Slashdot Mirror
Multifunction Printers — The Forgotten Security Risk?
eweekhickins writes to share an article in eWeek highlighting the forgotten risks that a multifunction printer could possibly offer. Brendan O'Connor first called attention to the vulnerabilities of these new devices at a Black Hat talk in '06 and warns that these are no longer "dumb" machine sitting in the corner and should be treated with their own respective security strategy. "During his Black Hat presentation in 2006, O'Connor picked apart the security model of a Xerox WorkCentre MFP, showing how the device operated more like a low-end server or workstation than a copier or printer--complete with an AMD processor, 256MB of SDRAM and an 80GB hard drive and running Linux, Apache and PostGreSQL. He showed how the authentication on the device's Web interface can be easily bypassed to launch commands to completely hijack a new Xerox WorkCentre machine."
Are we going to have a bot net of machines that print our spam for us?
Remove the toner from the printer and you only get white hats.
Engineering is the art of compromise.
My dot-matrix parallel printer will never turn on me like that!
Screeeeeeeech
Klingon programs don't timeshare, they battle for supremacy.
Thankfully, all of the multi-function print centers I have at my job are never working long enough at one time to get hijacked. Maybe the horrible up-times were a gift from the manufacturers to prevent these attacks!
Im in ur bulbs, givin u seezures.
I'm a rabbit startled by the headlights of life
We have a $45,000 high quality high volume scan/printer that is a paperweight.
They purchased it for scanning confidential documents. The hitch is that there is only 1 way to get documents off of this printer: A public non-protected network share... This is basically against the law for a bank.
I suggested that I could set up a private network and they could securely upload docs to the proper place with the right security, however that plan was nixed for being "non-standard"
The result is that now they consult me when buying a pencil sharpener because they don't know how it will affect network security.
Dunno if it was the first network printer hack, but I remember having great fun telnetting to our networked printers more than a decade ago, making the tiny LCD display say "Insert Coin".
You should have made that 'Sugar Y/N/Double'
"Dunno if it was the first network printer hack, but I remember having great fun telnetting to our networked printers more than a decade ago, making the tiny LCD display say "Insert Coin"."
Fun for you, sure. YOU didn't have to clean the coins out of the gears.
That's awesome. I did something similiar to the verifone credit card machine at my first job. I changed the "swipe card" prompt to say "access denied" and everyone thought the machine was broken. They didn't think it was nearly as funny as I did.
Upgrade now to Norton Anti virus 2008 to ensure your printer is safe.
Sort of. After a power outage, i hadnt rebuilt the settings on my wireless router. One day i went into my network places and there were a few new folders in there, as well as another shared printer. Checked the logs and sure enough "ScottsLaptop" or somebody was leeching my wireless. My own fault for not re-securing it, but i still printed several pages of goatse on his shared printer before i booted him off my network. Not really related at all, but a mildly amusing network printer story if there ever were such a thing.
"Sic Semper Tyrannosaurus Rex."
Well? What did the department do with it? You can't just waste that...