Malicious Faxes Leave Firms 'Open' To Cyber-Attack (bbc.com)

Booby-trapped image data sent by fax can let malicious hackers sneak into corporate networks, security researchers have found. From a report: Since many companies use fax machines that are also printers and photocopiers, they often have a connection to the internal network. The malicious images exploit protocols established in the 1980s that define the format of fax messages. The research was presented at the Def Con hacker conference in Las Vegas. The two researchers said millions of companies could be at risk because they currently did little to secure fax lines. "Fax has no security measures built in -- absolutely nothing," security researcher Yaniv Balmas, from Check Point software, told the BBC. Mr Balmas uncovered the security holes in the fax protocols with the help of colleague Eyal Itkin and said they were "surprised" by the extent to which fax was still used.

Comments

How exactly does this work?

[Oswald McWeany]

How exactly does this work, is this some sort of injection attack- where a badly formatted image file somehow includes code to take over the fax machine's operating system instead?

If so this is really poorly designed- an incoming fax should be isolated from everything except printing off the incoming fax.

Re:How exactly does this work?

[Anonymous Coward]

It's an attack over the phone line, so no network communication is involved in the exploit stage. That particular fax machine implements a protocol extension which allows the transmission of color faxes. This is achieved by sending a JPEG file instead of the typical black and white data. The attack exploits a bug in the JPEG decoder. With remote code execution achieved, the attack then proceeds with a payload that attacks the network to which the fax machine is connected.

The technical paper is at: https://research.checkpoint.com/sending-fax-back-to-the-dark-ages/

Why faxes are used

[Anonymous Coward]

Faxes are still used, whether digitized or old-fashioned, because of the court system. A signed and faxed form carries the weight of a physical contract. A signed and emailed form does not.

Re:Why faxes are used

[Tony Isaac]

No.

My company specializes in serving subpoenas for documents related to car accident cases, and collecting documents to deliver to the court. There is absolutely no legal advantage of fax over email, when it comes to contract enforcement or other court purposes. Legally, a simple email (signed or not) carries the weight of a signed contract.

Where fax DOES have an advantage is in HIPAA compliance. Fax is considered "secure" because it is (or was) so seldom hacked. This allows physicians and lawyers to transmit protected health information electronically, without having to worry about password-protected files. It's lazy, but effective.

Re:Fax won't go away for a very long time

[Anonymous Coward]

Fax machines aren't replaced by emailing scans. They are being replaced by holding documents up in front of a smart phone camera.

Re:just the faxes, ma'am

[SemperOSS]

Well, if you're out in the woods with no internet connection, no mobile coverage but have two copper wires connected to a telephone exchange, fax can be your saviour.

The real reason for the fax predominance, I believe, is that it is 1) "known" technology, which means that technophobes like my previous solicitor could understand it and use it, and 2) it is easier to use than most scan-to-E-mail solutions (even for tech-savvy people).

Have you tried to enter the E-mail address on the small, resistive touch-screen of a scan-2-mail device? Many people resort to using ballpoint pens (without the pen extended) as the sensitivity of the touch-screen is abysmal and the interface is often rather counter intuitive, making the whole ordeal a nightmare. I have tried quite a few and find the drop-the-paper-in-the-feeder-and-dial of fax much easier.

In my home office I rarely use fax but I do use a small scanner next to my computer to handle most of my scanning needs (receipts and such) and only go to the multi-function printer when I need high-volume scanning.

Re:just the faxes, ma'am

[kelemvor4]

Maybe we can finally get rid of one of the klugiest pieces of technology ever invented. Email anybody?

Others might describe it as one of the most solid and useful pieces of tech ever invented. As evidenced by the fact that it's widely popular after so many years and even those with no technical skills at all can send and receive faxes.

Personally, I prefer email. However if someone with no tech skills needs to send me a document image it's often far easier to just send a fax rather than spend an hour trying to teach the person to scan, then save in whatever format, and then send via email or other method (if the file is too large for email, often a problem). You get the idea.

Re:Fax me the oringal...

[nuckfuts]

My paper supply in my main printer is getting low. Could you fax me a few blank sheets? :D

I could fax you a few black sheets. Then your toner will also be low.

College tuition

[DrYak]

Hundreds of dollars just to pay for your semester.

In other saner parts of the world, hundreds of dollars *is* what you pay for the semester.

Old School Fax Attack

[IonOtter]

1. Take something black, preferably large, and place it on the copier. A t-shirt will work well, but no designs: just solid black.

2. Make four copies of the black.

3. Trim the sheets so they have no white edges or borders.

4. Assemble the 4 sheets together with Scotch tape. Trim off any excess.

5. Apply a strip of Scotch tape to the BACK of the topmost sheet, so it's half on, half off.

6. Dial the target fax machine, then feed the bottom-most sheet into the device.

7. When enough comes out of the bottom, bring it up and apply the bottom to the topmost strip of Scotch tape to create a loop out of the four sheets.

8. Go get some coffee, talk to some co-workers, maybe go to lunch.

Target fax will keep spitting out page after page of black nothing until it either runs out of paper, toner or the fuser burns out.