Faxploitation: Hackers can use old-school printers to invade your home network

(in)Secure is a weekly column that dives into the rapidly escalating topic of cybersecurity.

The more connected our devices get, the more protection they need. But that doesn’t mean a device needs to be “smart” to be hacked.

The team at Check Point Research recently showed how the fax function on a 1990s-era HP printer could be used to infiltrate network security. It was a groundbreaking demonstration, revealing just how vulnerable older technology can be to attacks. You might think that ancient printer you have in the corner of your office is harmless, but as this research shows, it might offer a backdoor into your network — and all the devices connected to it.

Sneaking in where no one was looking

Check Point Research took the stage at Def Con, the world’s largest hacking conference, to demonstrate what they called a “faxploit” in all-in-one, printer-fax machines.

The fax function on your old office printer may no longer be used, but if a company or personal fax number is made public on business cards or websites, the entire system is at risk. Using just that number, the researchers gained access to the entire associated network, including all the computers and data connected to it.

The process was shockingly simple. The hacker establishes connection with the printer, implements an exploit script, and sends a malicious fax right to the printer. That gives her full control.

Once the hacker has access to a network, she can use it as a foothold to target other machines. In the demonstration, the hacker installed a piece of malware called the EternalBlue NSA exploit on a targeted PC connected to the network. The malware pulled a specific document from the computer and printed it out on a remote fax machine.

Other vulnerabilities noted by Check Point Research include “tampering with fax content” and “sending a copy of every fax that a customer sends to their bank.” While those fax-specific risks might not sound scary, anytime a hacker gains access to a network and the connected computers, data is up for grabs. Fax is often used for sensitive and important documents, and the ability to alter a fax could certainly appeal to hackers looking to make a buck.

But what makes printers so vulnerable? We spoke with the CEO of Symphion, Jim LaRoe, who knows firsthand what makes this research so troublesome.

“The reason [the faxploit] caught people’s attention is because printers are common, highly prevalent devices that are universally being ignored when it comes to cybersecurity,” LaRoe told Digital Trends. “Printers are servers that transmit, use, and store sensitive (and valuable information), that provide on-ramps to other valuable digital assets inside companies.”

Though some printers have multiple servers and hard drives built into them, they aren’t treated with the same attention as other devices. Desktops and laptops are locked down by IT departments while printers often go unnoticed and become a security liability.

“A typical server is inside the company’s data center on highly monitored, controlled and protected network, and is watched under the careful eye of trained system administrator,” said LaRoe. “Conversely, printers are most often not on a separate network, and even if they are, are not managed for security and are often on wheels in the middle of offices, or say an emergency room, with physical (and often digital) access to everyone.”

The faxploit isn’t the only recent vulnerability found in printers. Just a couple months ago, HP launched a bug bounty program specifically for printer security, sparked by BugCrowd’s 2018 “State of Bug Bounty” report. The report showed that print vulnerabilities have increased 21 percent in the past year.

LaRoe explained printers are often deployed on networks with “default administrator passwords and 40-60 open ports,” which makes them relatively easy to compromise.

Clearly, printer security has a long way to go.

Securing your printers

Though all of this applies to personal homes as much as large-scale organizations, LaRoe reminded us that there’s far less incentive for a hacker to pull off something like a faxploit on a home printer.

“Many of those threat vectors are presented at home, but unlike business, most homes do not have high value digital assets for someone to steal or deny service to or ransomware computers for,” said LaRoe. “The bad guys follow the valuables and they can’t steal jewelry or cash through a printer.”

However, LaRoe said the prevalence of internet of things devices in the home gives even more power to an indirect entry point like the printer. The more connected devices are locked up behind a single lock, the more reward there is for a hacker to break it.

When it comes to the faxploit itself, it’s still thankfully theoretical. Hackers haven’t been caught using this tactic quite yet, and Check Point Research worked with HP to develop a patch for its exploit. Yet LaRoe thinks this is just the tip of the iceberg, as evidenced by the pages and pages of “printer hacks” available on Google. Some are ways to get more color from your printer. Others are closer to something you’d see at Def Con.

“As we all know, for the bad guys, it is now a published recipe for cooking up bad things,” said LaRoe, in reference to the faxploit.

There are solutions, of course, such as the one LaRoe has at Symphion, which involves hands-on surveillance and monitoring of a company’s print assets. Check Point Research suggests segmenting your printer into a separate network as an important strategy to shut off access to the rest of your network. But for the average person, simple tactics like changing the default password of your networked printer, and installing the latest firmware, are always recommended.

The faxploit doesn’t require every person needs to sell their old fax machine, you should at least look at your old fax machine with suspicion.