components....................................................................................................................................................................8
2.2.3. External Connections ..................................................................................................................................................................10
2.2.4. USB Ports .........................................................................................................................................................................................10
2.2.
Fax Module.......................................................................................................................................................................... 11
2.3.1. Purpose .............................................................................................................................................................................................11
2.3.2. Hardware .........................................................................................................................................................................................11
2.4.
Scanner ................................................................................................................................................................................. 11
2.4.1. Purpose .............................................................................................................................................................................................11
2.4.2. Hardware .........................................................................................................................................................................................11
2.5.
Graphical User Interface (GUI)................................................................................................................................... 12
2.5.1. Purpose .............................................................................................................................................................................................12
2.5.2. Hardware .........................................................................................................................................................................................12
2.6.
Marking Engine (also known as the Image Output Terminal or IOT).......................................................... 13
2.6.1. Purpose .............................................................................................................................................................................................13
2.6.2. Hardware .........................................................................................................................................................................................13
2.6.3. Control and Data Interfaces....................................................................................................................................................13
2.7.
System Software Structure ........................................................................................................................................... 13
2.7.1. Open-source components .........................................................................................................................................................13
2.7.2. OS Layer in the Controller .........................................................................................................................................................13
2.7.3. Network Protocols ........................................................................................................................................................................15
2.8.
Logical Access..................................................................................................................................................................... 16
2.8.1. Network Protocols ........................................................................................................................................................................16
2.8.2. Ports ...................................................................................................................................................................................................17
2.8.3. IP Filtering .......................................................................................................................................................................................21
3. SYSTEM ACCESS................................................................................................................................22
3.1.
Authentication Model..................................................................................................................................................... 22
Ver. 2.00, March 2011
Page 3 of 50
XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper
3.2.
Login and Authentication Methods........................................................................................................................... 24
3.2.1. System Administrator Login [All product configurations] ...........................................................................................24
3.2.2. User authentication.....................................................................................................................................................................24
3.3.
System Accounts............................................................................................................................................................... 26
3.3.1. Printing [Multifunction models only]....................................................................................................................................26
3.3.2. Network Scanning [Multifunction models only] ..............................................................................................................26
3.4.
Diagnostics.......................................................................................................................................................................... 27
3.4.1. Service [All product configurations]......................................................................................................................................27
3.4.2. Alternate Boot via Serial Port ..................................................................................................................................................27
3.4.3. tty Mode...........................................................................................................................................................................................27
3.4.4. Diagnostics via Portable Service Workstation (PSW) Port ...........................................................................................27
3.4.5. Summary..........................................................................................................................................................................................30
4. SECURITY ASPECTS OF SELECTED FEATURES ......................................................................31
4.1.
4.2.
4.3.
4.4.
4.5.
Audit Log.............................................................................................................................................................................. 31
Xerox Standard Accounting.......................................................................................................................................... 39
Automatic Meter Reads ................................................................................................................................................. 40
Encrypted Partitions........................................................................................................................................................ 40
Image Overwrite ............................................................................................................................................................... 40
4.5.1. Algorithm.........................................................................................................................................................................................41
4.5.2. User Behavior.................................................................................................................................................................................41
4.5.3. Overwrite Timing ..........................................................................................................................................................................41
5. RESPONSES TO KNOWN VULNERABILITIES .........................................................................42
5.1.
Security @ Xerox (www.xerox.com/security).......................................................................................................... 42
6. APPENDICES.......................................................................................................................................43
6.1.
6.2.
6.3.
6.4.
Appendix A – Abbreviations ......................................................................................................................................... 43
Appendix B – Supported MIB Objects....................................................................................................................... 45
Appendix C –Standards .................................................................................................................................................. 48
Appendix E – References................................................................................................................................................ 50
Ver. 2.00, March 2011
Page 4 of 50
XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper
1. Introduction
The WorkCentre 5735/5740/5745/5755/5765/5775/5790 multifunction systems are among the latest
versions of Xerox copier and multifunction devices for the general office.
1.1. Purpose
The purpose of this document is to disclose information for the WorkCentre products with respect to device security.
Device Security, for this paper, is defined as how image data is stored and transmitted, how the product behaves in a
networked environment, and how the product may be accessed, both locally and remotely. Please note that the
customer is responsible for the security of their network and the WorkCentre products do not establish security for
any network environment.
The purpose of this document is to inform Xerox customers of the design, functions, and features of the WorkCentre
products relative to Information Assurance (IA).
This document does NOT provide tutorial level information about security, connectivity, PDLs, or WorkCentre
products features and functions. This information is readily available elsewhere. We assume that the reader has a
working knowledge of these types of topics. However, a number of references are included in the Appendix.
1.2. Target Audience
The target audience for this document is Xerox field personnel and customers concerned with IT security.
1.3. Disclaimer
The information in this document is accurate to the best knowledge of the authors, and is provided without warranty
of any kind. In no event shall Xerox Corporation be liable for any damages whatsoever resulting from user's use or
disregard of the information provided in this document including direct, indirect, incidental, consequential, loss of
business profits or special damages, even if Xerox Corporation has been advised of the possibility of such damages.
Ver. 2.00, March 2011
Page 5 of 50
XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper
2. Device Description
This product consists of an in put document handler and scanner, marking engine including paper path, controller,
and user interface.
Document Feeder & Scanner
(IIT)
Graphical User
Interface
(GUI)
Paper Trays
Marking Engine (IOT)
High-volume finisher and
booklet maker accessories
High-capacity
feeder accessory
Figure 2-1 WorkCentre Multifunction System
2.1. Security-relevant Subsystems
2.1.1. Physical Partitioning
The security-relevant subsystems of the product are partitioned as shown in Figure 2-2.
Ver. 2.00, March 2011
Page 6 of 50
XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper
Figure 2-2 System functional block diagram
2.1.2. Security Functions allocated to Subsystems
Security Function
Image Overwrite
Subsystem
Controller
Graphical User Interface
Controller
System Authentication
Network Authentication
Graphical User Interface
Controller
Graphical User Interface
Controller
Controller
Controller
Controller
Controller
Controller
Controller
Security Audit
Cryptographic Operations
User Data Protection – SSL
User Data Protection – IP Filtering
User Data Protection – IPSec
User Data Protection – Disk Encryption
Network Management Security
Fax Flow Security
Fax Module
Controller
Graphical User Interface
Ver. 2.00, March 2011
Page 7 of 50
XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper
Security Function
Subsystem
Controller
Graphical User Interface
Security Management
Table 1 Security Functions allocated to Subsystems
2.2. Controller
2.2.1.Purpose
The controller provides both network and direct-connect external interfaces, and enables copy, print, email, network
scan, server fax, internet FAX, and LanFAX functionality. Network scanning, server fax, internet fax, and LanFax, are
standard features.
NOTE: The Copier only version includes a hard drive which is used to hold Operating System software, printing
applications, and jam clearance videos. Job Image data is not stored on this disk.
Image Overwrite, which is included as a standard feature, enables both Immediate and On-Demand overwrite of any
temporary image data created on disk. The controller also incorporates an open-source web server (Apache) that
exports a Web User Interface (WebUI) through which users can submit jobs and check job and machine status, and
through which system administrators can remotely administer the machine.
The controller contains the image path, which uses proprietary hardware and algorithms to process the scanned
images into high-quality reproductions. Scanned images may be temporarily buffered in DRAM to enable electronic
pre-collation, sometimes referred to as scan-once/print-many. When producing multiple copies of a document, the
scanned image is processed and buffered in the DRAM in a proprietary format. Extended buffer space for very large
documents is provided on the network disk. The buffered bitmaps are then read from DRAM and sent to the Image
Output Terminal (IOT) for marking on hardcopy output. For long documents, the production of hardcopy may begin
before the entire original is scanned, achieving a level of concurrency between the scan and mark operations.
The controller operating system is Wind River Linux, kernel v. 2.6.20+. (Note: Consistent with Flaw Remediation, this
baseline may be updated as indicated by the ‘+’ sign. Unnecessary services such as rsh, telnet and finger are disabled
in the OS. FTP is used in client-only mode by the network scanning feature for the filing of scanned images and the
retrieval of Scan Templates; however the controller does not contain an FTP server.
The controller works with the Graphical User Interface (GUI) assembly to provide system configuration functions. A
System Administrator PIN must be entered at the GUI in order to access these functions.
2.2.2.Memory Components
Volatile Memory
Type (SRAM, DRAM,
etc)
Size
User
Modifiable
(Y/N)
Function or Use
Process to Sanitize
DDR2 SDRAM
1GB
2GB
N
Single Board Controller
Subsequent jobs overwrite
the data and all images are
lost at power off or reboot.
Upgradeable to
(System and user image stored)
Additional Information: There are also a number of RAM buffers in the video path that are used for image
manipulation (Reduce/Enlarge, etc.), and all have no data retention capability. When power is removed all data is lost.
These buffers are typically built into the ASICs. Typical bleed down time for all volatile memory is 10 seconds.
Ver. 2.00, March 2011
Page 8 of 50
XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper
Non-Volatile Memory
Type (Flash, EEPROM, Size
etc)
User
Modifiable
(Y/N)
Function or Use
Process to Sanitize
Flash ROM
NVRAM
128MB
N
N
Single Board Controller
No user image data stored
No user image data stored.
(Boot code and system file)
128KB
Single Board Controller
(Xerographic set points)
Additional Information: There are other non volatile memory devices in the system, but these are used solely for
low level I/O control. Some examples of this distributed control are:
•
•
•
•
Power distribution, Photoreceptor and main drive motors control
Raster Output Scanner (ROS)
Paper Registration
Finisher
Table 2 Controller memory components
Media and Storage
Type (disk drives,
tape drives, CF/SD/XD Y / N
memory cards, etc.):
Removable Size:
User
Modifiable:
Y / N
Function:
Process to Sanitize:
Disk drive
N
80GB
N
Network Controller
Application and Copy
Controller Application
software. Image
On Demand Image
Overwrite
storage, processing and
Overflow EPC image
storage.
Fax Card
N
512MB
N
User FAX image data
stored
User image data
overwritten at the
completion of each fax
job.
Overwritten by
Standard or Full
ODIO operation
Table 3 Hard Disk Drives
Ver. 2.00, March 2011
Page 9 of 50
XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper
2.2.3.External Connections
Figure 2-3 Back panel connections
Interface
FAX line 1, RJ-11
Description / Usage
Supports FAX Modem T.30 protocol only
Supports FAX Modem T.30 protocol only
Software upgrade
FAX line 2, RJ-11
USB Host Port
Direct-connect printing; Xerox diagnostic tools (PSW and CAT)
and Xerox copier assistant
PSW USB Target Port
Ethernet
Scanner
10/100/1000 Network connectivity
Proprietary connection between the scanner and controller
carrying power and communications
Serial Port
Engineering development debug; default state is disabled
Allows connection of optional access control hardware
Foreign Device Interface (FDI)
Table 4 Controller External Connections
2.2.4.USB Ports
The WorkCentre contains a host connector for a USB flash drive, enabling upload of software upgrades and
download of network logs or machine settings files.
Autorun is disabled on this port. No executable files will be accepted by the port.
Modifying the software upgrade, network logging or saved machine settings files will make the files unusable on a
WorkCentre .
The data in the network logging file is encrypted and can only be decrypted by Xerox service.
The machine settings that can be saved and restored by a service technician are limited to controller and fax
parameters that are needed for normal operation. For example, the fax address book can be saved and restored by a
service technician.
There is no method for a user, administrator or technician to move image data from the WorkCentre to a USB device.
USB
USB port and location
Purpose
USB Host ports
Software upgrade
Ver. 2.00, March 2011
Page 10 of 50
XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper
USB Target port
Direct-connect printing; Xerox diagnostic tools (PSW and CAT) and Xerox copier assistant
Table 5 USB Ports
2.2. Fax Module
2.3.1. Purpose
The embedded FAX service uses the installed embedded fax card to send and receive images over the telephone
interface.
2.3.2. Hardware
The Fax module contains the fax modem and RJ-11 connector. The Fax modem implements the T.30 fax protocol.
The Fax module contains a CPU, BIOS, RAM, and Non-Volatile Memory.
Volatile Memory Description
Type (SRAM, DRAM, etc)
Size
User Modifiable Function or Use
(Y/N)
Process to Clear:
SDRAM
80MB
N
FAX Card volatile memory
No user image data
stored
Additional Information:
All memory listed above contains code for execution and configuration information. No user or job data is permanently stored
in this location.
Non-Volatile Memory Description
Type (Flash, EEPROM, etc) Size
User Modifiable Function or Use
(Y/N)
Process to Clear:
Flash ROM
4MB
N
FAX executable code.
No user image data
stored.
Additional Information:
All memory listed above contains code for execution and configuration information. No user or job data is stored in this location.
Table 6 Fax Module memory components
2.4. Scanner
2.4.1. Purpose
The purpose of the scanner is to provide mechanical transport of hardcopy originals and to convert hardcopy
originals to electronic data.
2.4.2. Hardware
The scanner converts the image from hardcopy to electronic data. An optional document handler moves originals
into a position to be scanned. The scanner provides enough image processing for signal conditioning and
formatting. The scanner does not store scanned images. All other image processing functions are in the copy
controller.
The DADF/Scanner contains a CPU, BIOS, RAM, and Non-Volatile Memory
.
Ver. 2.00, March 2011
Page 11 of 50
XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper
Volatile Memory Description
Type (SRAM, DRAM, etc)
Size
User Modifiable Function or Use
(Y/N)
Process to Clear:
SRAM
6KB
N
Scanner volatile memory; no user
image data stored
Power Off System
Additional Information:
All memory listed above contains code for execution and configuration information. No user or job data is permanently stored in this location.
Non-Volatile Memory Description
Type (Flash, EEPROM, etc) Size
User Modifiable Function or Use
(Y/N)
Process to Clear:
Flash ROM
128MB
N
Scanner executable code
No user image data
stored
Additional Information:
All memory listed above contains code for execution and configuration information. No user or job data is stored in these locations.
Table 7 Scanner memory components
2.5. Graphical User Interface (GUI)
2.5.1. Purpose
The GUI detects soft and hard button actuations, and provides text and graphical prompts to the user. The GUI is
sometimes referred to as the Local UI (LUI) to distinguish it from the WebUI, which is exported by the web service
that runs in theccontroller. Images are not transmitted to or stored in the GUI. The Start hard button is located on
the GUI panel.
2.5.2. Hardware
The user interface contains a FPGA that contains RAM and Non-Volatile Memory
.
Volatile Memory Description
Type (SRAM, DRAM, etc)
Size
User Modifiable Function or Use
(Y/N)
Process to Clear:
DRAM
2KB
N
User Interface volatile memory; no Power Off System
user image data stored
Additional Information:
All memory listed above contains code for execution and configuration information. No user or job data is permanently stored in this location.
Non-Volatile Memory Description
Type (Flash, EEPROM, etc) Size
User Modifiable Function or Use
(Y/N)
Process to Clear:
Flash ROM
32KB
N
no user image data stored
No user image data
stored
Additional Information:
All memory listed above contains code for execution and configuration information. No user or job data is stored in this location.
Ver. 2.00, March 2011
Page 12 of 50
XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper
Table 8 User Interface memory components
2.6. Marking Engine (also known as the Image
Output Terminal or IOT)
2.6.1. Purpose
The Marking Engine performs copy/print paper feeding and transport, image marking and fusing, and document
finishing. Images are not stored at any point in these subsystems.
2.6.2. Hardware
The marking engine is comprised of paper supply trays and feeders, paper transport, laser scanner, xerographics, and
paper output and finishing. The marking engine contains a CPU, BIOS, RAM and Non-Volatile Memory.
2.6.3. Control and Data Interfaces
Images and control signals are transmitted from the copy controller to the marking engine across a proprietary
interface.
2.7. System Software Structure
2.7.1. Open-source components
Open-source components in the connectivity layer implement high-level protocol services. The security-relevant
connectivity layer components are:
•
•
•
•
•
Apache 2.2.11, with mod_ssl integrated (http and https)
PHP 5.3.1
OpenSSL 0.9.8l (SSL)
SAMBA 3.0.30 (SMB)
Netsnmp 5.0.9 (SNMPv3)
2.7.2. OS Layer in the Controller
The OS layer includes the operating system, network and physical I/O drivers. The controller operating system is
Wind River Linux, kernel v. 2.6.20+. Xerox may issue security patchesfor the OS, in which case the Xerox portion of
the version number (i.e.. after the ‘+’ sign) will be incremented.
The crypto library for IPSec is provided by the kernel.
IP Filtering is also provided by the kernel.
Ver. 2.00, March 2011
Page 13 of 50
XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper
Figure 2-4 Controller Operating System layer components
Ver. 2.00, March 2011
Page 14 of 50
XEROX WorkCentre 5735/5740/5745/5755/5765/5775/5790 Information Assurance Disclosure Paper
2.7.3. Network Protocols
Figure 2-5 is an interface diagram depicting the protocol stacks supported by the device, annotated according to the
DARPA model.
Figure 2-5 IPv4 Network Protocol Stack
Ver. 2.00, March 2011
Page 15 of 50
|