When it comes to cyber security threats, most people are familiar with phishing, malware and data breaches. Far fewer know much about spooling attacks, or how to deal with them. If you are reading this article, you are probably interested in learning what spooling attacks are and how to defend against them, as an individual or an organisation.
This article explains what spooling attacks are in plain terms, and sets out the most reliable ways to deal with them so your organisation is not the next victim.
What is spooling?
The term spooling derives from the acronym SPOOL, which stands for Simultaneous Peripheral Operation On-Line. Spooling is the ability of a device — a mouse, a keyboard, a printer — to temporarily store the data needed to execute a task in a queue. If several computers send a document to be printed, for example, the printer temporarily stores the data for those documents until they have all been printed.
Spooling matters in computing because it lets devices execute tasks much faster: they can access the data for the next task as soon as the current one finishes. Most devices designed to use spooling are not especially fast on their own, so temporarily storing the next task is what keeps them working at a reasonable rate.
Why do attackers use spooling attacks?
Attackers like spooling devices because they usually do not have sophisticated security mechanisms preventing access. Reaching a printer does not require the kind of authentication a computer does, so these devices are comparatively easy to target.
Before using a device like a printer, a computer has to install drivers that allow the print task to run. Almost any computer can install those drivers, because most printers have no meaningful way to determine which devices should be allowed to access them. That is risky: an attacker can send malicious code to computers connected to that printer if they are not well protected, and can also overwhelm the printer with tasks until it crashes or is damaged.
It is also worth noting that most printer networks use Windows Print Spooler, software that is over twenty years old. It has carried several security flaws and vulnerabilities that attackers have been able to exploit.
How are spooling attacks executed?
One common spooling attack involves overwhelming the target device with tasks until it becomes unusable — a denial of service attack. Attackers can also send tasks deliberately designed to crash or damage the target device. These attacks are often hard to detect, because administrators may assume the traffic reaching the device is coming from legitimate machines that are supposed to use it.
As well as overwhelming a device with demanding tasks, attackers can send malicious code to other computers connected to it, aimed at stealing data or otherwise disrupting the machines affected.
How to deal with spooling attacks
Now that you know what spooling attacks are, here are the reliable ways to avoid becoming the next victim.
Use network monitoring to detect malicious requests
One of the most reliable ways of detecting spooling attacks is monitoring that spots unusual traffic trying to reach the targeted devices. As noted above, printers are usually the main target. Monitoring can filter print requests and deny access to those coming from unfamiliar devices on the network.
Use a firewall
A firewall is a hardware or software barrier between a computer and the internet that determines which traffic gets through. A well-configured firewall helps block attackers from sending malicious code to your devices across the network, so that even if something like a printer is compromised, the organisation's computers remain protected from attacks routed through it.
Educate staff about spooling attacks
Your staff need to recognise the signs of a spooling attack. Those signs include devices such as printers becoming unresponsive when nobody in the office is using them. They should be reported immediately, so that investigation and action can happen before an attacker compromises or damages the device.
Restrict software installation to a few users
When setting up company computers, the IT team should configure user roles that give each employee access to certain systems and privileges, depending on their role and how familiar they are with common attacks. If the tools your staff need are already installed, there is no need to allow them to install software themselves.
This prevents drivers being installed on a device that has already been compromised. These restrictions matter more the larger the organisation gets, and clear roles also make a spooling attack easier to investigate, because the possible points of attack are already known.
Install security patches as soon as they are available
Because of the growing number of spooling attacks, Microsoft and the manufacturers of computers and their accessories regularly release software and firmware updates to fix vulnerabilities — including patches for Print Spooler vulnerabilities, and updates fixing bugs and security flaws across large ranges of printer models.
Carry out routine cyber security audits
Every organisation that uses computers and the internet should carry out some form of cyber security audit on a regular cycle. How often depends on the size of the organisation and the level of risk it carries: organisations in sensitive sectors such as defence or healthcare need to audit more often, because they are the more attractive targets.
Implementing all of the above internally can be time-consuming and expensive, and is often done unevenly. Outsourcing security operations to a specialist provider is frequently the better option.
Why organisations outsource security operations
Many companies do not put enough emphasis on the security of their IT infrastructure — to the extent of not including it in the budget. It is worth investing in, because a single attack can put an organisation out of business.
Outsourcing security operations helps deal with spooling attacks, along with several other benefits.
Periodic penetration testing and security audits
This means testing your networks and the devices across your infrastructure for vulnerabilities an attacker could exploit. A provider will report on what was found, recommend what to do about it, and advise which vulnerabilities to address first based on the risk each one carries.
Your IT team stops absorbing security work
In most organisations with an in-house IT team, a significant share of their time goes on security issues. That time is better spent on the core work they were hired for. Moving security tasks to a specialist provider makes the IT team more effective at everything else.
Access to specialist experience
A specialist provider employs security people who have worked in the discipline for a long time, across many estates. Engaging one gives you access to that experience, and your own team can learn from it.
Final thoughts
Spooling attacks are not especially common, and they are easy to overlook. Attackers can take advantage of exactly that inattention to compromise infrastructure through a device nobody was watching. Monitoring, firewalling, patching, restricting installation rights and auditing regularly all reduce the risk — and where that is difficult to sustain internally, a competent provider can carry it for you.