Faxploitation: Hackers can use old-school printers to invade your home network

(in)Secure is a weekly column that dives into the rapidly escalating topic of cybersecurity.

The more connected our devices get, the more protection they need. But that doesn’t mean a device needs to be “smart” to be hacked.

The team at Check Point Research recently showed how the fax function on a 1990s-era HP printer could be used to infiltrate network security. It was a groundbreaking demonstration, revealing just how vulnerable older technology can be to attacks. You might think that ancient printer you have in the corner of your office is harmless, but as this research shows, it might offer a backdoor into your network — and all the devices connected to it.

Sneaking in where no one was looking

Check Point Research took the stage at Def Con, the world’s largest hacking conference, to demonstrate what they called a “faxploit” in all-in-one, printer-fax machines.

faxploit hacking printers checkpoint faxploitation infographic explainer fixed
How a hacker infects a network using faxploit. CheckPoint

The fax function on your old office printer may no longer be used, but if a company or personal fax number is made public on business cards or websites, the entire system is at risk. Using just that number, the researchers gained access to the entire associated network, including all the computers and data connected to it.

The process was shockingly simple. The hacker establishes connection with the printer, implements an exploit script, and sends a malicious fax right to the printer. That gives her full control.

“… Printers are common, highly prevalent devices that are universally being ignored when it comes to cybersecurity”

Once the hacker has access to a network, she can use it as a foothold to target other machines. In the demonstration, the hacker installed a piece of malware called the EternalBlue NSA exploit on a targeted PC connected to the network. The malware pulled a specific document from the computer and printed it out on a remote fax machine.

Other vulnerabilities noted by Check Point Research include “tampering with fax content” and “sending a copy of every fax that a customer sends to their bank.” While those fax-specific risks might not sound scary, anytime a hacker gains access to a network and the connected computers, data is up for grabs. Fax is often used for sensitive and important documents, and the ability to alter a fax could certainly appeal to hackers looking to make a buck.

But what makes printers so vulnerable? We spoke with the CEO of Symphion, Jim LaRoe, who knows firsthand what makes this research so troublesome.

“The reason [the faxploit] caught people’s attention is because printers are common, highly prevalent devices that are universally being ignored when it comes to cybersecurity,” LaRoe told Digital Trends. “Printers are servers that transmit, use, and store sensitive (and valuable information), that provide on-ramps to other valuable digital assets inside companies.”

Though some printers have multiple servers and hard drives built into them, they aren’t treated with the same attention as other devices. Desktops and laptops are locked down by IT departments while printers often go unnoticed and become a security liability.

“The bad guys follow the valuables and they can’t steal jewelry or cash through a printer.”

“A typical server is inside the company’s data center on highly monitored, controlled and protected network, and is watched under the careful eye of trained system administrator,” said LaRoe. “Conversely, printers are most often not on a separate network, and even if they are, are not managed for security and are often on wheels in the middle of offices, or say an emergency room, with physical (and often digital) access to everyone.”

The faxploit isn’t the only recent vulnerability found in printers. Just a couple months ago, HP launched a bug bounty program specifically for printer security, sparked by BugCrowd’s 2018 “State of Bug Bounty” report. The report showed that print vulnerabilities have increased 21 percent in the past year.

faxploit hacking printers faxploitation printer fax desk hero
Getty Images

LaRoe explained printers are often deployed on networks with “default administrator passwords and 40-60 open ports,” which makes them relatively easy to compromise.

Clearly, printer security has a long way to go.

Securing your printers

Though all of this applies to personal homes as much as large-scale organizations, LaRoe reminded us that there’s far less incentive for a hacker to pull off something like a faxploit on a home printer.

“As we all know, for the bad guys, [faxploit] is now a published recipe for cooking up bad thing.”

“Many of those threat vectors are presented at home, but unlike business, most homes do not have high value digital assets for someone to steal or deny service to or ransomware computers for,” said LaRoe. “The bad guys follow the valuables and they can’t steal jewelry or cash through a printer.”

However, LaRoe said the prevalence of internet of things devices in the home gives even more power to an indirect entry point like the printer. The more connected devices are locked up behind a single lock, the more reward there is for a hacker to break it.

When it comes to the faxploit itself, it’s still thankfully theoretical. Hackers haven’t been caught using this tactic quite yet, and Check Point Research worked with HP to develop a patch for its exploit. Yet LaRoe thinks this is just the tip of the iceberg, as evidenced by the pages and pages of “printer hacks” available on Google. Some are ways to get more color from your printer. Others are closer to something you’d see at Def Con.

Checkpoint Faxploitation network infographic
CheckPoint

“As we all know, for the bad guys, it is now a published recipe for cooking up bad things,” said LaRoe, in reference to the faxploit.

There are solutions, of course, such as the one LaRoe has at Symphion, which involves hands-on surveillance and monitoring of a company’s print assets. Check Point Research suggests segmenting your printer into a separate network as an important strategy to shut off access to the rest of your network. But for the average person, simple tactics like changing the default password of your networked printer, and installing the latest firmware, are always recommended.

The faxploit doesn’t require every person needs to sell their old fax machine, you should at least look at your old fax machine with suspicion.

Emerging Tech

Awesome Tech You Can’t Buy Yet: Self-balancing skates, tiny tripods, and more

Check out our roundup of the best new crowdfunding projects and product announcements that hit the Web this week. You can't buy this stuff yet, but it sure is fun to gawk!
Computing

Wi-Fi vulnerability could allow attackers to steal your data on unencrypted sites

A 20-year-old security flaw in the design of the Wi-Fi standard and how computers communicate using the transmission control protocol could allow hackers to perform a web cache poisoning attack to steal your data and login information.
Product Review

Canon Pixma iP8720 review

The Canon Pixma iP8720 is a wide-format, single-function home printer that’s ideal for photos, crafts, and documents.
Social Media

Facebook is paying cash rewards if you find vulnerabilities in third-party apps

As part of efforts to put the Cambridge Analytica scandal and related issues behind it, Facebook said this week it's expanding its bug bounty program to include third-party apps and websites that could potentially misuse its data.
Product Review

The powerhouse Alienware 17 R5 will leave your desktop in the dust

With a 17-inch display and a chassis weighing in at nearly 10 pounds, the Alienware 17 R5 is truly massive. Between its weight and its hardware, it’s certainly outfitted like a gaming desktop so let’s find out if it performs like one.
Computing

Edit, sign, append, and save with 12 of the best PDF editors

There are plenty of PDF editors to be had online, and though the selection is robust, finding a solid solution with the tools you need can be tough. Here, we've rounded up best PDF editors, so you can edit no matter your budget or OS.
Product Review

The HP Chromebook x2 takes Chrome to the next level

HP’s Chromebook x2 acts a lot like Microsoft’s Surface Book 2, with a well-equipped tablet that plugs into a keyboard base that’s heavy enough to keep the combination mostly stable. Is this premium Chromebook the best one you can buy?
Computing

Pain in the wrists? Type in comfort with one of these great ergonomic keyboards

Long typing sessions can leave anyone's wrists aching, but if you have one of the best ergonomic keyboards, that doesn't have to be the case. Our list of favorites will support good typing posture while being comfortable to use.
Gaming

Dive head first into the best experiences available now on the Oculus Rift

The Oculus Rift brought back virtual reality and put a modern twist to it. Grab your Touch Controllers, put on your VR headset, and jump into the fun with some of the best Oculus Rift games available now.
Computing

Ripple cryptocurrency jumps 70 percent in 24 hours after news of bank deal

The Ripple cryptocurrency has seen its value reach the highest point since late 2017 after a tease from a Ripple Labs regulator suggested it could soon be adopted by banks for international money transfers.
Computing

Google tells lawmakers it allows other apps access to your Gmail

Google admitted to lawmakers in a letter that its privacy policy allows third-party apps access to the email messages of its 1.4 billion Gmail users. Google says the apps need the consent of users before access is granted.
Computing

From beautiful to downright weird, check out these great dual monitor wallpapers

Multitasking with two monitors doesn't necessarily mean you need to split your screens with two separate wallpapers. From beautiful to downright weird, here are our top sites for finding the best dual monitor wallpapers for you.
Computing

Gaming on a laptop has never been better. These are your best options

Gaming desktops are powerful, but they tie you down to your desk. For those of us who prefer a more mobile experience, here are the best gaming laptops on the market, ranging from budget machines to maxed-out, wallet-emptying PCs.
Computing

Tired of paying for shipping? Here's how to set up an Amazon Prime account

Want to know how to sign up for Amazon Prime? It's easier than you might think and even comes with a free trial so that you can enjoy all of its benefits for 30 days risk-free. Just follow these steps.