Slashdot Mirror
Digital Photocopiers Loaded With Secrets
skids writes 'File this under "no, really?" CBS news catches up with the fact that photocopiers, whether networked or not, tend to have a much longer memory these days. When they eventually get tossed, few companies bother to scrub them. Couple this with the tendency of older employees to consider hard-copy to be "secure," and your most protected secrets may be shipped directly to information resellers — no hacking required. "The day we visited the New Jersey warehouse, two shipping containers packed with used copiers were headed overseas — loaded with secrets on their way to unknown buyers in Argentina and Singapore."'
Why did they start designing copy machines to have long term storage, and to keep a copy of everything ever copied?
I'm not surprised - there are all sorts of nifty things mere "copiers" do. They can store documents forever, especially "secure" ones that you have to release with a PIN. They provide network services - some include (hackable!) FTP servers.
HPs printers support SNMP, but usually in the most insecure method possible. One of the simpler things you can do (Google it, perhaps not using SNMP) is remotely change the LCD text and blink the status lights. I wrote a script that would make all the HP printers on campus flash an animated ASCII Kirby dance.
Print servers are just that - servers. But, they look like copiers, so they get thrown out with secrets.
DATABASE WOW WOW
Your basic deskside all-in-one isn't much of a risk.
You mean cheap all-in-one are more secure than expensive ones? I wouldn't say that if it wasn't for this article...
Seems one more thing to have in mind when buying a printer...
Isn't there a spec for deleting data? Seems it would be a good selling feature and cheap to implement a system in the BIOS of all PCs and any device that has a hard drive a way to securely delete all data. This would make it much easier to get rid of old equipment without having to worry about what data is left.
How long has it been taking you to improve the horrible UI?
Indeed. But even storage used by the machine would required some physical presence. Having torn these machine down to almost the bare frame on more than one occasion, if there's a hard drive in there, it's invisible. Maybe some flash memory on the board somewhere, but I doubt it could store more than the last 100 pages or so....
I judt got a nre Kinesis keybiartf so please excusr ant egregiou typos.
I'm starting to really think that we're making a mistake putting full-fledged computers in everything we build. They allow for an amazing array of features, but it makes fully understanding our machines much more difficult. Security problems like this one are inevitable.
A dumb analog xerox machine is pretty easy to understand, and one that runs on a microcontroller and a few KB of ram (if that) isn't much harder. But who but the most dedicated hacker has any real idea about what is going on inside a modern Xerox. It *might* not have any undocumented "features," but you have no way of knowing. Security has gone from being a matter of applied common sense to involving a large amount of blind trust in these manufacturers.
It's a symptom of a larger issue though. We're rapidly getting away from having a society where a well educated and technically minded person can understand the actual inner workings of the technology they interact with every day. The tradeoff might be worth it, I'm not a luddite. But we should remember that we are entering into a new kind of relationship with our machines,
In Capitalist America, bank robs you!
many years ago, in the ages of DOS 4.0 and so forth, we had a hewlett packard laser jet, which we thought pretty slick, that connected with a huge fat parallel port cable. One day, I unplug the printer and hook it up to another PC, which, children, in those far off days was quite an adventure in drivers (this was before you could download drivers off the web.....almost pre historic) While, I send some print jobs, say job1, job2.... to the printer, some of which print and some of which vanish, but, eventually, I get all the printouts I need and hook the laserjet back to its orignal computer. A month or two later, printjob2 popped out of the printer. snce the software for this was not installed on the pc the printer was hooked up tow, the job must have sat in the printer all that time (this is long before any "wireless" was available - it would be 2 or 3 years later that the marvel of 802.11A came along)
Even nicer, I remember a few years ago I needed to scan the work permit in my passport for HR. So I went to the photocopier, did a scan to storage, and from my desktop retrieved from the photocopier storage and emailed. Job done I went to delete my passport from the photocopier storage. No Dice, windows admin rights required, and when I asked a windows admin to delete it for me (and the other 8 confidential documents sitting there with full read access) I got a very blank look.
And I suppose that's really the distinction. If you asked people, "does the copier right now have a copy of that page you just copied?" that might not be surprised by that, but "does the copier right now have a copy of that page you copied last year?" they would be, and the difference comes down to how much storage and whether or not you have persistent storage.
I got tons of confidential at my last company from having one of those fax/scanner/copiers dump the scans into a network folder that everyone had access to. We were a smallish startup, and at times I felt our CEO was being less than forthcoming about our financials and the potential customers we had lined up, and that network folder more or less confirmed that, among other things. I couldn't believe the stuff that people would just leave there for weeks and months, no one realized that "hey I can just go and read all this stuff, so everyone else must be able to as well!"
I know its a bit off the topic at hand here, but these devices can ruin the best laid security plans- our admin at that company was top notch, and it blew right by him as well.
Sadly true... Well, true that I don't do the UI (our marketing guys don't either... we actually have a dedicated team for UI design, and they constantly make me cringe)
My book about LSD and Self-Discovery
Also on facebook as: DroppingAcidDaleBewan
All the major manufacturers offer options that will delete/overwrite data from the internal hard drive after it has been output. They also offer encryption of all user data on the drives, so that the drive content cannot be read outside of the machine.
As most of the machines in this class now run on Linux, adding that kind of features should be pretty simple.
It's a fairly open secret that the US and other governments have strong-armed color copier vendors into including anti-counterfeiting and steganographic identification features. Specifically, color copiers can detect certain unique features of currency, and will refuse to copy a document that has those features. Also, color printers put a virtually invisible unique pattern of tiny yellow dots on every sheet they print, so that the sheet can be traced back to its owner.
To what extent are those features visible and controllable by copier technicians?
I think what is happening is, the operating system of the printer (which I hear in some cases is Linux ?) works like most operating systems when deleting a file. It just removes the directory entry. So the file-data is still on the disk, but it has no name or length, isn't connected to a directory and parts could be scattered all over the disk.
New things are always on the horizon