Thursday, December 8th 2011
![HP](https://tpucdn.com/images/news/hp-v1723408558483.png)
Hackers Can Make HP Printers Catch Fire!! Well, Singe Paper...
Researchers at Columbia University have investigated the security of HP network printers and have found them wanting. The basic problem is the complexity of the devices and the fact that the authenticity of firmware updates for these devices isn't checked by using a digital signature. MSNBC published an exclusive story, explaining how by using a hacked computer, the researchers could make their test printers do various nasties, such as continuously heat the fuser unit until the paper singed, at which point the printer shut off due to the built-in safety device, a thermal switch which cannot be overridden by software. They could also be programmed to spread viruses, which would be very dangerous, as these attacking printers would be within the firewall perimeter, allowing them unrestricted access to the soft underbelly of the network. And as the MSNBC article put it so well: "Few companies are prepared to protect themselves from an attack by their own printer." Quite, seems ridiculous at first sight, doesn't it? The researches focused on HP printers, which are by far the most popular brand out there, but say that there are similar vulnerabilities within all devices which employ embedded networked computers, leaving them wide open to attack, hence the industry should wake up to this threat and fix their systems before hackers start to exploit these for real. HP for their part, played down the overall threat and disagreed on several points made by the researchers. Also, the attacks were carried out using Linux and Mac computers and the suggestion seems to be that it's somehow harder to do with a Windows computer. There's a lot more detail at the MSNBC article and readers are encouraged to check it out.
23 Comments on Hackers Can Make HP Printers Catch Fire!! Well, Singe Paper...
Kudos to anyone who gets my reference
If a "hacker" can get into a corporate LAN so easily, then I'm more worried about data security issues than a few printers overheating. And rather than fiddle with overheating, why not just do a remote print run and print off a 1000 pages of pr0n or wikileaks? Far more problematic than a printer under blanket corporate IT insurance.
If the "hacker" is an internal, ie employee, then what else are they up to? If they want to cause damage, they can drop their laptop or put paperclips in the fuser.
NONSTORY
Other devices, too, are possible. :eek: More Press and probably got fed funding for the study they did.:)
Of course, you do get printers and other systems that are directly connected to the internet and these are much more at risk.
One big hint that the problem isn't so bad? These vulnerable devices have been around for the last 15 years or so, so you'd think that the criminal malware writers would have exploited them widely by now if it had been profitable for them to do so. You cynic! :laugh:
Er, time for me to go to bed!
www.irongeek.com/i.php?page=security/networkprinterhacking
Last update was four years ago but there is still alot of useful information in there for Sys Admins.
The problem is they should make firmware digitally signed, and it'd be even better if firmware could be updated only locally
there is firmware that has a checksum to protect against transmission error, but i can't think of much that is protected against attacks from evil people(tm)
I'm no Apple fan but I also hate when any son of a bitch can write some malicious driver or firmware to screw things up and can easily spread that shit.
if you hate your boss use that after you go home
If they can get access to your networked printer they've either already gotten around the firewall or they're an internal employee.
in either of those sceanrios there's far worse things they would be doing.